The mental model

Find My, for AI agents

An AirTag never trusts the bag it's in to report where it is. The network around it does. Sello works the same way: every service your agent touches drops a sealed, verifiable sighting that only you can open. See where your agents went, and prove it.

LIVE TRAIL
maps.api
pay.acme
mail.svc
db.internal · now
research-agent-01 · 4 verified sightings
maps.api/geocode
tools/call · result success
✓ verified
11:02
pay.acme/charge
tools/call · result success
✓ verified
11:03
mail.svc/send
tools/call · result success
✓ verified
11:05
db.internal/query
tools/call · result success
✓ verified
now
The metaphor

The same trick AirTags pull, for agent activity.

Find My already solved "track a thing you don't control, privately, using a network you don't own." Map it onto agents and you get Sello.

Find My The AirTag
The sealed receipt

A tiny, tamper-evident token of presence. Here, each service stamps what it observed into a signed COSE envelope the agent can't forge.

Find My The crowdsourced network
The services + transparency logs

Passing iPhones relay an AirTag's pings. Here, the services your agent calls relay sealed sightings into append-only public logs.

Find My "Last seen" pings
Verified sightings

Every location report is a discrete, attributable event. Here, every action is a receipt signed by the service that saw it, with a verifiable time.

Find My End-to-end encryption
HPKE to the owner

Apple can't see your stuff's location. Here, the network and the logs carry your trail, but only your key can decrypt what actually happened.

The key inversion

The finder reports the sighting. Never the thing being found.

A lost AirTag can't lie about where it is, because it isn't the one talking. The phones around it are. Sello moves the pen the same way: the service that handled the action signs the sighting, so a compromised agent can't quietly rewrite its own trail.

One sighting, relayed
agent
service
signs
public
log
you
verify

The agent passes through. The service seals what it saw and drops it in a public log. You pull it back later and verify. The agent never holds the pen.

Privacy

Only you hold the key.

The trail is public enough to prove and private enough to trust. Anyone can confirm a sighting exists. Only your key reveals what it says.

What the network stores🔒 ciphertext
hpke:Aq8f3k2Lx9pQ7wZ1nB6vR0sT4mYcJ8d Hn5oW2eK1aD9fG3hL7jP0qS4uX6zC8vN b2M5tR8yU1iO3pA7sD9fG2hJ4kL6mZ0xC v3B5nM8qW1eR4tY7uI0oP2aS5dF8gH1jK 9lZ3xC6vB2nM4qW7eR0tY3uI6oP9aS2dF

Every observer, every log, every passerby sees only this. Sealed to your key with HPKE.

What your key reveals✓ decrypted
{
  "service": "db.internal/query",
  "action-type": "tools/call",
  "result-status": "success",
  "seen-at": "11:06:02Z",
  "verified": true
}

Held only by the owner. The signature proves who sealed it; the log proves it existed.

It's a metaphor, the protocol is real

A verifiable trail for every agent you run.

The Find My picture is just the intuition. Underneath it is a concrete protocol: signed COSE receipts, HPKE encryption, and public transparency logs.