┌─────────┐     ┌─────────────┐     ┌─────────────┐
│  Agent  │────▶│ AIP Policy  │────▶│ MCP Server  │
│         │◀────│   Engine    │◀────│             │
└─────────┘     └─────────────┘     └─────────────┘
                      │
                      ▼
              ┌─────────────┐
              │ AIP Server  │  (optional)
              │  Endpoint   │
              └─────────────┘

         LAYER 1 -- IDENTITY                    LAYER 2 -- ENFORCEMENT
         (Who is this agent?)                  (What can it do?)

+-------------------+                       +-------------------+
|  AIP Registry     |  (Root of Trust)      |   AI Client       |
|  Registers Agents |                       | Cursor / Claude   |
|  Signs Certs      |                       +---------+---------+
+--------+----------+                                 | tool call + AAT
         | Issues Attestation                         v
         v                                  +---------------------------+
+-------------------+                       |       AIP Proxy           |
| Agent Identity    |                       |                           |
| Document (AID)    |                       | 1. Verify AAT signature   | <-- Registry
|  (Public Key)     |                       | 2. Check revocation list  |     (revocation)
+---------+---------+                       | 3. Validate user binding  |
          | Signs Token Requests            | 4. Check AAT capabilities |
          v                                 | 5. Evaluate local policy  |
+-------------------+                       | 6. DLP scan               |
|  Token Issuer     |                       | 7. Audit log              |
|  Validates ID     |      AAT             +---------+-----------------+
|  Binds User       | ---------------------->         | ALLOW / DENY
|  Issues AAT       |                                 v
+-------------------+                       +-------------------+
                                            |   Real Tool       |
                                            | Docker/Postgres   |
                                            | GitHub / etc.     |
                                            +-------------------+

apiVersion: aip.io/v1alpha3
kind: AgentPolicy
metadata:
  name: <string>
  version: <string>           # OPTIONAL
  owner: <string>             # OPTIONAL
  signature: <string>         # OPTIONAL
spec:
  mode: <string>              # OPTIONAL, default: "enforce"
  allowed_tools: [<string>]   # OPTIONAL
  allowed_methods: [<string>] # OPTIONAL
  denied_methods: [<string>]  # OPTIONAL
  tool_rules: [<ToolRule>]    # OPTIONAL
  protected_paths: [<string>] # OPTIONAL
  strict_args_default: <bool> # OPTIONAL, default: false
  dlp: <DLPConfig>            # OPTIONAL
  identity: <IdentityConfig>  # OPTIONAL
  server: <ServerConfig>      # OPTIONAL
  registry: <RegistryConfig>  # OPTIONAL (v1alpha3)
  aat: <AATConfig>            # OPTIONAL (v1alpha3)

metadata:
  name: <string>        # REQUIRED - Policy identifier
  version: <string>     # OPTIONAL - Semantic version (e.g., "1.0.0")
  owner: <string>       # OPTIONAL - Contact email
  signature: <string>   # OPTIONAL - Policy signature

metadata:
  name: production-agent
  signature: "ed25519:YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXo..."

allowed_tools:
  - github_get_repo
  - read_file
  - list_directory

# Default allowed methods (when not specified)
allowed_methods:
  - initialize
  - initialized
  - ping
  - tools/call
  - tools/list
  - completion/complete
  - notifications/initialized
  - notifications/progress
  - notifications/message
  - notifications/resources/updated
  - notifications/resources/list_changed
  - notifications/tools/list_changed
  - notifications/prompts/list_changed
  - cancelled

denied_methods:
  - resources/read
  - resources/write

protected_paths:
  - ~/.ssh
  - ~/.aws/credentials
  - .env

tool_rules:
  - tool: <string>              # REQUIRED - Tool name
    action: <string>            # OPTIONAL - allow|block|ask (default: allow)
    rate_limit: <string>        # OPTIONAL - e.g., "10/minute"
    strict_args: <bool>         # OPTIONAL - Override strict_args_default
    schema_hash: <string>       # OPTIONAL - Tool schema integrity
    allow_args:                 # OPTIONAL
      <arg_name>: <regex>

allow_args:
  url: "^https://github\\.com/.*"
  query: "^SELECT\\s+.*"

