Query-to-Data protocol
A transport-neutral protocol for policy-bound, least-disclosure answers over protected data.
Requester
Custodian
Evaluated locally · never transmitted
Agents are routinely given record- or document-level access to answer questions whose legitimate output is a boolean, an enum, or a small bounded result. Everything else in that record becomes reachable — by the model, by its tools, and by anything that can inject a prompt into it.
Q2D moves the question instead. A requester submits a signed, typed answer contract — the question, its purpose, the intended recipient, the permitted sinks, and the maximum response domain — before any evaluation happens. A participating custodian evaluates it locally under the applicable policy and returns a bounded, authenticated answer with a disclosure receipt.
Q2D does not make a released answer retractable. It does not prove the truth of self-asserted inputs. It does not prevent all inference from repeated answers — disclosure accounting bounds the channel, not the adversary's posterior. It does not independently establish legal compliance.
Bindings for MCP and A2A are planned, as is an optional contained-runtime profile that keeps verification evidence out of model context and mediates where an answer may flow next. Neither has shipped.