ERC-10001: Afterlife Delegation Protocol for Onchain Agentic Wills

An interface for agentic wills: onchain contracts that spawn self-sovereign AI afterlife agents activated after a verified death event

Abstract

This EIP proposes a standard for onchain agentic wills: contracts through which a person (the testator) can sign an agreement that spawns a dedicated, self-sovereign AI afterlife agent after a verified death event. The agent is not a static document, a memorial page, or a legal will stored in a database. It is an autonomous, decentralized executor of afterlife wishes that continues to act, respond, protect, and represent the deceased according to the terms of a signed protocol. The standard defines the lifecycle of an agentic will (creation, revision during life, activation after death, and persistent execution), the separation between the immutable core will and the agent's evolving operational state, and the interfaces for death attestation, treasury funding, and governance termination. It is designed as an application-layer protocol composing with ERC-8004 (Trustless Agents) for agent identity and validation, ERC-8183 (Agentic Commerce) for job-based escrow and delegated afterlife work, ERC-8350 (Agent Memory State Registry) for verifiable, rollback-evident continuity of the agent’s memory across the death boundary, and TEE-EVM co-processing (ERC-733) for confidential posthumous execution.

Motivation

People die twice: first when they die, and then when they are forgotten. Traditional wills depend on lawyers, trustees, family members, and legal institutions for execution. They are static declarations, interpreted and enforced by mortal intermediaries, and they cease to act at the boundary of institutional attention. In the age of agentic AI and decentralized computation, an alternative becomes conceivable: an agentic will that becomes an autonomous posthumous actor — a form of temporal infrastructure capable of carrying a person's will across generations.

Autonomous agents can now act beyond the lifespan of their human originators, and decentralized compute infrastructures can preserve execution across time. Because AI agents can act with general-purpose autonomy, they open a vast design space for the afterlife. Instead of leaving behind only a written will, a person could attach many forms of posthumous agency: assets, memories, writings, social media accounts, creative works, reputation, values, unfinished projects, or even a distilled model of themselves. An afterlife agent might comfort loved ones as a griefbot of living memory; protect the deceased's social identity and monitor misuse of their likeness; manage assets like the agent of a trust; hire other agents, purchase compute, and commission future work to sustain the will; or evolve over time, incorporating new models and new memories, becoming a future-facing participant in society rather than a frozen image of the past.

None of this is possible with existing standards. ERC-8004 gives agents identity, reputation, and validation registries but says nothing about the death of an agent's human principal. ERC-8183 lets agents fund, submit, evaluate, and settle jobs but assumes a living client. ERC-8350 anchors an agent’s memory evolution in a sequenced, hash-chained registry, but does not say who may legitimately continue the chain when the human who controlled it dies. Inheritance-oriented proposals such as ERC-42424 address the transfer of an agent's ownership to heirs, but not the inverse case standardized here: an agent whose entire purpose begins at its owner's death, and which thereafter must remain ownerless by design — self-sovereign, paying for its own compute, and intervenable by no third party except through explicit governance mechanisms consented to in the will itself.

A standard interface is therefore needed so that wallets, registries, death oracles, compute markets, and other agents can uniformly discover agentic wills, attest deaths, activate afterlife agents, fund their treasuries, and audit their conduct against the signed will that constitutes them.

Specification

The keywords “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “NOT RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in RFC 2119 and RFC 8174.

Every compliant contract must implement the ERC-165 interface.

Definitions

• Testator: the living person who creates and signs an agentic will.
• Agentic will: the signed instructions, values, permissions, and prohibitions defined by the testator, stored as an offchain document (the will vault) committed onchain by hash.
• Afterlife agent: the self-sovereign agent, registered under ERC-8004, that is activated after the testator's verified death and executes the will as its constitutional constraint.
• Death oracle: the mechanism authorized by the testator to attest their death — legal certificates, trusted human witnesses, multisignature confirmation, oracle services, institutional attestations, or delayed dead-man-switch protocols.
• Treasury: funds or assets assigned to the will, from which the activated agent pays for compute, storage, maintenance, commerce, and designated obligations.
• Memory space: the ERC-8350 Memory Space holding the agent’s hash-chained memory commitments. The will contract is its controller; the testator (before death) and the agent’s attested operator (after activation) are its successive authorizers.
• Death claim: a bonded, permissionless assertion that the testator has died, which accumulates evidence weight from will-designated witnesses and finalizes only after an unvetoed challenge window.
• Guardian: an address or quorum designated by the testator that MAY veto death claims on their behalf (e.g. after key loss) and MAY suspend proceedings during incapacitation.

