IDENTITY
MONETIZATION
AUTO GOVERNANCE
EXCHANGE PROTOCOL

The "Banner Ad" model is collapsing.

• Users ask ChatGPT instead of visiting sites.
• Google AdSense needs human eyeballs. Bots don't click ads.
• IMAGXP enables Direct Monetization ($0.01/request) from AI Companies to Creators, ensuring the web survives.

It replaces "Scraping" with "Negotiation".

• Identity: Stops spoofing ("I am OpenAI" vs "I am Steve").
• Money: Handles micro-payments efficiently.
• Governance: Gives Publishers control (e.g., "Yes to RAG, No to Training").

No. IMAGXP is a Protocol, not a Firewall.

• The Reality: We cannot physically stop a "Trillion Dollar Scraper" from spoofing a residential proxy ("Steve from Ohio"). Cloudflare does that.
• The Distinction: Cloudflare stops the Packet. IMAGXP stops the Excuse.
• The Defense: By serving a cryptographically secured "No", we remove "Plausible Deniability". If they bypass it via proxies, it becomes a Computer Fraud and Abuse Act (CFAA) Violation (Criminal Hacking). Public companies do not cross this line.

Impossible without the Private Key.

• The Math: We use ECDSA P-256 (same as Bitcoin/TLS).
• The Only Way: Steal OpenAI's .env file containing their Private Key.
• Network Attacks: Spoofing IP addresses does nothing because the signature won't match.

Blocked by Timestamps.

Every signature includes a ts (timestamp). The SDK rejects any request older than 5 minutes. A hacker cannot "record" a valid request and play it back later.

Google AdSense is for Humans.

• Bots don't click banners.
• Bots don't have "Viewability".
• Until AdTech evolves, Direct Payment (The Broker) is the only way to monetize AI Agents.

• Efficiency: OpenAI doesn't want to send 1,000 checks for $0.01. You don't want to chase 1,000 invoices.
• The Bond: The Broker holds a large deposit from the Agent, guaranteeing they can pay.
• Trust: You delegate trust to the Broker (like accepting a Visa card), enabling 1-line configuration.

The "Spotify Model" (Data Pools).

Agent pays a flat fee (e.g., $10k/month) to the Broker. Broker distributes it to Publishers based on Usage Share (proved by IMAGXP Logs). This works today.

No, if configured correctly.

• Hybrid Mode (Default): Allows Verified Agents (who pay/sign), Browsers/Humans, and Legacy Bots (Google) which are detected as non-IMAGXP traffic.
• Strict Mode: If you block everything without a signature, you will block Google. Don't do this unless you are an API-only service.

No.

The protocol is Trustless. We verify the Signature, not the Name. If unknown-bot.com sends a valid signature and pays $0.01, they are allowed. No whitelist needed.

It doesn't look *for* them; it stumbles *upon* them.

• The Workflow: The Agent crawls blindly (like Googlebot). When it sees the x-imagxp-policy header, it says "Aha!" and upgrades to Signed Mode.
• The Scale: This check takes 0.1ms. Zero pre-configuration or central database required.

No. The web is too big for lists. Discovery must be Decentralized and Automatic.

They lose. (The "Snapshot Defense")

• The Proof: Their key is public at .well-known/imagxp-agent.json.
• The Archive: The Internet Archive (Wayback Machine) timestamps this file.
• Verdict: Even if they change it today, the Archive proves what it was yesterday. This is Non-Repudiation.

Depends on your size.

• Small Publishers: 7 days (via Vercel/Netlify logs) is enough for "Who scraped me?".
• Enterprise: 7 years (stream to S3) for audit trails.

Never.

• The Lock: They only see the Public Key (via DNS).
• The Secret: Your Private Key stays on your server in .env.
• The Math: Public Key Cryptography proves ownership without revealing the key.

No. It is Admin Only. You must use standard authentication to protect your existing log routes.