Query-to-Data protocol
A transport-neutral protocol for policy-bound, least-disclosure answers over protected data.
Requester
Custodian
Evaluated locally · never transmitted
Agents are routinely given record- or document-level access to answer questions whose legitimate output is a boolean, an enum, or a small bounded result. Everything else in that record becomes reachable — by the model, by its tools, and by anything that can inject a prompt into it.
Q2D moves the question instead. A requester submits a signed, typed answer contract — the question, its purpose, the intended recipient, the permitted sinks, and the maximum response domain — before any evaluation happens. A participating custodian evaluates it locally under the applicable policy and returns a bounded, authenticated answer with a disclosure receipt.
A bounded answer domain does not prevent prompt injection. It closes the response channel — an injected payload in the custodian's data has no field to occupy in a boolean or a small enum — and leaves the tool-description channel untouched. And Q2D does not constrain a hostile custodian: the bound is enforced by the custodian, so one that declines to run the check is not conforming and is not detectable by this protocol. Q2D is a way for a participating custodian to show its working, not a way to bind a dishonest one.
Q2D does not make a released answer retractable. It does not prove the truth of self-asserted inputs. It does not prevent all inference from repeated answers. It does not independently establish legal compliance. And a bounded answer is not a harmless one — one value can carry the consequential fact.
MCP is the reference binding, and it is not built yet. The contained-runtime profile — which would keep verification evidence out of model context and mediate where an answer may flow next — is deferred. Until it exists, a deployment may claim bounded authenticated answer from a participating custodian, and may not claim answer-derived flow restricted to permitted sinks.