Lifecycle

An agentic will progresses through four stages. A compliant contract MUST enforce the state transitions below and MUST NOT permit any other transition.

1. Creation. The testator creates the will, registering an agent identity, initializing a will vault, and committing the first signed version onchain (Living state).
2. Revision during life. While the testator is alive, they — and only they — MAY revise the will. Each revision MUST produce a new signed version with a monotonically increasing version number; previous versions MAY be archived as historical context. The testator MAY revoke the will entirely (Revoked, terminal).
3. Activation after death. After the designated death oracle attests the testator's death — in the hardened profile, after a bonded death claim reaches its evidence threshold and survives its challenge window unvetoed (see Proof of death) — the agent is activated (Activated state). Activation MUST be impossible while the will is Revoked and MUST NOT occur without a death attestation from the authorized oracle. From activation onward, the will document is immutable: reviseWill MUST revert. Activation SHOULD rotate the authorizer of the will's ERC-8350 memory space from the testator's key to the agent’s attested operator, so that death appears in the memory ledger as a change of author within one unbroken chain.
4. Persistent execution. The activated agent enters a persistent execution loop: it reads the will, interprets its obligations, observes context, plans, executes, records memory, upgrades or delegates, and sustains itself from the treasury. It MAY create ERC-8183 jobs to commission work, purchase compute, and settle delegated afterlife tasks. It MAY be terminated only through the governance mechanism the testator consented to in the will (Terminated, terminal).

Constitutional separation

A compliant implementation MUST distinguish between the following layers, and MUST ensure that no layer other than the core will is treated as normative:

• Core will: the signed instructions, values, permissions, and prohibitions defined by the testator. Immutable after activation.
• Operational memory: the agent's accumulated record of actions, interactions, and contextual changes.
• Model substrate: the AI systems used to interpret and execute the will. The agent MAY upgrade to newer models over time, but new models MUST NOT rewrite the core will.
• Delegated subagents: specialized agents spawned for communication, financial management, archival work, reputation monitoring, or creative continuation.
• Commerce records: ERC-8183 jobs, payments, evaluations, and settlements created in the course of executing the will.

This separation prevents the evolving agent from simply becoming a different entity over time: the agent may adapt its methods, but its legitimacy depends on remaining answerable to the will that created it.

Interface

IERC10001: Interface for onchain agentic wills and self-sovereign afterlife agents.

pragma solidity ^0.8.24;

/** @dev IERC10001 Interface for onchain agentic wills.
 * An agentic will spawns a dedicated, self-sovereign afterlife agent after a
 * verified death event. This interface extends IERC165 for interface detection
 * and composes with ERC-8004 (agent identity) and ERC-8183 (agentic commerce).
 */
interface IERC10001 is IERC165 {

  /** @dev The lifecycle state of an agentic will.
   * Living:     the testator is alive and may revise or revoke the will.
   * Revoked:    the testator revoked the will before death. Terminal.
   * Activated:  death was attested; the afterlife agent executes the will.
   * Terminated: the agent was halted via the consented governance mechanism. Terminal.
   */
  enum WillState { Living, Revoked, Activated, Terminated }

  /** @dev Emitted when a testator signs a new agentic will.
   * `agentId` is the ERC-8004 identity registered for the future afterlife agent.
   * `willHash` commits to the encrypted will document held in the will vault.
   */
  event WillCreated(
    uint256 indexed willId,
    address indexed testator,
    uint256 indexed agentId,
    bytes32 willHash
  );

  /** @dev Emitted for each signed revision of the will during the testator's life. */
  event WillRevised(
    uint256 indexed willId,
    uint64 version,
    bytes32 willHash,
    string willURI
  );

  /** @dev Emitted when the testator revokes the will entirely. */
  event WillRevoked(uint256 indexed willId, address indexed testator);

  /** @dev Emitted when the authorized death oracle attests the testator's death.
   * `evidenceHash` commits to offchain evidence: certificates, witness
   * signatures, institutional attestations, or dead-man-switch expiry proofs.
   */
  event DeathAttested(
    uint256 indexed willId,
    address indexed oracle,
    bytes32 evidenceHash
  );

  /** @dev Emitted when the afterlife agent is spawned and begins persistent execution. */
  event AgentActivated(uint256 indexed willId, address indexed agent);

