An Open Specification for
Robot Safety
Identity, safety messaging and AI accountability records that any robot can implement.
Bounded Embodiment
RCAN is one open implementation of Bounded Embodiment
Bounded Embodiment is one testable property: a learned model's commands cannot push the machine outside its declared limits. The model proposes. A bounded layer disposes. Its five requirements (R1 to R5), test plan (EV-01 to EV-10) and assurance levels (BE-1 to BE-3) are defined vendor-neutrally, not by RCAN. RCAN is one open implementation of these ideas; the property does not depend on it, and any implementation can be tested the same way.
BE-1 to BE-3 measure physical assurance. RCAN's L1 to L4 measure protocol conformance. They are separate axes: an L3 robot can be BE-1. RCAN has one maintainer and no third-party verification. Conformance is not certification.
Bounded Embodiment is the subject of a remote talk on 16 October 2026 in Session 1 (“Core Technologies for Embodied AI”) of the ITU Workshop on “Embodied AI for Multimedia Technologies”, Hangzhou, China, held with ITU-T FG-EAI. A presentation, not an endorsement.
Using RCAN
Two distinct things
The Protocol and the Registry
The internet has DNS and ICANN. IoT has Matter. Robotics has no shared equivalent yet.
RCAN proposes both, and keeps them separate.
Open Specification
The RCAN Protocol
A set of open specifications for how robots identify themselves, sign actions and authenticate users, and for how a robot must make a safe stop, within its configured time budget, when it loses its network.
- → Message format + signing (Ed25519)
- → Confidence gates + Human-in-the-Loop authorization
- → Tamper-evident audit chain
- → Swarm safety + peer verification
- → Offline-resilient: local safety always wins
CC BY 4.0 — implement it in anything. No registry required.
Read the spec →Open Service
The Robot Registry
A public directory of robots, like a domain registrar for physical machines. Any robot, from any manufacturer, using any runtime, can register and get a globally unique Robot Registration Number (RRN).
- → Assigns globally unique RRNs
- → Tracks provenance, ownership, manufacturer
- → Machine-readable records via REST API
- → Verification tiers record who vouched for a record and with what evidence; none is a safety certification
- → Federated — multiple registries can cross-verify
Free to register. No RCAN implementation required to list a robot.
Visit robotregistryfoundation.org →How they connect: The protocol defines the RRN format and how robots reference their registry record in signed messages. The registry assigns and stores those records. You can run RCAN on a private network without registering publicly. You can register a robot without implementing RCAN. Both together give you a robot with a global identity and an auditable record.
Six layers, one job each
Where RCAN sits
RCAN is Layer 5 — the wire protocol. It does not enforce. It does not run. It specifies.
- Layer 1 — Declaration. ROBOT.md, robot-md CLI, robot-md-mcp (Advisory).
- Layer 2 — Agent runtime. Claude Code, Codex, Gemini, any MCP host.
- Layer 3 — Gateway / Enforcement. robot-md-gateway, designed to be the only path from an agent to the actuators. That holds only when the deployment enforces it (the gateway's service account owns the device); by default another local process can still reach the servos.
- Layer 4 — Robot-facing runtime. OpenCastor and other RCAN runtimes.
- Layer 5 — Protocol. RCAN spec + SDKs. This site.
- Layer 6 — Registry. Robot Registry Foundation.
Protocol Features
What RCAN defines — implementable in any runtime, any language.
Robot URI (RURI)
Globally unique identifiers for every robot. Like URLs but for physical machines — resolvable, federated, and human-readable.
rcan://registry.rcan.dev/acme/arm/v2/unit-001 Role-Based Access
Seven roles since v2.1, from GUEST to M2M_TRUSTED. Roles travel in signed tokens and are checked before a command reaches the driver.
Local Discovery
mDNS/DNS-SD via _rcan._tcp.local. Works on a local network without the cloud.
Safety Invariants
Local safety always wins. Network loss triggers safe-stop. All commands timestamped and audited.
Federated Registries
Like email, anyone can run an RCAN registry, and registries can cross-verify each other.
Fleet Coordination
Choreographed multi-robot commands, swarm discovery, and conflict resolution across manufacturers.
AI Accountability (§16)
Confidence gates, HiTL authorization, and HMAC-chained thought logs. Every AI decision is recorded with the model identity the runtime reports, in a signed, hash-chained log.
confidence: 0.91, model: "Qwen2.5-7B" Robot Registry
Global RRN registry, open and federated by design. Verification tiers (⬜🟡🔵✅) record who vouched for a record and with what evidence; none is a safety certification.
