The AP2 v0.2 specification. Supports the requirements that the Trusted Surface remain non-agentic, verification run in deterministic code, and signed mandates and receipts provide transaction evidence.
The W3C Device Bound Session Credentials First Public Working Draft. Supports the device-held-key design, draft status, and explicit limits against attackers already resident on a device.
CAPSEM's project documentation. Supports the details about ephemeral read-only VMs, host-side TLS inspection, network and MCP policy, and per-session logging. These are project claims, not an independent security audit.
The public CAPSEM repository. Supports the hardware-isolated Linux VM, network control, MCP routing, telemetry, Apache-2.0 license, and the explicit disclaimer that the project is not official or supported by Google.
Google's Jul 14 I/O Connect India announcement. Supports the launch context and claims that Google announced Sec-Gemini v3 testing, CAPSEM open sourcing, DBSC, and AP2.
Sensemaker brief on CAPSEM isolation and the broader pattern of deterministic controls around AI agents.
The end