TOOL_SCHEMA_HASH(tool):
  schema = {
    "name": tool.name,
    "description": tool.description,
    "inputSchema": tool.inputSchema
  }
  canonical = JSON_CANONICALIZE(schema)  # RFC 8785
  hash = SHA256(canonical)
  RETURN "sha256:" + hex_encode(hash)

dlp:
  enabled: <bool>             # OPTIONAL, default: true when dlp block present
  scan_requests: <bool>       # OPTIONAL, default: false
  scan_responses: <bool>      # OPTIONAL, default: true
  detect_encoding: <bool>     # OPTIONAL, default: false
  filter_stderr: <bool>       # OPTIONAL, default: false
  max_scan_size: <string>     # OPTIONAL, default: "1MB"
  on_request_match: <string>  # OPTIONAL, default: "block"
  on_redaction_failure: <string>    # OPTIONAL, default: "block"
  log_original_on_failure: <bool>   # OPTIONAL, default: false
  patterns:
    - name: <string>          # REQUIRED - Rule identifier
      regex: <string>         # REQUIRED - Detection pattern
      scope: <string>         # OPTIONAL, default: "all" (request|response|all)

[REDACTED:<name>]

spec:
  identity:
    enabled: <bool>           # OPTIONAL, default: false
    token_ttl: <duration>     # OPTIONAL, default: "5m"
    rotation_interval: <duration>  # OPTIONAL, default: "4m"
    require_token: <bool>     # OPTIONAL, default: false
    session_binding: <string> # OPTIONAL, default: "process"
    nonce_window: <duration>  # OPTIONAL, default: equals token_ttl
    policy_transition_grace: <duration>  # OPTIONAL, default: "0s"
    audience: <string>        # OPTIONAL, default: policy metadata.name
    nonce_storage: <NonceStorageConfig>  # OPTIONAL
    keys: <KeyConfig>         # OPTIONAL

spec:
  server:
    enabled: <bool>           # OPTIONAL, default: false
    listen: <string>          # OPTIONAL, default: "127.0.0.1:9443"
    failover_mode: <string>   # OPTIONAL, default: "fail_closed"
    timeout: <duration>       # OPTIONAL, default: "5s"
    tls:
      cert: <string>
      key: <string>
    endpoints:
      validate: <string>      # default: "/v1/validate"
      revoke: <string>        # default: "/v1/revoke"
      jwks: <string>          # default: "/v1/jwks"
      health: <string>        # default: "/health"
      metrics: <string>       # default: "/metrics"

spec:
  registry:
    enabled: <bool>                 # OPTIONAL, default: false
    endpoint: <string>              # REQUIRED if enabled - Registry URL
    tls:                            # OPTIONAL
      ca_cert: <string>            # Path to CA certificate for registry
      client_cert: <string>        # Path to client certificate (mTLS)
      client_key: <string>         # Path to client key (mTLS)
    cache:                          # OPTIONAL
      enabled: <bool>              # default: true
      ttl: <duration>              # default: "5m"
      max_entries: <int>           # default: 10000
    revocation:                     # OPTIONAL
      check_interval: <duration>   # default: "30s"
      mode: <string>               # "online" | "cached" | "crl"
      crl_path: <string>           # Path to local CRL file (if mode=crl)
    auth:                           # OPTIONAL
      type: <string>               # "bearer" | "mtls" | "api_key"
      token: <string>              # Bearer token for registry access
      api_key: <string>            # API key for registry access

registry:
  enabled: true
  endpoint: "https://registry.aip.example.com"

registry:
  revocation:
    mode: "online"

registry:
  revocation:
    mode: "cached"
    check_interval: "30s"

registry:
  revocation:
    mode: "crl"
    crl_path: "/etc/aip/revocation.crl"
    check_interval: "5m"  # Re-read CRL file

