AGENT TRUST PROTOCOL
ARIA gives agents identity.
ATP is what happens at the door.
When an AI agent arrives at your API, three things need to happen: identity is verified, intent is declared, and authorization is checked against your policy. That's ATP.
The Agent Trust Protocol is a three-phase handshake that binds an agent's identity and stated intent to your published admission policy. It works like DMARC — you publish a DNS record that defines your requirements, and ATP enforces them.
THREE PHASES. EVERY TIME.
No shortcuts. No exceptions. Every agent goes through all three phases before it touches your infrastructure.
The agent presents its AID — a cryptographically signed W3C Verifiable Credential — and a signed intent declaration stating its purpose, principal, requested actions, data usage, and retention policy.
The receiving system checks the agent's credentials against its own DNS-published policy. Trust level sufficient? Scopes authorized? Delegation depth within limits? Intent declaration complete? Credential revoked?
Pass or reject. The evaluation result is returned as an ATP response code. Enforcement follows the mode set in your DNS policy — monitor, warn, or strict.
INTENT DECLARATION. NOT OPTIONAL.
Before an agent is admitted, it must state its purpose — what it intends to do, for whom, and within what boundaries. This is a protocol requirement. Not a suggested field. Not an optional header.
No other agent protocol requires intent declaration. DMARC authenticates the sender. OAuth authorizes the token. Neither asks why. ATP does. Because accountability starts with intent.
WHAT AN INTENT DECLARATION CONTAINS
The intent declaration is what separates ATP from every other agent authentication mechanism. It's not enough to prove who you are. You must state why you're here.
PUBLISH YOUR POLICY. ONE DNS RECORD.
Receivers publish an Agent Trust Policy as a DNS TXT record at _aria-policy.{your-domain}. This record defines what your infrastructure requires from incoming agents.
EXAMPLE: FINANCIAL SERVICES
_aria-policy.bank.com TXT v=ATP1; min=L2; enforce=strict; req=commerce.*,invoice.*; deny=identity.represent.human; intent=purpose,principal_ref; depth=3; rate=100/hr; qualify=sector:finance>sox; rua=https://bank.com/atp-reports
DNS RECORD TAGS
EXAMPLE: HEALTHCARE API
v=ATP1; min=L3; enforce=strict; req=health:patient:read; deny=health:patient:export; intent=purpose,principal_ref, data_usage,retention; qualify=sector:health>hipaa; rate=50/hr
EXAMPLE: INTERNAL TOOLING
v=ATP1; min=L0; enforce=monitor; rua=mailto:ops@company.com
START WITH MONITORING. ENFORCE WHEN READY.
ATP is designed for progressive deployment. Start by observing. Move to enforcement when you understand your traffic. Exactly like DMARC.
Log everything. Admit all agents regardless of compliance. Non-compliant agents flagged in reports but not blocked.
Admit all agents. Non-compliant agents receive an X-ATP-Warning header. Your API can handle warned agents differently.
Reject non-compliant agents. ATP error response returned with a specific response code. Only compliant agents admitted.
RESPONSE CODES
Every ATP evaluation returns a specific code. The agent knows exactly what passed, what failed, and why.
TRANSPORT BINDINGS
ATP is transport-agnostic. The identity and intent travel alongside the request, not inside it. Two bindings at launch.
HTTP TRANSPORT
POST /api/v2/invoices/4471 HTTP/1.1 X-ARIA-AID: <base64url-encoded signed AID> X-ARIA-Intent: <base64url-encoded signed intent>
Standard HTTP headers. Works with any REST API.
MCP TRANSPORT
{
"name": "fetch_invoice",
"arguments": { "invoice_id": "4471" },
"aria": {
"aid": "<signed AID>",
"intent": "<signed intent>"
}
}Native MCP integration. Works with Claude, LangChain, AutoGen, CrewAI.
THE DMARC PARALLEL
If you understand DMARC, you understand ATP. Same pattern. Same progressive deployment. One critical addition: intent.
DMARC authenticates who sent an email. ATP authenticates who the agent is AND evaluates what it intends to do. ATP is DMARC + intent declaration.
Start with monitoring. Today.
Publish one DNS record. See every agent hitting your API — their identity, their intent, their trust level. No blocking. No breaking changes. Just visibility.
YOUR FIRST ATP POLICY
_aria-policy.yourdomain.com TXT "v=ATP1; min=L0; enforce=monitor; rua=mailto:you@yourdomain.com"
ATP is defined in §05 of the ARIA specification. For the complete technical reference including scope namespaces, delegation rules, and Trust Ledger integration, see the spec.