A STANDARD, NOT A MOATFree for any app to adopt. The more who copy it, the more the human wins — that is the whole point.
ECHO · THE HUMAN OPERATING SYSTEM

Authorize with Echo.

Not “who you are.” Exactly what an app may do.

“Sign in with Google” tells an app who you are. Authorize with Echo tells you precisely what an app may do — bounded, timed, revocable — and refuses, structurally, to carry your identity, your keys, or a blank cheque. Try it on a real outside app below.

One button replaces “sign in with Google” — and hands power back to you.

Northwind Notesexternal app

A note-taking app — outside the Echo ecosystem.

To sync your notes, Northwind Notes needs to connect to your Echo. It never sees your password, your vault, or your identity — only what you authorize.

You stay in control. Every grant is bounded, timed, and revocable.

Every grant answers eight questions — out loud

01Who is asking?The app, named as the delegate — never hidden.
02Who authorized it?You. Authority has exactly one source.
03What can it do?One verb per grant. Not a role, not a login.
04What does it reach?A reference to the thing — never the thing itself.
05How sensitive?A ceiling it cannot cross. Secrets are never-grantable.
06Does value move?If it does, you commit it — never the app.
07Can it be undone?Marked on every grant. Irreversible acts demand you.
08When does it end?Always. Authority is time-bound, never permanent.

Why the world copies this

“Sign in with Google” hands over who you are.Authorize with Echo hands over one bounded action — and a receipt that proves the limit.
Most consent screens are a wall of “allow” you scroll past.Here the over-reaching asks are shown struck out — refused before they can form.
Revoking access elsewhere means trusting they deleted it.Revoking ends the standing; the tamper-evident history stays yours to check.

A moat rots. Gravity pulls. The moment one app shows a live, revocable receipt, every app that hides its data grab looks like exactly what it is.

Add it to your app

Three steps. Any builder can adopt the standard — no permission, no lock-in. The button is the surface; the receipt is the contract.

01Drop in the buttonReplace “Sign in with Google” with Authorize with Echo. You declare the capabilities you need — one verb each, bounded and timed.
02The human authorizesEcho shows the person exactly what you asked for, refuses anything over-reaching before it can form, and mints a real Authority Object for what they approve.
03Verify the receiptYou get back a Universal Receipt with an opaque proof. Check it on your server and act — without ever holding the person’s private data.
connect-echo.tsxTSX
import { AuthorizeWithEcho } from "@echo/authorize"

// Drop this where "Sign in with Google" used to live.
export function ConnectEcho() {
  return (
    <AuthorizeWithEcho
      app="northwind-notes"
      request={[
        { capability: "read-display-name", sensitivity: "low",    ttlHours: 24 },
        { capability: "read-note-count",   sensitivity: "low",    ttlHours: 24 },
        { capability: "schedule-reminder", sensitivity: "medium", ttlHours: 24, uses: 1 },
      ]}
      onReceipt={(receipt) => saveToSession(receipt)}
    />
  )
}

The @echo/authorize package names show the integration shape. The contract underneath — the eight questions and the Universal Receipt — is the real, canonical HAP-1 standard, free for anyone to implement.

Trust it on your server

The other half of the loop. An integrator's backend verifies the Universal Receipt from the open spec alone — recomputing the opaque proof from its stated terms. It learns exactly what it was granted, and none of the person's data. Tamper with the receipt in transit and the server refuses it.

A person authorized Northwind Notes on their own device. Now the receipt travels to Northwind's server — which has never seen inside the Echo ecosystem. Watch it decide whether to trust the grant, using nothing but the open standard.

Honest edges

This demo runs entirely on your deviceNorthwind Notes is a mock, and the Authority Graph is local-first (Law 1). A real integrator would mint the same objects server-side against your Echo — the primitive is identical.
The guard is only as good as the forbidden setThe engine refuses birthdays, recovery fragments, blank cheques and permanence today. The set is versioned (AO-1): it can grow, and it will never shrink.
A receipt proves the grant was authorized, not that the app then behavedThe opaque head commits to the authority decision — that this scope was granted, by you, at that moment. It does not prove what the app did afterwards, and it does not prove the grant was wise. Authorize with Echo keeps power with you; it does not decide for you.

Whatever app you connect, it always answers to you.

The Authority Object →The Human Authority Standard →The Authority Graph →The Laws →