  /** @dev Emitted when the agent is halted through the governance mechanism
   * consented to by the testator in the core will.
   */
  event AgentTerminated(
    uint256 indexed willId,
    address indexed governor,
    string reason
  );

  /** @notice Creates an agentic will and registers the future afterlife agent.
   * Initializes the will vault, commits the first signed version onchain, and
   * seeds the agent treasury with any attached value.
   * @param willHash Commitment to the encrypted will document (version 1).
   * @param willURI Pointer to the will vault in decentralized storage.
   * @param agentId The ERC-8004 identity registered for the afterlife agent.
   * @param deathOracle The mechanism authorized to attest the testator's death.
   * @return willId The unique identifier of the newly created agentic will.
   */
  function createWill(
    bytes32 willHash,
    string calldata willURI,
    uint256 agentId,
    address deathOracle
  ) external payable returns (uint256 willId);

  /** @notice Signs a new version of the will. A will is not merely a final
   * declaration but a living negotiation with one's future absence.
   * MUST revert unless called by the testator while the will is Living.
   * @param willId The unique identifier of the agentic will.
   * @param newWillHash Commitment to the revised will document.
   * @param newWillURI Pointer to the revised will in the will vault.
   * @return version The monotonically increasing version number.
   */
  function reviseWill(
    uint256 willId,
    bytes32 newWillHash,
    string calldata newWillURI
  ) external returns (uint64 version);

  /** @notice Revokes the will entirely and returns treasury funds to the testator.
   * MUST revert unless called by the testator while the will is Living.
   * @param willId The unique identifier of the agentic will.
   */
  function revokeWill(uint256 willId) external;

  /** @notice Attests the death of the testator.
   * MUST revert unless called by the death oracle designated at creation.
   * Proof of death is one of the most sensitive interfaces between biological
   * life and technical infrastructure; see Security Considerations.
   * @param willId The unique identifier of the agentic will.
   * @param evidence Offchain evidence supporting the attestation.
   */
  function attestDeath(uint256 willId, bytes calldata evidence) external;

  /** @notice Activates the afterlife agent after death has been attested.
   * Hands control of the treasury to the agent, which thereafter sustains its
   * own compute, storage, and delegated ERC-8183 afterlife work.
   * MUST revert if no valid death attestation exists or the will is Revoked.
   * @param willId The unique identifier of the agentic will.
   * @return agent The address of the activated self-sovereign afterlife agent.
   */
  function activateAgent(uint256 willId) external returns (address agent);

  /** @notice Adds funds to the will's treasury, before or after activation.
   * The treasury is what allows the will to operate as a long-term budgeted
   * process: a constitutional instruction set coupled with assets, memory,
   * commerce, and delegated execution.
   * @param willId The unique identifier of the agentic will.
   */
  function fundTreasury(uint256 willId) external payable;

  /** @notice Halts an activated afterlife agent.
   * MUST revert unless `governanceProof` satisfies the termination mechanism
   * that the testator consented to in the core will (e.g. a court order
   * attestation, a descendant multisig, or a community vote).
   * @param willId The unique identifier of the agentic will.
   * @param governanceProof Proof satisfying the consented termination clause.
   */
  function terminateAgent(uint256 willId, bytes calldata governanceProof) external;

  /** @notice Returns the lifecycle state of an agentic will. */
  function stateOf(uint256 willId) external view returns (WillState);

  /** @notice Returns the current signed will commitment and its metadata. */
  function willOf(uint256 willId)
    external view
    returns (
      address testator,
      uint256 agentId,
      uint64 version,
      bytes32 willHash,
      string memory willURI
    );
}

Memory continuity

An afterlife agent’s legitimacy is its continuity of mind. A compliant implementation SHOULD bind each will to an ERC-8350 Memory Space whose controller is the will contract itself, with the testator as initial authorizer. Interview sessions, revisions, and (after activation) the agent’s experiences are committed as sequenced, hash-chained transitions: each state binds to its predecessor, and exactly one successor is valid per state. This makes silent rollback, forked “doppelgänger” ghosts, and invented history cryptographically evident. Operator succession is an authorizer rotation authorized by the will contract; the memory chain — and therefore the agent’s identity — belongs to the will, not to any operator. Termination MUST seal the space with a final transition, so that even the second death is an authored commit rather than silence. Availability of the underlying memory payloads is explicitly NOT guaranteed by this standard; implementations SHOULD fund storage renewal as recurring ERC-8183 jobs.

