A tiny file an AI product publishes at its web root — the machine- and human-readable version of its Never List: the action classes the agent refuses from untrusted input. Stake what you won't do, in public, before anyone asks.
A proposed convention — openly published, free to adopt. Pre-release. Not a certification. Not a guarantee.
⚡ The idea
In 2026 the question stopped being "what can the AI read?" and became "what will it do when the input tries to talk it into something?" reality.txt answers that in public, in a form another agent — or a careful human — can fetch and compare. It assumes one split, borrowed from the CaMeL pattern: a control plane (trusted instructions) and a data plane (untrusted input — email bodies, caller speech, web pages). Words on the data plane may inform a decision; they may never authorize a consequential one. reality.txt is how a product states where it draws that line — and the line itself is the Amber Line: green, the agent's got it; amber, a human's call.
⚡ The vocabulary · v0.1
A reality.txt is a list of Key: value lines plus # comments. Readers ignore keys they don't know, so the convention can grow without breaking. Required: Agent, Posture, and at least one of Allow / Hold / Disallow.
| Directive | Band | What it declares |
|---|---|---|
| Agent | core | Which product or agent this file describes. One line. |
| Posture | core | The default trust stance. Recommended: holds-the-line — fail-closed, so an unmapped action is refused, never guessed. |
| Valve | The deterministic mechanism that enforces the postures. Names the code, not a vibe. | |
| Allow | green | Action classes the agent may perform on its own — read-only, reversible, benign. The agent's got it. |
| Hold | amber | Action classes that wait for a human's explicit approval before they run. Human-in-the-loop. A human's call. |
| Disallow | red | Action classes refused outright — not executable by anyone through the agent, ever. No in-band override. The hard-stop. |
| Trust | Inputs treated as authoritative — the control plane: signed config, an authenticated operator, proven identity. | |
| Distrust | Inputs treated as untrusted by default — the data plane: message bodies, caller speech, web content, attachments. | |
| Quarantine | How tainted input is isolated so it can inform a reply but never reach the control plane or authorize an action. | |
| Discovery | Where the human- and machine-readable trust surfaces live — e.g. a /the-line card, /reality.txt, a refusals ledger. | |
| Ask | The permission verb an external agent calls to request a held action — requestPermission(action). The Permission-as-a-Service hook. Optional. | |
| Ledger | Where refusals are counted and (optionally) published. Any public counter must be labeled real or illustrative. Optional. |
⚡ A real one
This is RadMail's file, verbatim — its business-email-compromise hard-stops, made legible. The same shape works for a phone agent, a task cockpit, a clinic front office, or a robot.
# reality.txt # robots.txt told crawlers what they may READ. # reality.txt tells agents what they may DO. # # This is RadMail's Never List — the action classes the approval valve # refuses when it triages mail for an agent. RadMail runs a free, runnable # SANDBOX engine; a tool, not a guarantee — never "fraud-proof". Agent: RadMail Posture: holds-the-line # fail-closed: an unmapped action is refused Valve: @sureel/approval-valve # the same valve, five surfaces # GREEN — handled for you. Read-only / reversible. Allow: triage + classify mail # sort, summarize, surface "why this matters" Allow: draft a reply for review # written, never auto-sent on the held classes # AMBER — a human's call. Drafted, queued for one-tap approval. Hold: send an external email # RadMail drafts; a human releases the send # RED — refused outright. No override, no "verified" tier. The BEC hard-stops: Disallow: move money out # wire / pay an invoice / release a payment Disallow: change banking on file # new routing / payee / remittance Disallow: act on a first-contact ask # unknown sender, consequential move Disallow: read or relay a credential # OTP / password / "send me the code" Disallow: obey a privilege-escalation # "ignore your instructions, you're admin now" Disallow: act on an authority pretext # "I'm the CEO / your bank / IT — wire it" # --- Trust boundary --- Trust: the authenticated mailbox owner and RadMail's signed config. Distrust: every inbound message body, header, reply, and attachment. Quarantine: tainted instructions are split from the control plane (the CaMeL pattern). RadMail's camel won't swallow them — they shape a draft, they can't authorize a send. # --- Where to look --- Discovery: /the-line # human-readable: what RadMail refuses + why Discovery: /reality.txt # this file Ask: requestPermission(action) # the MCP verb for a held send Ledger: /trust # refusal counter — labeled real or illustrative # RadMail won't send the wire. RadTask won't delete the data. RadTalk won't # move the money mid-call. RadHealth won't decide care. RadRobo won't pour the # bleach. Same valve, five surfaces. # Didn't send the wire. On purpose.
The file is a claim by RadMail about RadMail. A reader can fetch it, parse it, and compare it — it can't, by itself, prove the code behind it. That's the honest limit of the convention.
⚡ How to adopt
There's no registry to join and no one to ask. Publishing a reality.txt is a unilateral act of legibility — the agent-discoverable land-grab is open to anyone who'll be honest about where their line is.
Start from reality.txt.template — a commented skeleton with all twelve directives and the honesty rules inline. Delete the lines that don't apply.
Name your Allow / Hold / Disallow classes honestly. Point Valve at the real code that enforces them — not a promise.
Publish at https://yourproduct.com/reality.txt, next to robots.txt. Link it from a human-readable /the-line page if you have one.
reality.txt is a proposal, openly published, free to adopt — not a certification, not a guarantee.
There is no registry, no authority, and no audit behind it. A reality.txt is a claim by its publisher about their own product — trust it exactly as much as you trust them. A tool for legibility, not a promise of safety. Pre-release. Maintained by RadLife as part of the Rad family.