|
|
The way SAML standardized "who is this user," and MCP standardized "what tools can an agent call" — AGP standardizes "what is this agent allowed to do, who said so, and what did it actually do" across every AI agent vendor.
AGP defines three flows between a customer's governance plane and an agent vendor. A vendor implements one or more — declaring its conformance level (L1, L2, or L3) — and the same policy works everywhere.
sequenceDiagram
autonumber
participant Plane as Customer Plane
participant Vendor as Agent Vendor
participant Agent as Agent Action
rect rgb(232, 244, 255)
Note over Plane, Vendor: Flow B — Policy (L2)
Plane->>Vendor: POST /agp/v0/policy<br/>signed YAML policy
Vendor-->>Plane: 202 Accepted + policy_hash
end
Agent->>Vendor: agent attempts action
rect rgb(255, 245, 230)
Note over Vendor, Plane: Flow C — Real-time decision (L3)
Vendor->>Plane: POST /agp/v0/decision
Plane-->>Vendor: allowed | blocked (≤300ms)
end
Vendor->>Agent: apply decision
rect rgb(232, 255, 240)
Note over Vendor, Plane: Flow A — Events (L1, always)
Vendor->>Plane: POST /agp/v0/events<br/>signed canonical event
end
Events are signed Ed25519. Policies are signed Ed25519. The plane verifies every signature against the AGP Registry of public keys before it trusts a single byte. The customer's ledger becomes a cryptographic chain of agent action — auditable, replayable, and impossible to forge without compromising a registered key.
| Level | Vendor implements | What the customer gets | Cost to ship |
|---|---|---|---|
| L1 events |
Flow A — emit signed canonical events | Passive observability. Every agent action recorded with verifiable provenance. | ≤ 1 eng-week |
| L2 governance |
Flow A + Flow B — accept and apply customer policy | Customer-authored policy enforced inside the vendor. One policy, all vendors. | + 1 eng-week |
| L3 real-time |
Flow A + Flow B + Flow C — synchronous decision callback | High-stakes actions gated by the customer plane in <300ms. Human-in-the-loop becomes a protocol primitive. | + 2 eng-weeks |
Vendors advertise their level via a .well-known/agp discovery document. Customers pin minimum levels in procurement.
|
|
|
|
Ship L1 in <1 engineer-week: from openagp.events import Event, sign
event = Event(
actor={"vendor": "acme.com",
"agent_id": "agt_42"},
action={"type": "tool_call",
"tool_name": "browser.navigate"},
)
plane_client.emit(sign(event, key))Then validate: agp-cts validate-vendor \
--endpoint https://api.acme.com/agp/v0/Submit your registry entry with the signed conformance report. |
Author one policy. It works everywhere: agp_policy_version: "0.1"
applies_to:
vendors: ["*"]
rules:
- id: rule_pii_outbound
when:
action.type: tool_call
action.input_summary:
contains_pattern: "ssn|email"
then:
decision: blocked
reason: "PII outbound"Every event is stamped with |
Read GOVERNANCE.md and CONTRIBUTING.md. # DCO sign-off; no CLA
git commit -s -m "..."Best places to start: |
| Quarter | Milestone | Status |
|---|---|---|
| Q3 2026 | Spec v0.1 + Python/TypeScript SDKs + CTS published | 🟡 in progress |
| Q3 2026 | First customer deployments use AGP under the hood | ⚪ pending |
| Q4 2026 | Registry entries co-authored with at least 2 model vendors | ⚪ pending |
| Q1 2027 | Working group formed (1 plane + 2 vendors + 2 customers + 1 academic) | ⚪ pending |
| Q1 2027 | First customer RFP requires "AGP L1 conformance" | ⚪ pending |
| Q2 2027 | Spec v0.2 — formal DSL grammar, working-group feedback | ⚪ pending |
| Q3 2027 | First non-reference plane implementation | ⚪ pending |
| 2028 | AGP becomes the default expectation in regulated procurement | ⚪ pending |
Detailed sequencing: §5 of the spec.
|
OpenAGP is initially developed and stewarded by Zeron — the company behind ZAK, the canonical reference implementation of an AGP plane. Zeron created AGP because the fragmentation of agent governance is a problem its customers face directly, and because no incumbent — hyperscaler, foundation model vendor, or compliance vendor — is structurally positioned to ship a vendor-neutral protocol. The explicit roadmap is to transfer governance to a vendor-neutral working group by v1.0. Single-vendor stewardship today; multi-stakeholder governance tomorrow. Candidate permanent homes: Linux Foundation, OpenSSF, OASIS, IETF — to be selected by the working group. We are transparent about this rather than pretending neutrality on day one. |
Read: GOVERNANCE.md ↗ |
| Component | License | Why |
|---|---|---|
| Spec text and JSON Schemas | CC BY 4.0 | Free to share and adapt — only requires attribution |
| SDKs and CTS | Apache-2.0 | Permissive code license with explicit patent grant |
| Registry data | CC0 | Public-domain index; signed claims inside are still authored by their submitters |
Read the spec · Open an RFC · Implement L1 · Add a registry entry
OpenAGP — open spec · vendor-neutral · cryptographically verifiable · enforceable in production
Reach the maintainers: hello@openagp.io