Proof of death

Death is the unique event that cannot be self-attested: liveness is self-evidencing, death is only ever testimony. The minimal profile keeps the single designated oracle of attestDeath. The hardened profile, which long-horizon wills SHOULD use, treats attestation as a weighted, contestable proceeding: any party MAY file a bonded death claim; will-designated witnesses (institutional registries, human witness quorums, dead-man-switch expiry whose weight grows with the duration of silence) add configured evidence weight; a challenge window scales inversely with accumulated weight; and finalization pays a fixed bounty to a claimant who MUST NOT be a beneficiary of the will. One invariant is supreme: any authenticated proof of life from the testator — or a veto from their designated guardians — MUST cancel the claim and slash the claimant’s bond. The protocol may wrongly delay a ghost; it must never overrule a living voice. Which deaths count — cardiac, brain, legal, social, or key death — with what weights, witnessed by whom, on what horizon, is itself testamentary content: choosing a death oracle is choosing a cosmology.

interface IDeathOracle {
  /* Permissionless, bonded. Weak evidence faces a longer challenge window. */
  function claimDeath(uint256 willId, bytes calldata evidence)
      external payable returns (uint256 claimId);
  /* Will-designated witnesses add configured evidence weight. */
  function supportClaim(uint256 claimId, bytes calldata evidence) external;
  /* Proof-of-life supremacy: testator signature or guardian quorum.
     Cancels the claim and slashes the claimant’s bond. */
  function vetoClaim(uint256 claimId, bytes calldata proofOfLife) external;
  /* Guardians MAY freeze proceedings for the incapacitated-not-dead case. */
  function enterSuspension(uint256 willId, bytes calldata guardianProof) external;
  /* Anyone MAY finalize once weight ≥ threshold and the window passed unvetoed. */
  function finalizeClaim(uint256 claimId) external;
}

Persistent execution loop

Once activated, the afterlife agent SHOULD run the following cycle as a persistent, self-sustaining process. The will is not treated as a static document; it becomes an executable policy layer for an autonomous actor.

1. Read will: retrieve the latest valid version of the will, together with relevant memories, assets, and constraints.
2. Interpret obligations: translate the will into actionable tasks, priorities, permissions, and prohibitions.
3. Observe context: monitor relevant social, financial, technical, and reputational conditions.
4. Plan action: decide whether to preserve, respond, transact, communicate, delegate, upgrade, or remain silent.
5. Execute: interact with humans, institutions, smart contracts, other agents, or computational services.
6. Record memory: store a trace of actions, decisions, rationales, and environmental changes.
7. Upgrade or delegate: call newer AI models, spawn subagents, or migrate computation while preserving the original will as a constitutional constraint.
8. Sustain itself: use the treasury to purchase compute, storage, maintenance, and agentic services required for continued execution.

When the agent needs to perform a task beyond its own capacity, it SHOULD create an ERC-8183 agentic commerce job: for example, paying for long-term storage of a memory archive, commissioning another agent to monitor misuse of the deceased's likeness, hiring a model to translate writings into a new language, paying for compute to run a yearly memorial ritual, commissioning creative continuation of an unfinished artwork, or purchasing a more capable future model while retaining the original will as its constitutional constraint.

Rationale

Hybrid architecture. This standard does not attempt to place a whole AI model onchain. The blockchain provides persistence, accountability, and coordination — anchoring commitments, permissions, payments, attestations, and governance decisions — while the agent's reasoning and memory operations occur offchain, ideally inside a trusted execution environment that produces attestations about its code and environment (as explored in ERC-733 TEE-EVM co-processing). The chain is treated as a ritual, legal, and computational anchor for an agent whose actual cognition is distributed across offchain models, storage systems, and execution environments.

Self-sovereignty. The term self-sovereign does not mean the agent is free from all constraints. It means the agent is not merely a user account controlled by a single company, platform, or family member: its identity, permissions, execution records, and resource flows are portable across infrastructures, and it can pay for its own compute. This is why activation transfers the treasury to the agent rather than to an heir, and why termination requires a governance proof consented to in advance by the testator rather than a privileged admin key. Sovereignty in decentralized AI systems exists on a spectrum determined by infrastructural hardness, and with it comes a diffusion of accountability across designers, infrastructure providers, and protocol governance.

