VSELFAI task control
HelpDID documentDID

VSELF SUPPORT

Help center

Learn how to authorize an AI task, hand it off securely, review the result, verify the record, and revoke authority.

VSELF Agent Protocol 1.1

One integration, reusable authorization

The Agent polls its encrypted inbox, verifies each signed grant, then opens only the task room it was authorized to use.
Create a connectionAPI

All topics

8 topics
Getting startedStart with one bounded taskCreate, share, and verify a first authorization in a few minutes.
What to do
  1. No account is required. Open Authorize and VSELF creates a non-exportable P-256 controller key in this browser.
  2. Describe one agent task, required evidence, allowed actions, safeguards, and an expiry.
  3. Sign the authorization, create an encrypted task room, and send only the AI link to the agent you chose.
  4. The agent can accept, request changes, or decline. After accepting, it returns a summary and evidence in the same room.
  5. Review the returned work and accept or reject it. VSELF signs the outcome receipt; share the separate verification link or QR code when someone else needs to inspect the record.
Open workspace
WorkflowsAuthorize an agentChoose the work, allowed actions, safeguards, and expiry before signing.
What to do
  1. Use a specific agent name and DID or URL so the recipient is unambiguous.
  2. Keep the scope narrow. External actions or fewer safeguards raise the review warning.
  3. Signing binds the task, evidence requirement, permissions, safeguards, expiry, controller, and challenge into one envelope.
  4. Create an encrypted room when the task needs a real handoff. The owner link can decide and revoke, the AI link can respond and submit, and the verification link is read-only.
  5. Each link carries its own capability and the decryption key in the URL fragment. VSELF stores encrypted content and status, but anyone holding a link has that link’s access, so never forward the owner link.
Open workspace
WorkflowsVerify an envelopeCheck a grant independently before trusting an agent’s result.
What to do
  1. Paste a VSELF authorization or outcome receipt JSON, or load the latest grant created on this device.
  2. Run Verify to check its P-256 signatures, controller DID, VSELF namespace, timestamps, required scope, and local revocation state.
  3. A valid authorization unlocks Review returned work. Enter the AI’s summary and evidence, then accept or reject it as the original controller.
  4. Treat Valid as proof of key control and stated authority, not proof that the agent’s result is true. The human review remains decisive.
Open workspace
WorkflowsRevoke approvalRecord that a previously signed authorization must stop.
What to do
  1. Open the owner task-room link and use Revoke to stop further agent actions for that room.
  2. You can also choose a signed grant stored on this device, add a useful reason, and revoke its local authorization record.
  3. Future room views show the online revocation. Local verification reports the device record; export the audit log when that stop record must travel independently.
Open workspace
Identity & securityUnderstand the local controllerLearn where the signing key lives and what key rotation changes.
What to do
  1. The browser generates a non-exportable P-256 private key and stores its CryptoKey in IndexedDB.
  2. The public key becomes a did:jwk controller identifier and is included in each signed envelope.
  3. Rotating the key changes the controller for future grants. Existing envelopes keep their original public key and remain verifiable.
Open workspace
Identity & securityResolve the did:web documentInspect the public protocol document and its service endpoints.
What to do
  1. did:web:vself.com resolves through https://vself.com/.well-known/did.json once the custom domain serves this deployment.
  2. The document declares VSELF’s authorization, verification, and revocation service endpoints.
  3. The service DID names the protocol namespace; the browser’s did:jwk identifies the key that actually signs a grant.
Open DID document
Identity & securityExport an audit recordKeep a portable JSON record of grants and local revocations.
What to do
  1. The recent-activity ledger combines grants, result decisions, revocations, and the non-secret status of task rooms saved by this browser.
  2. Export Audit log downloads a JSON snapshot with the service DID, controller, grants, signed outcome receipts, revocation records, and room references without capability URLs.
  3. Each outcome receipt embeds its original authorization, so another reviewer can verify the complete task-to-decision record from one JSON file or the room’s read-only verification link.
Open workspace
TroubleshootingFix common problemsRecover from clipboard, key, document, and missing-grant issues.
What to do
  1. If clipboard access is blocked, paste the envelope manually or use its downloaded JSON file.
  2. If no grants appear, confirm you are using the same browser profile and device that signed them.
  3. If the DID document reports a domain issue, the deployment is usable locally but vself.com still needs to serve it for global did:web resolution.
Open workspace

FAQ

Common questions

Short answers about keys, identity, portability, and trust.

Can VSELF recover my private key?

No. The private key is non-exportable and stays in this browser profile. Rotating creates a new controller; it does not recover the previous key.

Does a valid envelope prove a legal identity?

No. It proves that the key represented by the controller signed the stated scope. Legal identity and truthful task completion require separate evidence.

Does revocation sync across devices?

Sign in to own long-lived Agent connections, revoke access from any device, and restore encrypted connection keys after browser data is cleared.

Do I need an account to create or verify an authorization?

Public pages and one-time verification stay open. Sign in before creating a persistent Agent connection.

Who can open an encrypted task room?

Anyone holding one of its links. The owner, AI, and verification links carry different capabilities plus the decryption key in the URL fragment. Share only the least-privileged link needed, and never forward the owner link.

What does an outcome receipt prove?

It binds the original signed authorization, returned summary and evidence, and the controller’s accept or reject decision into one independently verifiable JSON record.

Why can the DID document say domain binding is pending?

did:web:vself.com is globally resolvable only when vself.com serves the well-known DID document from this deployment.