WYSIWYS Consent Binding for Agent UIs

Agent UI stacks let an AI agent render a surface, obtain a human's approval, and then execute or settle an action. Across today's protocols, what the human saw and approved is not bound to what the action dispatches or settles: an agent (or an injection that reaches it) can display one thing and act on another, within a fully conformant surface, with no artifact proving what was shown. This draft RFC defines a small, additive, protocol-neutral primitive — a consent binding — that carries a signed digest of the displayed surface (and the action's resolved target) with the human's decision, so the executing/settling side can verify the decision corresponds to the exact surface the human approved. It is the "what you see is what you sign" (WYSIWYS) property from trusted-path and hardware-wallet security, applied to agent tool-calls. The document maps the primitive onto the current agent-UI protocols (A2UI, AG-UI, MCP-UI, Open-JSON-UI); because the runtime layer carries the rendering protocols, defining the binding there lets them inherit it from one place. An open-source reference implementation is available for review.