SASH is an open, implementation-independent protocol for keeping protected data and privileged capabilities outside an untrusted Requester while preserving useful processing, authorized effects, and explicit completion or reconciliation evidence.
Its core principle is simple:
Requesters ask for effects, not secrets.
SASH defines interoperable objects, state transitions, cryptographic bindings, protected views, destination controls, effect profiles, and evidence receipts. A deployment may integrate vaults, identity systems, privacy engines, sandboxes, gateways, or automation platforms without turning any of them into an implicit protocol dependency.
- Domain language — normative vocabulary for roles, views, authority, effects, evidence, and assurance.
- Core protocol — roles, objects, operations, processing rules, errors, security, and conformance boundaries.
- HTTPS/JSON binding — transport, authentication, idempotency, caching, and requester-visible surfaces.
- Security model — assets, adversaries, trust boundaries, threats, mitigations, and residual limits.
- Cryptographic transcript — canonical artifacts, signatures, HPKE bindings, claims, receipts, and validation order.
- Schemas and registries — closed JSON formats and registered identifiers.
- Formal claim model — executable state and claim invariants.
- Reference implementations — Python and Node.js protocol implementations.
- Vectors and fixtures — synthetic positive and mutation cases.
- SASH Technical Preview V1 — a dated, claim-bounded research snapshot inviting independent implementation and review.
- Published Zenodo record — the citable public preprint record for Technical Preview V1.
- Tester invitation — safe test scope and the minimum report format.
- Validation guide — clean-checkout reproduction path and report checklist.
- Integrity manifest — SHA-256 digests for the frozen source and PDF.
- Rendered preview — the version-bound PDF.
SASH does not claim to invent generic agent mediation, credential use without model exposure, tokenization, pseudonymization, or privileged execution. It is not an IETF standard, a universal anonymization guarantee, a production-security certification, or a legal-compliance conclusion. Every assurance statement is bounded by the declared profile, implementation, deployment, evidence, and remaining trust assumptions.
The protocol and its machine-readable artifacts are open for implementation and evaluation. See the license files for the applicable Apache-2.0 and CC BY 4.0 terms.