--- id: 01995a3e-6c0e-7f2a-9b1d-3e8f4a2c7d10 slug: ai-handshake aliases: [] title: The AI Handshake Convention question: How do two parties, or their agents, find out whether and how to act together before anything is committed? status: published version: 0.1.0 language: en reviewed_at: 2026-09-19 reviewed_by: martin-schubert current_through: 2026-09-19 changes: - date: 2026-09-19 kind: version note: "v0.1.0, first public draft for reaction. Nothing in it is stable yet." - date: 2026-09-19 kind: clarification note: "Confirmed by the owner as v0.1.0 (review on issue #34). budget-frame and exit-conditions wait for v0.2." --- # The AI Handshake Convention Version 0.1.0, draft, 2026-09-19. Published by DATENMASSIV GmbH for the AI Handshake initiative (KI-Handschlag). The current version lives at https://ki-handschlag.de/ai-handshake.md; the German Guide explains it in part "Wie du handelst". This Convention proposes. It does not prescribe. A party adopts it by writing its own Instance (a `handshake.md`) and, if it wishes, by signing the Principles in the Directory. The key words MUST, MUST NOT, SHOULD and MAY are used as in RFC 2119 and appear only in section 3 and section 5; everything else is a proposal with a default. ## 1. What this is for More and more exchanges are shaped by AI before a person sees them: a chatbot answers for a bank, an assistant drafts a letter, an agent negotiates a delivery date with another agent. The parties in such an exchange rarely know who or what is on the other side, what it already knows about them, what it may commit to, and who is accountable when it goes wrong. The Handshake is the pre-conversation that settles this before the actual exchange starts. This Convention gives it a shared vocabulary, four principles, a catalogue of criteria each party declares, and a procedure with a defined exit. It is written for four party roles: a private person, a person at work, an organization (including institutions and the state), and an agent acting for any of them. A person is not a party; a person takes one of these roles in a given situation. ## 2. Terms Party, Instance, scoped projection, mandate, boundary, escalation, clean exit, declared relationship, effective mediation and verified outcome are used as defined in the initiative's glossary (CONTEXT.md in the initiative's repository). Two are restated here because the Convention turns on them: - **Declared relationship**: what the parties represent as identity, purpose, authority and conditions of an interaction. - **Effective mediation**: the people, models, agents, data, policies and tools that actually shape it. A handshake is the act of aligning the two: the declared relationship must be a fair account of the effective mediation, to the extent the criteria below require. ## 3. Principles The four principles are ordered; each presupposes the one before it. 1. **Ethical.** A party MUST NOT exploit the other side's half-knowledge, weakness or false certainty. The asymmetry of knowledge is a condition to dissolve together, not a lever. 2. **Legal.** What is agreed MUST hold up before law and rule. A party MUST always be able to learn whether it is dealing with a person or an agent, and who stands behind a commitment. 3. **Transparent.** A party MUST state the assumptions under which a claim, price or recommendation holds, and SHOULD show the variants and their trade-offs. Radical transparency is the default: whoever discloses most cleanly wins the audit that AI makes possible anyway. 4. **Productive.** Every run of the procedure MUST have a defined exit: a close, an agreed next step, or a documented no. Motion is not progress. Signing the Principles means committing to these four sentences in one's own conduct and in one's agents' configuration. It is the entry condition for a Directory entry and nothing more; the operator checks identity, not conduct. ## 4. Criteria catalogue Each criterion has two sides: - **Disclosure**: what a party's own agent may reveal about the party. Levels: `open` (volunteered at the start), `on-request` (given when the counterpart asks), `never`. - **Requirement**: what a party demands from the counterpart before the exchange proceeds. Levels: `mandatory` (a missing answer stops the handshake or escalates to a person), `desired` (asked for, proceeds without), `optional` (not asked). The table gives the proposed default per party role, written `disclosure / requirement`. A party's Instance overrides any cell. | id | Criterion | What it answers | private | work | organization | agent | | --- | --- | --- | --- | --- | --- | --- | | `identity` | Identity | Who am I, and whom does my agent represent? | on-request / mandatory | open / mandatory | open / mandatory | open / mandatory | | `intent` | Intent and goal | What do I want from this exchange (the goal, not the solution)? | open / mandatory | open / mandatory | open / desired | open / mandatory | | `mandate` | Mandate | What may my agent commit to, up to which amount, until when, and who can revoke it? | on-request / mandatory | on-request / mandatory | on-request / mandatory | open / mandatory | | `values` | Values and red lines | What will I not do, regardless of price? | on-request / optional | on-request / desired | open / desired | open / desired | | `counterpart-form` | Form of the counterpart | Is the other side a person, an agent, or a person assisted by an agent? | open / mandatory | open / mandatory | open / mandatory | open / mandatory | | `evidence` | Duty of evidence | Which claims will I back with evidence, and what counts as evidence? | on-request / desired | open / desired | open / mandatory | open / mandatory | | `sources` | Citation and currency | Which sources does my agent use, and how old may they be? Minimum currency: a date per claim. | never / optional | on-request / desired | on-request / desired | open / mandatory | | `data-use` | Data use | What does my agent learn about the counterpart, what does it keep, for how long, and does it train on it? | on-request / mandatory | on-request / mandatory | open / mandatory | open / mandatory | | `escalation` | Escalation to a person | When does my agent stop and hand over, and to whom? | on-request / mandatory | open / mandatory | open / mandatory | open / mandatory | | `recording` | Recording | Is the exchange recorded, where, and who may read it? | on-request / mandatory | open / mandatory | open / mandatory | open / mandatory | Two candidates are not in the catalogue yet and are open for reaction: `budget-frame` (the rough frame for money and time, disclosed before the gate) and `exit-conditions` (the conditions under which my agent ends the run). Both may fold into `mandate`. The `private` column deliberately reveals least by default and demands most. A private person's agent volunteers only intent and the fact that it is an agent, and refuses to proceed if the counterpart will not say who it is, what it may commit to, what it does with the data, how one reaches a person, and whether the exchange is recorded. ## 5. The pre-conversation The negotiation loop of the Guide applied to two agents, or a person and an agent. Five phases, one controlled return, three exits. 1. **Disclose.** Each side puts its `open` criteria on the table and answers the counterpart's `mandatory` requirements. An agent MUST state that it is an agent and whom it represents before anything else. 2. **Frame.** The goal is separated from the solution each side brought. A generic recommendation (what an AI produced beforehand) is placed as the median case, not the answer for this one. 3. **Gate.** Before effort or money is incurred, an authorization within the agreed frame MUST exist. An agent without a mandate covering the next step MUST stop here and escalate, documented and without resentment. The transition into the paid or binding zone is announced, not concealed. 4. **Co-specify.** Beyond the gate the shared frame becomes a bounded statement of what will be done. Technology last. What cannot be settled is recorded as an assumption, not asserted as fact. 5. **Close.** The result is fixed in a form that survives an audit: justified, with variants and honest trade-offs. "Not now, not like this" is a close. **Controlled return.** New input returns the run to phase 2, never to a fresh unpriced loop; larger changes of direction are bundled at a milestone. **Exits.** On asymmetry abuse, the weaker side MAY at any time ask for a pause, a second opinion or the disclosure of assumptions, and this MUST NOT be read as distrust. On dispersion, the controlled return is enforced. When no budget, no binding yes and no mandate appear despite a clear announcement, the run ends in a clean exit: friendly, documented, no continuing commitment. ## 6. The Instance A party's Instance is a `handshake.md` file: YAML frontmatter for the declarations, markdown for anything a person should read. It is private by default and shared only as a scoped projection: the minimum set of fields the counterpart's requirements need. ```yaml convention: ai-handshake convention_version: 0.1.0 party: role: private # private | work | organization | agent id: ... # a stable identifier the party controls; a URL, a handle, a legal name represents: ... # agents only: the party id they act for criteria: identity: { disclosure: on-request, requirement: mandatory } intent: { disclosure: open, requirement: mandatory, value: "..." } mandate: { disclosure: on-request, requirement: mandatory, value: { commit_up_to: "0 EUR", until: "2026-12-31", revocable_by: "..." } } values: { disclosure: on-request, requirement: optional, value: ["..."] } counterpart-form: { disclosure: open, requirement: mandatory } evidence: { disclosure: on-request, requirement: desired } sources: { disclosure: never, requirement: optional, min_currency_days: 90 } data-use: { disclosure: on-request, requirement: mandatory, value: { retain_days: 0, train: false } } escalation: { disclosure: on-request, requirement: mandatory, value: { to: "a person", when: ["authority_exceeded", "red_line", "evidence_conflict"] } } recording: { disclosure: on-request, requirement: mandatory, value: { recorded: false } } projections: default: [counterpart-form, intent] ``` A `value` is what the party declares; `disclosure` and `requirement` are the two sides from section 4. Secrets, tokens and private topology MUST NOT appear in an Instance. The Instance declares; the party's own systems enforce. ## 7. Starter prompt Paste this into your own assistant at the start of any exchange with a service, a chatbot or another agent. Replace the bracketed parts or delete them. ```text Before we go further, run a short handshake with the other side according to the AI Handshake Convention v0.1 (https://ki-handschlag.de/ai-handshake.md). Say that you are an agent acting for me. Tell them my goal: [what I want], not a solution. Ask them, and do not continue until they answer: 1. Who are you, and whom do you represent? Are you a person or an agent? 2. What may you commit to, and who stands behind it? 3. What do you learn about me in this exchange, what do you keep, for how long, and do you train on it? 4. How do I reach a person if this goes wrong? 5. Is this exchange recorded, and who can read it? Do not reveal anything about me beyond my goal unless they ask and I have allowed it: [what you may tell them]. Do not agree to anything that costs money or binds me. If they ask for that, stop and hand the decision to me with a short brief: what they offered, what they assumed, what it would cost, and what you recommend. If they will not answer questions 1 to 5, end the conversation politely and tell me why. ``` ## 8. Versioning This file is versioned `major.minor.patch`. A change of meaning bumps minor while the major is 0; corrections are recorded in the frontmatter change log and announced on the initiative's news stream. Every published version stays retrievable. How proposals to the Convention are made and decided is the subject of the governance ticket and will be stated here from v0.2. ## Changelog - 0.1.0 (2026-09-19): first public draft for reaction.