Open standard · Working drafts
The open standard for authorizing AI agents.
The Agent Authorization Protocol (AAP) defines how an agent's identity, authority, and actions are expressed, checked, and recorded — so any system can decide what an agent may do, and prove afterward why it was allowed.
- Apache License 2.0
- Vendor-neutral
- Developed in the open
The gap
Identity says who an agent is. Something has to say what it may do.
Agent protocols such as MCP and A2A standardise how agents connect to tools and to each other. AAP addresses the layer beside them: what an agent is permitted to do, on whose authority, and how anyone can verify that later.
- 01Who is the agent?
- 02What authority does it have?
- 03What action is it requesting?
- 04What resource is it acting on?
- 05Why was the action allowed?
- 06Still valid? was that authority still valid when execution occurred?
What AAP defines
A small set of objects and rules that bind an agent action to its authority.
Specs 01–02
Delegation
How authority is passed from a person or organisation to an agent, and onward, as a verifiable chain.
Read the specSpecs 03–04
Trust and risk
Trust zones and layered risk evaluation that inform how much authority a decision can carry.
Read the specSpec 05
Revocation
Cutting authority off at a branch of the chain so the change takes effect before the next action.
Read the specSpec 06
Policy
A versioned policy model that turns a request and its context into an allow, deny, or review outcome.
Read the specSpec 07
Audit evidence
Decision provenance: what was decided, on what authority, and how to reconstruct it later.
Read the specSpec 30
Execution-time validation
Re-checking that authority still holds at the moment an approved operation actually runs.
Read the specSpecifications
Every specification, in the open.
All specifications are working drafts and may change. Each links to its text in the public repository, which is the authoritative source; this site does not copy them.
Kernel
The six objects every conformant implementation must support, and how they bind into an auditable record.
Core formats
The wire formats of the kernel objects.
Profiles
Optional layers over the kernel: trust, risk, oversight, sector controls, and cross-organisation trust.
- 03Trust Zones
- 04Risk Layers
- 12Emergency Procedures
- 13Privacy and Selective Disclosure
- 14Pre-Deployment Governance
- 15Human Oversight and Escalation
- 16Multi-Agent Coordination
- 17Behavioral Monitoring and Drift
- 18Regulatory Compliance Mapping
- 24Trust Summary Format
- 26Trust Relay Protocol
- 27Global Trust Registry Protocol
- 28Federation Revocation Sync
- 29Enterprise Identity Assurance
- 30Execution-Time Authorization Validation
Adapters
Transport translation into kernel objects without redefining them.
Operational
Conformance testing, runbooks, and production constraints that support implementations.
Frameworks and glossary
How the concepts fit together, and what each term means.
The frameworks explain how identity, trust, and lifecycle relate. The glossary gives short, stable definitions for each term, and the framework pages link to it.
Implement AAP
Build against the specifications.
Anyone can implement AAP. The conformance specification describes what an implementation must support and how it is tested, and the adapter specifications describe how MCP, A2A, and HTTP traffic maps onto the kernel objects.
Implementations
INTREXA AXIS
INTREXA AXIS is a commercial implementation of AAP, built and operated by INTREXA. It is one implementation of the standard, not the standard itself.
Visit INTREXA AXISCommunity and governance
Developed in public, under an open license.
The specifications are published under the Apache License 2.0. Agent Governance Foundation is an open standards initiative maintained by INTREXA Technologies (OPC) Private Limited.
Start with the core specification.
AAP-Core defines the six objects everything else builds on.