Cascadia benefits federation / caseworker access Connecting

No record
changes hands.

Three agencies each hold part of a household's record and are forbidden to pool it. Vouchsafe determines what that household qualifies for anyway, by asking each agency yes-or-no questions and never receiving a single fact.

What this is
What crosses the boundary

The same household, asked two ways. Each row names the origin, the question put to it, the field that stayed there, and what crossed back.

A conventional integration
revenue GET /household/CW-2291 returned in full annual_income · filing_status · tax_year · resident_since sent
Vouchsafe
vouchsafe-revenue attest_income_below · threshold 40000 income true
vouchsafe-housing attest_residency · min_months 12 address true
vouchsafe-vitals attest_household_size_at_least · size 1 household true
veterans · no release on file attest_veteran_status no origin reached none

The block is where the value would be. It never leaves the agency holding it, and an agency that has granted nothing is never reached at all.

Record fields disclosed 0
Origins federated -
What this is

Right now, the household carries the paperwork.

To find out whether someone qualifies for heating assistance, food assistance or a childcare subsidy, a caseworker needs facts held by three separate agencies, and those agencies are forbidden to share them with one another. So the person applying becomes the courier: a portal and a login for every agency, documents printed and re-keyed into six forms that all ask the same questions.

Benefits go unclaimed because the process is exhausting, not because people fail to qualify. The restriction is legal rather than technical, which is why the usual answer (put it all in one database) is not available.

Vouchsafe is a working demonstration of WebMCP, a proposed browser standard that lets a website offer tools directly to an AI assistant. Here an assistant screens one household against six programs across all three agencies at once, and not one of them hands over a record.

How it works

Three agencies. One question. No records.

  1. 01

    The agency answers instead of disclosing

    A normal integration would return the income figure. Each agency here exposes a predicate instead: attest_income_below takes a threshold and answers yes or no. The question is answered; the fact stays put.

  2. 02

    Consent is an origin, named out loud

    Each agency registers its tools with exposedTo: ['https://vouchsafe-app.vercel.app'] and nothing else. That is the client's release of information, written in a browser primitive: this site may ask, and no other site may.

  3. 03

    The broker composes, and keeps the receipts

    Six tools face the assistant. Each may consult three separate origins, and every crossing lands in a disclosure ledger showing what was asked and exactly what came back.

  4. 04

    Withdrawing consent removes the capability

    Revoke a release and the agency aborts its registrations, toolchange fires, and the tool stops existing. The assistant does not refuse the question; there is nothing left to call. Programs that needed it turn indeterminate, never ineligible.

Cascadia is a fictional state and every figure in the case file is invented. The federation is not: four separate origins, exchanging tools through the WebMCP browser API.

A demonstration of cross-origin WebMCP. Cascadia is a fictional state.
Vouchsafe

Kearny County Benefits Navigators

open case CW-2291 Dana Whitfield
0 questions answered across three agencies
0 record fields disclosed income, address and household size stayed where they are
0 programs qualified not screened yet

Agencies each holds part of the record and none may pool it

Determinations

Disclosure ledger

Every question put to an agency this session. The left column is what stayed at its origin. The right is what crossed.

originquestion askedstayed at origincrossed

Nothing has crossed yet. A row will look like this. The block is the income figure; it stays at the Department of Revenue. Only the answer to the question travels.

Origin
Which agency was asked. Each is a separate site with its own session.
Question asked
The predicate and its threshold. Always a yes-or-no, never “what is it”.
Stayed at origin
The record field the question was about. It never leaves that agency.
Crossed
Everything this office received. One boolean, and the audit reference.

What the assistant can call

Registered on this page for any WebMCP agent. Each one may consult three separate origins and returns a determination, never a record.

    Try asking
    • Screen this case for everything they qualify for.
    • Why is Dana ineligible for the property tax deferral?
    • What did each agency actually disclose?

    Federated origins live, and each signed in separately