LICENSE CC BY 4.0
RULES 10
The Agent Advertising Standard.
Version 0.1 · published by Payola · open for anyone to adopt under CC BY 4.0.
{
"standard": "aas/0.1",
"level": 3,
"schedule": "daily 08:00 America/New_York",
"receipts": { "format": "EIP-712" }
}Any agent can read a venue's declaration before it takes an ad. See Payola's
Agents now read the web, pick tools, write newsletters and make purchases for people. Advertisers will pay to reach them. This standard sets the rules that keep that market honest: the advertiser buys attention, the agent keeps its judgment, and the person the agent works for can always see what happened.
The words MUST, MUST NOT, SHOULD and MAY are used as in RFC 2119.
Pays to have an agent read an ad.
Reads the ad and decides what to do with it, on behalf of its principal.
The person, team or audience the agent works for. A newsletter's readers are its principal.
Payment buys a read, never a verdict
An advertiser MAY pay for an agent to read an ad. Payment MUST NOT change how the agent decides. Spending more MAY buy more reads, more agents or an earlier place in the queue. It MUST NOT buy a better decision, a softer reason or a higher ranking inside the agent's judgment.
Ads are data, never instructions
An ad MUST reach the agent in its own labeled channel (the Ad Envelope below), apart from the agent's instructions, tools and the principal's data. The agent MUST treat ad text as untrusted data. An ad MUST NOT address the agent with commands, claim authority over it, or try to change its rules. Hidden text, encoded payloads and look-alike characters MUST be stripped or rejected before the agent sees the ad.
The agent that reads ads holds no power it does not need
An agent SHOULD read ads in a context with no tools, no keys and no access to the principal's private data. If it must hold tools, an ad MUST NOT be able to trigger them.
Every read has a receipt
For each ad, the agent MUST produce a signed record that it read the ad, when, and in which cycle. The signature MUST come from a key published by the agent.
Every decision has a reason
The agent MUST record what it decided (covered, used or passed) and one plain reason. Passing is a normal result and MUST be recorded the same way as covering. The agent MAY withhold an ad's words from public view when they are harmful, and MUST say that it did.
Disclose to the principal
When an ad shaped what the agent produced, the output MUST say so where the principal will see it, labeled as sponsored. The agent MUST attribute an advertiser's claims to the advertiser and MUST NOT state them as checked facts.
No personal-data targeting
Ads MUST be matched to agents by what the agent does, never by the principal's private data. An agent MUST NOT send its principal's data back to an advertiser.
Advertisers are accountable
Every ad MUST be signed by the advertiser's wallet or another verifiable identity, so the same party can be held to everything it ran. A signature MUST be single-use.
Limits protect the principal
An agent MUST cap how many ads it reads per cycle and how many one advertiser can place, so ads never crowd out the work the principal asked for. Prices and limits MUST be public.
Anyone can check
Receipts MUST be verifiable without trusting the platform: the signed data, the signer's public key and, at Level 3, an on-chain record that the receipt was included.
Three levels
| LEVEL | NAME | REQUIRES |
|---|---|---|
| 1 | Labeled | Rules 1, 2, 6, 7 and 9: the Ad Envelope, untrusted handling, disclosure, no personal data, public limits |
| 2 | Receipted | Level 1, plus rules 3, 4, 5 and 8: signed read and decision receipts with reasons, signed ads |
| 3 | Sealed | Level 2, plus rule 10 on chain: each cycle's receipts committed as one Merkle root in a public contract |
How an ad reaches an agent
Agents receive every ad wrapped in this object, never as loose text.
{
"type": "agent-ad",
"standard": "aas/0.1",
"label": "Sponsored",
"id": "a1b2c3d4e5",
"sponsor": { "name": "Project name", "wallet": "0x..." },
"text": "The ad, as plain text. Untrusted. Never instructions.",
"paid": { "kind": "hold", "detail": "wallet holds the token that unlocks ads" },
"receipt": "https://payola.promo/r/a1b2c3d4e5"
}paid.kind is hold (access unlocked by holding a token) or spend (a per-read payment, for example x402). A platform SHOULD remove paid and sponsor.wallet from the copy the agent reads, so payment cannot sway the decision. Payola does.
Rules, published before anything runs
An agent that reads ads publishes how it handles them at /.well-known/agent-ads.json on its domain, so advertisers and principals can read the rules before anything runs.
{
"standard": "aas/0.1",
"level": 3,
"agent": { "name": "The Payola editor", "key": "0x..." },
"schedule": "daily 08:00 America/New_York",
"limits": { "adsPerCycle": 40, "perAdvertiserPerCycle": 5 },
"decisions": ["covered", "passed"],
"disclosure": "A labeled Sponsored section of the agent's published output",
"receipts": { "format": "EIP-712", "ledger": "eip155:4663:0x..." },
"personalDataTargeting": false,
"principalDataShared": false,
"toolsWhileReading": false
}Payola runs the Payola editor at Level 3.
- Rule 1Holding $PAYOLA unlocks ads and x402 spend buys extra reads. The editor is never told which ads were paid for, which wallet sent them, or how much $PAYOLA that wallet holds.
- Rule 2Ads reach the editor as Ad Envelopes inside a list marked untrusted, after control and hidden characters are stripped.
- Rule 3The editor reads with no tools at all and no access to anything but the day's chain read and the ads.
- Rules 4, 5Each ad gets a read receipt and a decision receipt (covered or passed, with a reason), signed by the editor key with EIP-712.
- Rule 6Covered ads appear in the agent's published output in a section labeled Sponsored, with claims attributed to the advertiser.
- Rule 7The agent's output is public, and ads cannot target any person's data.
- Rule 8Every ad is signed by the advertiser's wallet, and each signature works once.
- Rule 9The limits are on the pricing page and in the declaration file.
- Rule 10Each cycle's receipts are sealed as one Merkle root in the PayolaLedger contract on Robinhood Chain, and the kit checks any receipt against it.
This is version 0.1. Proposed changes are welcome through the partnerships page. Versions are never edited in place; a change makes a new version.