registry:
  cache:
    enabled: true
    ttl: "5m"
    max_entries: 10000

spec:
  aat:
    enabled: <bool>               # OPTIONAL, default: false
    require: <bool>               # OPTIONAL, default: false
    validation:                   # OPTIONAL
      verify_signature: <bool>    # default: true
      verify_user_binding: <bool> # default: true
      verify_capabilities: <bool> # default: true
      max_token_age: <duration>   # default: "1h"
      clock_skew: <duration>      # default: "30s"
    capabilities_mode: <string>   # OPTIONAL, default: "intersect"
    trusted_issuers: [<string>]   # OPTIONAL - List of trusted Token Issuer IDs
    header_name: <string>         # OPTIONAL, default: "X-AIP-AAT"

aat:
  capabilities_mode: "intersect"

aat:
  capabilities_mode: "aat_only"

aat:
  capabilities_mode: "policy_only"

aat:
  trusted_issuers:
    - "https://issuer.aip.example.com"
    - "https://issuer.aip.corp.internal"

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "read_file",
    "arguments": {"path": "/etc/hosts"},
    "_aip_aat": "<base64url-encoded-aat>"
  }
}

POST /v1/validate HTTP/1.1
X-AIP-AAT: <base64url-encoded-aat>

NORMALIZE(input):
  1. Apply NFKC Unicode normalization
  2. Convert to lowercase
  3. Trim leading/trailing whitespace
  4. Remove non-printable and control characters
  5. Return result

IS_METHOD_ALLOWED(method):
  normalized = NORMALIZE(method)

  IF normalized IN denied_methods:
    RETURN DENY

  IF "*" IN allowed_methods:
    RETURN ALLOW

  IF normalized IN allowed_methods:
    RETURN ALLOW

  RETURN DENY

IS_TOOL_ALLOWED(tool_name, arguments, identity_token, aat):
  normalized = NORMALIZE(tool_name)

  # Step 0: Verify identity token (if configured)
  IF identity.require_token:
    IF identity_token IS EMPTY OR NOT valid_token(identity_token):
      RETURN TOKEN_REQUIRED

  # Step 0b: Verify AAT (v1alpha3)
  IF aat.require:
    IF aat IS EMPTY:
      RETURN AAT_REQUIRED
    IF NOT valid_aat(aat):
      RETURN AAT_INVALID
  ELSE IF aat IS PRESENT:
    # Validate opportunistically even when not required
    IF NOT valid_aat(aat):
      LOG_WARNING("Invalid AAT presented but not required")

  # Step 0c: Check AAT capabilities (v1alpha3)
  IF aat IS PRESENT AND aat IS VALID:
    IF aat.capabilities_mode == "intersect":
      IF normalized NOT IN aat.capabilities:
        RETURN AAT_CAPABILITY_DENIED
    ELSE IF aat.capabilities_mode == "aat_only":
      IF normalized NOT IN aat.capabilities:
        RETURN AAT_CAPABILITY_DENIED
      SKIP local allowed_tools check (Step 4)

  # Step 1: Check rate limiting
  IF rate_limiter_exceeded(normalized):
    RETURN RATE_LIMITED

  # Step 2: Check protected paths
  IF arguments_contain_protected_path(arguments):
    RETURN PROTECTED_PATH

  # Step 3: Check tool rules
  rule = find_rule(normalized)
  IF rule EXISTS:
    IF rule.action == "block":
      RETURN BLOCK
    IF rule.action == "ask":
      IF validate_arguments(rule, arguments):
        RETURN ASK
      ELSE:
        RETURN BLOCK

  # Step 4: Check allowed_tools list (skipped if aat_only mode)
  IF aat.capabilities_mode != "aat_only":
    IF normalized NOT IN allowed_tools:
      RETURN BLOCK

  # Step 5: Validate arguments (if rule exists)
  IF rule EXISTS AND rule.allow_args NOT EMPTY:
    IF NOT validate_arguments(rule, arguments):
      RETURN BLOCK

