Agent Governance Protocol (AGP)

AGP is an experimental governance layer for multi-agent systems.

It defines how independent agents or authorities can propose, review, approve, reject, veto and audit high-impact decisions without trusting a single coordinator as the sole source of truth.

Status: experimental. AGP is not yet a production standard.

120-Second Demo

Run the public AGP demo with no external dependencies:

python3 examples/120_second_demo/demo.py

Fast mode:

python3 examples/120_second_demo/demo.py --fast

Valid governance path:

python3 examples/120_second_demo/demo.py --happy-path --fast

The demo shows a coordinator changing a deployment payload after approval. A coordinator-trusting workflow accepts it because the approval count is still present. AGP rejects it because the approvals are bound to the exact approved input.

Read the demo documentation

Whitepaper

The current public review draft is:

AGP Whitepaper v0.9.2 — A Deterministic Governance Layer for Multi-Agent Systems

• Read online
• Download PDF
• Submit technical feedback

The whitepaper is experimental, is not a production standard, and has not yet received independent security review.

Why AGP?

• MCP connects models to tools and data.
• A2A-style protocols let agents communicate.
• Workflow engines coordinate execution.
• AGP governs collective decisions.

A workflow can record that a deployment was approved. AGP additionally aims to make the authority snapshot, evidence, ballots, resolution and history independently verifiable.

Core properties

• deterministic resolution;
• canonical serialization;
• independent Python and Go implementations;
• Ed25519 signed envelopes;
• replay, expiration and revocation checks;
• append-only transparency log;
• external audit receipts;
• conformance and adversarial test vectors.

Architecture

flowchart LR
    P[Proposal] --> E[Evidence]
    E --> B[Signed ballots]
    B --> R[Deterministic resolution]
    R --> L[Transparency log]
    L --> A[Independent audit]

AGP vs. a conventional workflow

AGP is intentionally more complex. For low-risk internal automation, a conventional workflow is usually the better choice.

Reproducible results

AGP v0.3 Conformance:          260/260 passed
AGP v0.4 Signed Conformance:    10/10 passed
AGP v0.5 Transparency:           8/8 passed
AGP vs Workflow benchmark:       8/8 attacks detected by AGP

The workflow baseline in the benchmark detected 0/8 because it treated coordinator state as authoritative. This is a limited experimental benchmark, not a claim that all workflow engines are insecure.

Trust Primitive Engine quick start

The AGP Trust Primitive Engine 2.3 is published on PyPI as agp-tpe.

Requirements:

• Python 3.12+

Install it without cloning this repository:

python -m pip install agp-tpe

Verify the installed distribution and packaged schemas:

python - <<'PY'
from importlib.metadata import version
from trust_primitive_engine import DEFAULT_SCHEMA_DIR

print("agp-tpe", version("agp-tpe"))
print("schemas:", DEFAULT_SCHEMA_DIR)
assert DEFAULT_SCHEMA_DIR.is_dir()
PY

Use the stable public facade:

from trust_primitive_engine import (
    TrustPolicyEvaluationError,
    evaluate_trust_policy,
)

try:
    result = evaluate_trust_policy(
        signed_context=signed_context,
        policy=policy,
        keyring=keyring,
        policy_set=policy_set,
    )
except TrustPolicyEvaluationError as exc:
    print(exc.code, exc.detail)
else:
    print(result["status"])

A real evaluation requires an AGP signed Decision Context, a Trust Policy, and the corresponding verification keyring. See the Trust Primitive Engine integration guide for the complete input contract, policy references, failure handling, and command-line examples.

TPE 2.3 remains experimental and has not received an independent security audit.

Repository benchmark quick start

Requirements:

• Python 3.10+
• Go 1.22+

git clone https://github.com/agpprotocol/agp.git
cd agp
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements-v0.4.txt
python3 run_benchmark_all.py

Expected final line:

AGP BENCHMARK COMPLETE

Repository map

spec/           Conformance profile
python/         Python resolver
go/             Go resolver
signed/         Signed envelope conformance
transparency/   Append-only audit log
benchmark/      AGP vs workflow experiment
examples/       Reference scenarios
docs/           Architecture, threat model and evaluation

What AGP does not claim

AGP does not:

• replace authentication, authorization or IAM;
• replace orchestration engines;
• guarantee that evidence is factually true;
• eliminate compromised members;
• solve governance for every multi-agent system;
• claim production maturity.

Current research question

Do high-impact multi-agent systems need a portable, independently verifiable governance layer distinct from communication and orchestration?

Documentation

• Architecture
• Threat model
• Benchmark
• Roadmap
• Contributing
• Security policy
• Governance

License

Apache License 2.0. See LICENSE.