Skip to content

authsec-ai/AAAP

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

1 Commit
 
 
 
 
 
 
 
 

Repository files navigation

Agent Action Approval Protocol (AAAP)

The missing governance layer for AI agents.

OAuth tells agents who they are. MCP tells agents what tools exist. AAAP tells agents what they're allowed to do — and which human said so.


What is AAAP?

AAAP is an open standard protocol for human-in-the-loop governance of AI agent actions. When an AI agent wants to do something risky — delete files, push code, drop databases, modify infrastructure — AAAP ensures a human approves first.

97% of deployed AI agent systems have no mechanism for end-users to approve what the agent does on their behalf (OWASP, 2026). AAAP fixes this.

Protocol Lifecycle

1. EVALUATE  — Agent submits action to AAAP server
2. SCORE     — Risk engine scores 0-100
3. NOTIFY    — If risky, push notification to human's phone
4. DECIDE    — Human approves or denies (with biometric)
5. ENFORCE   — Agent gets decision, proceeds or aborts
6. AUDIT     — Immutable log entry created

Key Properties

  • Framework-agnostic — works with any agent (LangChain, CrewAI, MCP, Claude, Codex, custom)
  • Simple — two HTTP calls for the common case (evaluate + poll)
  • Asynchronous — human doesn't need to be online at evaluation time
  • Configurable — risk policies are per-organization, not hardcoded
  • Auditable — every action, score, and decision is logged
  • Built on standards — OAuth 2.0, CIBA (RFC 9126), JSON-RPC

Documents

Document Description
AAAP Specification v1.0 Full protocol specification (RFC-style, 14 sections)
OWASP Agentic Top 10 Mapping How AAAP covers 8 of 10 OWASP risks
NIST Submission Response to NIST AI Agent Standards Initiative

OWASP Coverage

AAAP provides runtime mitigation for 8 of 10 OWASP Agentic Top 10 risks:

# Risk Coverage
1 Excessive Agency Full
2 Prompt Injection Partial
3 Tool Misuse Full
4 Uncontrolled Autonomy Full
5 Cascading Failures Partial
6 Insecure Identity Full
7 Insufficient Logging Full
8 Supply Chain Attacks Partial
9 Memory Poisoning Indirect
10 Multi-Agent Trust Full

Relationship to Other Standards

OAuth/OIDC:     "Who is this agent?"
MCP:            "What tools can this agent use?"
A2A:            "How do agents communicate?"
ACP:            "Is this action cryptographically authorized?"

AAAP:           "Should this specific action be allowed,
                 and which human said so?"

Reference Implementation

  • Server (Agent Guard): AuthSec — production-deployed API
  • Client (Agent Shield): authsec-agent-shield — system-level protection binary
  • Mobile Approver: AuthSec Mobile (iOS/Android) — biometric approval via CIBA push

Live-Tested With

  • Claude Code (Anthropic) — blocked rm -rf, git push --force, git reset --hard
  • Docker — blocked docker rm -f
  • Kubernetes — blocked kubectl delete namespace production
  • MySQL — blocked DROP TABLE users
  • PostgreSQL — blocked via psql shim
  • Azure CLI — blocked az vm delete

Get Involved

License

Apache-2.0

About

No description, website, or topics provided.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

 
 
 

Contributors