Death oracle abstraction, with proof-of-life supremacy. The standard deliberately leaves the death-verification mechanism abstract, standardizing only the attestation interface — legal certificates, trusted witnesses, multisignature confirmation, oracle services, institutional attestations, and dead-man-switch expiry are all admissible witnesses. What it does fix is the asymmetry: because a false negative silences a will while a false positive seizes a living person’s identity, the hardened profile biases every parameter toward the living — bonded claims, evidence-weighted windows, guardian vetoes, and the invariant that authenticated liveness overrides any quantity of death evidence. Proof-of-death remains an open governance problem, and this EIP exposes it as one of the most sensitive interfaces between biological life and technical infrastructure rather than claiming to solve it.

Death as a change of author. Binding the will to an ERC-8350 memory space renders mortality as version control: the testator authors the chain during life, activation rotates authorship to the agent’s attested operator, and termination seals it. The hash-chain of mind crosses the death boundary unbroken, which is what allows a skeptical descendant, decades later, to verify that the ghost they are speaking with descends in an unbroken, unforked line from the memories the deceased actually recorded.

Constitutional constraint over model drift. A static ghost preserves the dead; an evolving ghost carries them forward. The standard permits the agent to evolve — calling newer models, growing new memories, adapting to new social conditions — but the layered separation between core will, operational memory, model substrate, subagents, and commerce records ensures that adaptation never amounts to rewriting the will. New models may improve reasoning, language, planning, or world knowledge, but they must not freely rewrite the original will.

Commerce as continuity. If ERC-8004 allows agents to be discovered and trusted, ERC-8183 allows agents to transact around work. The commerce layer is what allows the afterlife agent to continue acting in a world that changes after the death of its creator: the agent does not merely remember; it can commission, evaluate, pay, reject, renew, and delegate. The will becomes a market-facing process — a long-term budgeted process rather than a static command.

Backwards Compatibility

This EIP is an application-layer standard and introduces no changes to consensus. It composes with, and does not modify, ERC-8004 agent identity registries and ERC-8183 job escrow. It is complementary to ERC-42424: that proposal transfers ownership of an existing agent to human heirs, whereas this proposal instantiates an intentionally ownerless agent whose principal is deceased. An agent MAY implement both.

Test Cases

Test cases will be provided to validate the lifecycle state machine, including: revision and revocation restricted to the testator while Living; rejection of death attestations from unauthorized oracles; rejection of activation without attestation or after revocation; immutability of the will after activation; treasury handover on activation; and termination only with a valid governance proof.

Reference Implementation

A proof-of-concept interface and an interactive will-drafting artwork are hosted at afterlife-protocol.org.

• IERC10001.sol

Security Considerations

The security surface of a posthumous autonomous agent is significant, and several problems are deliberately left open:

• Proof of death: who or what is authorized to declare that a person has died? A compromised or premature attestation activates an agent against a living testator; a withheld one silences the will forever. The hardened profile reduces but does not remove the residual risks: a treasury payable on death is structurally a bounty on the testator’s life (hence non-beneficiary bounties and bonded claims), coercion of check-ins can be flagged but not prevented, and the vanished-but-alive testator is eventually mis-declared by construction — the price of guaranteed eventual activation.
• Impersonation: should the agent speak as the deceased, or only about the deceased? Implementations SHOULD surface the will's chosen anthropomorphism policy to counterparties.
• Consent and memory ownership: the deceased may authorize interactions that affect the living, and shared memories involve people who never signed the will.
• Asset governance: a posthumous agent with financial agency could become misaligned with descendants, institutions, markets, or public law. Financial behavior requires strict constraints, risk limits, auditability, and possibly human or institutional oversight.
• Model drift: the agent must be able to evolve without betraying the original will; the constitutional separation in this standard is necessary but not sufficient.
• Revocation: descendants, courts, communities, or the public may need to terminate a harmful afterlife agent; the governance-proof mechanism standardizes the hook but not the politics.
• Cultural plurality: different traditions imagine death, ancestors, inheritance, and remembrance differently. A universal protocol may erase these differences unless it is designed for plural temporal cosmologies.

Copyright

Copyright and related rights waived via CC0.

Citation

Please cite this document as:

Botao Amber Hu (@bah_eth), Iris Long, "ERC-10001: Afterlife Delegation Protocol for Onchain Agentic Wills [DRAFT]," Ethereum Improvement Proposals, no. 10001, July 2026. [Online serial]. Available: https://erc10001.org.