AION Protocol

The trust layer for AI agents — identity, limits, and court-ready proof for every agent action.

AI agents don't just chat anymore — they spend money, run code, delete files, and call other agents. What they're missing is a bank-grade control layer. AION gives every agent:

• 🪪 Identity — a signed Intent Mandate (budget + payee allowlist + expiry) the agent cannot exceed
• 🚦 Limits — one-time, amount-and-payee-bound payment authorizations (replay-proof)
• 🧾 Proof — tamper-evident, hash-chained receipts for every action
• ⚖️ Disputes — exportable, third-party-verifiable evidence bundles

AION doesn't move money — rails like x402 do. AION decides whether a payment is allowed, and proves what happened.

Quickstart

pip install aion-core

1. Scan — find risky patterns in your agent's code:

aion scan .

2. Guard — allow, block, or require approval for actions:

aion guard-demo

3. Payments — give your agent a spending mandate and let it pay safely:

# Create a signed mandate: agent:shopbot can spend max 500/payment, 1000 total, only these payees
aion mandate-create agent:shopbot 500 1000 "api:weather,api:news"

# Agent requests a one-time payment auth (bound to exact amount + payee)
aion pay <mandate_id> 300 api:weather

# Settle it with the on-chain/off-chain reference
aion settle <jti> x402:tx_0xabc123

# Verify as a third party / export court-ready dispute evidence
aion pay-verify <jti>
aion dispute <mandate_id> --save

Attack table (all enforced, all tested):

4. x402 adapter — enforce the human's intent on real x402 payments:

# Seller asks for 0.003 USDC on base-sepolia (x402 PAYMENT-REQUIRED body)
# Agent pre-flights it: does the signed mandate allow this exact payment?
aion x402-pay <mandate_id> @x402-requirements.json

# Seller-side: is this agent's payment actually allowed? (called inside /verify)
aion x402-check <mandate_id> @x402-requirements.json <jti>

# Bind the on-chain settlement hash into the receipt chain
aion x402-settle <jti> @x402-response.json

x402's own spec says funds "must only move in accordance with client intentions" — but the protocol has no way to sign, bind, or prove those intentions. AION adds that missing layer: a signed mandate the agent cannot exceed, one-time authorizations bound to exact amount + payee, and settlement hashes chained into verifiable receipts. Overcharge, rogue payee, double-spend, and prompt-injected terms are all blocked.

Why not just trust the model?

A modern model writes clean code — that was never the problem. The problem is authority: an agent that can act on the real world needs the same thing humans got from banks: card limits, one-time OTPs, receipts, and chargebacks. AION is that layer. It doesn't depend on the agent's goodwill — only on signatures and state the agent cannot touch.

Receipts

Every allowed/blocked/approved action gets a tamper-evident receipt (sha256-chained, secrets auto-redacted):

aion receipts 10

Optional: hosted verification API

Local mandates and receipts are free and offline. For third-party verification, revocation, and cross-company agent trust, run the API server:

pip install "aion-core[cloud]"
uvicorn aion.api:app

Endpoints: /issue, /enforce, /verify/{jti}, /revoke/{jti}, /health. The server boots in degraded mode if the database is down and reports it in /health.

Status

• Scan: ✅ | Guard: ✅ | Authority (one-time tokens + delegation): ✅
• Receipts + audit chain: ✅
• Payment Trust Rails (mandate → bound auth → settlement → dispute bundle): ✅
• x402 adapter (client pre-flight, seller-side verify, settlement binding): ✅
• Hosted verification network: 🟡 live at https://aion-protocol.onrender.com

Links

• Landing page: https://sourabh1845.github.io/aion-protocol
• GitHub: https://github.com/Sourabh1845/aion-protocol
• Live API: https://aion-protocol.onrender.com

Built by Sourabh Ranjan Sahoo.