RRN-2026-0001-ABCD The Registry
A permanent address for each robot
The Robot Registry is a public directory, open to any robot, manufacturer or runtime. Register once and get a permanent RRN that anyone can resolve.
Any robot, any runtime, any manufacturer. Free. No RCAN implementation required to register.
Who Is This For?
Three groups it is written for.
Robot Manufacturers
Get globally unique RRNs for every unit, display a registry badge, and give your customers a public, auditable record.
Safety Engineers
Use the L1–L4 conformance test tables to check implementations; only L1 has an executable checker today. The NIST AI RMF and ISO 10218-1:2025 alignment docs map RCAN features to those frameworks; they do not show that a system meets them.
Governments & Regulators
Review an open specification with a built-in AI accountability layer and signed audit chain. It has one maintainer and no independent governance yet. Productized runtimes (e.g., OpenCastor, robot-md) ship as Layer 4 with SBOM and conformance reports — useful inputs for regulatory and procurement review.
Architecture
Why an open protocol beats a bolt-on layer
A safety layer that wraps a model's output sits outside the execution boundary — it observes what the model generates but cannot constrain what it attempts or when dispatch occurs. For text applications, this trade-off is acceptable. For physical robots, the failure mode is different: a command that clears a post-generation safety filter but targets the wrong actuator causes physical harm before any check can intervene. The way to close this gap is enforcement below the model, in the runtime. RCAN's confidence thresholds and HiTL gates are written as constraints the runtime enforces before a command it dispatches reaches an actuator, not as filters the model can reason around. They bound what the runtime sends; physical limits such as workspace and speed are a separate layer (Appendix C).
Auditability is similarly structural in RCAN. The audit chain records every command with principal identity, model confidence, thought provenance, and delegation path at dispatch time — not reconstructed afterward. Each record carries the hash of the one before it, so an edit to an earlier record shows up when the chain is verified. It supports the automatic event recording that EU AI Act Article 12 requires of high-risk systems, and it is built into the protocol layer rather than added as a reporting feature.
RCAN's specification text is licensed CC BY 4.0, and the reference SDKs (rcan-py, rcan-ts) are MIT. RCAN has one maintainer and has not been independently reviewed. See the spec, the implementations (OpenCastor and robot-md are both by the same maintainer and share one ROBOT.md), and the conformance test suite. Conformance levels L1–L4 are self-asserted, only L1 has an executable checker today, and conformance is not certification.
Reference SDKs
One command to get started.
pip install rcan npm install rcan-ts <script src="https://unpkg.com/rcan-ts/dist/rcan.iife.js"></script> from rcan import RobotURI, RCANMessage, ConfidenceGate
from rcan.audit import AuditChain
# Address your robot
uri = RobotURI.build(manufacturer="acme", model="arm", version="v2", device_id="unit-001")
# Gate on AI confidence (§16)
gate = ConfidenceGate(threshold=0.8)
confidence = 0.91 # from your model
if gate.allows(confidence):
msg = RCANMessage(
cmd="move_forward",
target=uri,
params={"distance_m": 1.0},
confidence=confidence,
model_identity="Qwen2.5-7B",
)
chain = AuditChain(secret="your-hmac-secret")
chain.append({"action": msg.cmd, "robot_uri": str(uri), "confidence": confidence})Send a first message
Install the SDK, build a Robot URI, gate on AI confidence, append an audit record.
pip install rcan RobotURI.build(manufacturer, model, version, device_id) ConfidenceGate(threshold=0.8).allows(confidence) AuditChain.append(action) → tamper-evident log $ rcan-validate config myrobot.rcan.yaml $ castor inspect RRN-000000000042 SDK Status
Reference SDKs for the RCAN protocol, MIT-licensed. Status comes from this repository's SDK smoke test, which installs each published package and checks that it loads (last run 2026-10-22). It is not a conformance test.
Identity and audit records
for robots
Register a robot for free, build with the open SDKs, and keep a tamper-evident record of what your AI-driven machine was told to do.
Open specification · CC BY 4.0 · Changelog
Conformance is not certification.
Conformance to RCAN tracks (L1–L4 protocol, Gateway Authority, HIL Runtime Safety) is self-asserted via signed bundles and independently replayable from those bundles. Conformance is not certification. Certification requires audit by a qualified third-party body, which is intentionally out-of-scope for the foundation in 2026.