aiap-client — AI Agency Protocol SDK

Identity is persistent. Agency is ephemeral.

Python SDK for the AI Agency Protocol (AIAP). Enables agents to request scoped, time-limited authority from a central broker.

Install

pip install aiap-client
pip install aiap-client[aws]   # + boto3 for credential sessions
pip install aiap-client[cert]  # + cryptography for certificate auth

Quick Start

from aiap_client import AgencyClient, AgencyLevel

client = AgencyClient(
    broker_url="https://broker.example.com",
    agent_id="YXFQTW0VCL",
    mac_secret="your-hmac-secret",
)

# Request JIT credentials
grant = await client.request_agency(
    intent="Invoke underwriting model",
    use_case="underwriting",
    resources=["bedrock:InvokeModel"],
    duration_seconds=900,
)

if grant.granted:
    session = grant.to_boto3_session(region="us-east-1")
    bedrock = session.client("bedrock-runtime")
    # Invoke with scoped creds — expires in 15 min
else:
    print(f"Denied: {grant.reason}")

Mediated Execution (Level 2)

Agent never sees credentials:

result = await client.execute(
    intent="Invoke model for risk assessment",
    use_case="underwriting",
    action="bedrock:InvokeModel",
    parameters={"modelId": "<model-id>", "body": {...}},
)
print(result.output)  # Only the result

Certificate Authentication

from aiap_client import AgencyClient, CertificateSigner

client = AgencyClient(
    broker_url="https://broker.example.com",
    agent_id="YXFQTW0VCL",
    signer=CertificateSigner(cert_path="agent.pem", key_path="agent-key.pem"),
)

Protocol

See RFC-001: AI Agency Protocol