From zero to first authorize call — in order.

Plain take

Plain take

Start with the protocol. Read the rails. Pick your SDK.

• Three rails. Seven docs. One quickstart.
• TypeScript or Python or REST.
• Sandbox tokens are free.
• Pilot tokens take one day.

Curated reading order

From zero to first authorize call — in order.

Total reading time end-to-end: ~3 hours. Steps 1–5 are read-only (~75 minutes). steps 6–9 involve running code (~105 minutes including download and warm-up). Each step listed below carries a target read or run time.

1. 1. The problem — landing + Protocol overview. Read time: ~10 min. Why authority cannot be a per-system problem. what the six primitives are. what KYE Protocol™ proves at runtime.
2. 2. The vocabulary — github.com/KYE-Protocol/vocabulary. Read time: ~15 min. Entity types, action types, decision codes, reason codes, capability kinds, lifecycle states, signal types, obligations, redaction fields. 501 dictionary files.
3. 3. The ID format — github.com/KYE-Protocol/id-format. Read time: ~10 min. URN scheme: kye:<class>:<trust-domain>:<subclass>:<local>. 18 documented classes.
4. 4. Schemas + examples — github.com/KYE-Protocol/examples. Read time: ~25 min. 1165 JSON Schemas + 1449 validated examples. node scripts/validate-schemas.js walks every example through ajv on every CI run. Includes kye.search_result.v1, kye.agent_memory.v1, kye.data_flow_graph.v1, kye.report.v1.
5. 4a. New sub-engine CLIs — Read time: ~5 min. Four CLI verbs added 2026-05-17: kye search (KYE™ Native Search Engine™) · kye memory (KYE™ Memory Engine™) · kye data-flow (KYE™ Data Mapping Agent™) · kye report (KYE™ Reporting Engine™). Each surface ships a signed envelope, replayable offline from the per-tenant signing pubkey. The construction of each engine is proprietary and is not disclosed in this repository.
6. 5. SDK quickstart — Developers page quickstart. Read time: ~15 min. TypeScript and Python at full surface parity (HTTP client + crypto + errors + retry + webhook verifier + JWS HS256 / RS256). Go covers the core surface, with extension endpoints rolling out.
7. 6. KYE™ Reference Gateway™ — Run time: ~30 min. Run with npx wrangler dev, exercise POST /v1/runtime/authorize against the embedded fixture pack. Production hardening (auth, rate limit, body-size, structured logging, JSONL audit chain) is opt-in via env vars. the full hardening register ships under commercial licence to design partners (request the procurement pack).
8. 7. Conformance + certification — certification.html. Read time + run time: ~30 min. 5-tier badge ladder (L0 Declared → L4 KYE™ Certified™) plus the capability-scoped Conformance ladder (Core / Authority / Capability / Evidence Conformant™ — program in development). 133 fixtures, all passing in CI against the reference Gateway.
9. 8. Sector profile — pick yours from sectors.html. Read time: ~30 min for one profile. 11 Connector Profile™ families, 10 canonical profiles +. 70 rule packs +. 61 sector packs +. 501 dictionaries. Adopt only what you need. Core never shifts beneath you.
10. 8a. Continuity + Discoverability profiles — KYE™ Continuity Profile™ and KYE™ Discoverability Profile™. Read time: ~20 min combined. Continuity binds interpreted-vs-declared intent + multi-dimension state + pressure + incentive + oversight into a signed pre-commit verdict (decision values: continuity_preserved, continuity_degraded, continuity_broken. ten drift types). Discoverability turns the cryptographically-bound authority graph into a queryable surface with discovery policy, row-level masking, federation traversal, and signed audit emission per query (six discovery modes. three risk-discovery types).
11. 8b. Ontology profile — KYE™ Ontology Profile™. Read time: ~15 min. The semantic layer that gives shared meaning to entities, authorities, capabilities, scopes, states, decisions, evidence, profiles, connectors and sectors. Defines twelve ontology domains, a stable predicate dictionary, and six explicit mapping types (equivalent, related_not_identical, not_equivalent, aliased_by, subsumes, subsumed_by) so OAuth scopes, IAM roles, payment mandates and healthcare consents map into KYE™ without false equivalence. JSON-LD context published. RDF / OWL optional.
12. 8c. Operating Model profile — KYE™ Operating Model Profile™. Read time: ~20 min. The enterprise adoption layer. Ten ordered stages from use-case intake through readiness assessment, Entity Authority Record™, Authority Gates™, Commit Boundary™, runtime decision, signed adoption Evidence Pack™, review and improve. Eight gate types (payment, external message, contract, clinical, infrastructure, data export, credential rotation, evidence export). risk tiers low / medium / high / critical. lifecycle states proposed → pilot → controlled_production → production → deprecated → suspended → revoked.
13. 8d. Assurance Card profile — KYE™ Assurance Card Profile™. Read time: ~20 min. The lifecycle assurance layer. Turns runtime evidence into a living assurance record per delegated entity. Eight lifecycle stages (design → pilot → deploy → monitor → incident_review → scope_change_review → retention_review → decommission). KYE™ Human Involvement Plan™ enforced as a runtime policy gate (deny on bypass). Provenance + supply-chain evidence for models, datasets, tools, suppliers, licences, hardware. KYE™ Assurance Review Cycle™ with ten triggers (scheduled, scope_change, new_capability, incident, risk_state_change, model_update, authority_change, supplier_change, licence_change, retention, decommission). decommissioning plan with cascade-revocation scope. Defence-grade reference: Alan Turing Institute / Accenture / UK MoD AI assurance work.
14. 8e. Formal Rules profile — KYE™ Formal Rules Profile™. Read time: ~20 min. The rights, obligations and governance layer. Six rule families (permission, obligation, prohibition, power, immunity, exception) plus meta_governance. Compact normative operators (P, O, F, Pow, Imm, Ex). Eleven normative objects covering rules, permissions, obligations (with full lifecycle), prohibitions, powers, exceptions, governance rules, conflicts, proofs and obligation states. KYE™ Rule Prover™ checks consistency before deployment. KYE™ Control Compiler™ compiles formal rules into runtime authority gates + commit boundaries + signal events + evidence requirements. KYE™ Obligation Ledger™ tracks every obligation lifecycle hash-chained into the audit ledger.
15. 8f. Action Admissibility™ profile — KYE™ Action Admissibility Profile™. Read time: ~15 min. The upstream pre-action layer. Checks whether a proposed action is admissible into the authority pipeline before any authority, formal-rule or commit-boundary check runs. Six decision values (admit, reject, require_clarification, require_human_review, quarantine, route_to_authority_check). fifteen inadmissibility classes (intent / scope / data / continuity / coercion / incentive / jurisdiction / accountability). KYE™ Admissibility Engine™ emits signed admissibility decision + admissibility evidence hash-chained into the audit ledger.
16. 9. Whitepaper — whitepaper.html. Read time: ~45 min. The normative spec + governance + roadmap, end to end. Read this before any pilot scoping conversation.

Stuck? Open a discussion at KYE-Protocol/Discussions or use the Talk to us modal — pick the "Adoption” topic.

Reading order by role

Pick the path that matches your job.

What it is. Why it matters. What to do next.

Ready to see your AI agents flagged?

Start in shadow mode. We’ll deliver your first Evidence Pack™ in 4–8 weeks.

Canonical KYE™ surfaces referenced on this page: Authority Graph™ · Evidence Pack™ · KYE™ Conformance Pack™ · KYE Protocol™.