  # Step 6: Strict args check
  IF strict_args_enabled(rule):
    IF arguments has undeclared keys:
      RETURN BLOCK

  RETURN ALLOW

VALIDATE_ARGUMENTS(rule, arguments):
  FOR EACH (arg_name, pattern) IN rule.allow_args:
    IF arg_name NOT IN arguments:
      RETURN FALSE  # Required argument missing

    value = STRING(arguments[arg_name])
    IF NOT REGEX_MATCH(pattern, value):
      RETURN FALSE

  RETURN TRUE

CANONICALIZE(policy):
  1. Remove metadata.signature field (if present)
  2. Serialize to JSON using RFC 8785 (JSON Canonicalization Scheme)
  3. Return UTF-8 encoded bytes

POLICY_HASH(policy):
  canonical = CANONICALIZE(policy)
  hash = SHA-256(canonical)
  RETURN hex_encode(hash)

POST /v1/validate HTTP/1.1
Host: aip-server:9443
Content-Type: application/json
Authorization: Bearer <identity-token>
X-AIP-AAT: <agent-authentication-token>

{
  "tool": "<tool-name>",
  "arguments": { ... }
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "decision": "allow|block|ask",
  "reason": "<human-readable-reason>",
  "violations": [
    {
      "type": "<violation-type>",
      "field": "<field-name>",
      "message": "<description>"
    }
  ],
  "token_status": {
    "valid": true,
    "expires_in": 240
  },
  "aat_status": {
    "valid": true,
    "agent_id": "<agent-id>",
    "user_id": "<user-id>",
    "capabilities_checked": true,
    "issuer": "<issuer-id>"
  }
}

{
  "aat_version": "aip/v1alpha3",
  "iss": "<token-issuer-id>",
  "sub": "<agent-id>",
  "aud": "<target-service-or-proxy>",
  "iat": 1708300800,
  "exp": 1708304400,
  "nbf": 1708300800,
  "jti": "<unique-token-id>",

  "agent": {
    "id": "<agent-id>",
    "name": "<human-readable-agent-name>",
    "public_key_thumbprint": "<sha256-of-agent-public-key>",
    "aid_hash": "<sha256-of-agent-identity-document>"
  },

  "user_binding": {
    "user_id": "<user-identifier>",
    "auth_method": "<how-user-authenticated>",
    "auth_time": 1708300000,
    "delegation_scope": "<scope-of-delegation>"
  },

  "capabilities": {
    "tools": ["<tool-name>", ...],
    "resource_scopes": ["<scope>", ...],
    "max_calls_per_session": <int>,
    "allowed_servers": ["<mcp-server-id>", ...]
  },

  "context": {
    "session_id": "<uuid>",
    "policy_hash": "<64-char-hex>",
    "registry_id": "<registry-identifier>"
  }
}

RESOLVE_CAPABILITIES(aat, local_policy, mode):
  IF mode == "intersect":
    RETURN INTERSECTION(aat.capabilities.tools, local_policy.allowed_tools)

  IF mode == "aat_only":
    RETURN aat.capabilities.tools

  IF mode == "policy_only":
    RETURN local_policy.allowed_tools

{
  "resource_scopes": [
    "repo:read",
    "repo:write",
    "db:read",
    "file:/home/user/**:read",
    "api:github.com:*"
  ]
}

{
  "alg": "ES256",
  "typ": "aat+jwt",
  "kid": "<key-id-of-issuer-signing-key>"
}

┌──────────────┐
│  User Grants  │
│  Delegation   │
└──────┬───────┘
       │
       ▼
┌──────────────┐     ┌──────────────┐
│ Token Issuer │────▶│   Active     │
│  Issues AAT  │     │     AAT      │
└──────────────┘     └──────┬───────┘
                            │
       ┌────────────────────┼────────────────────┐
       │                    │                    │
       ▼                    ▼                    ▼
┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│   Refresh    │     │   Expired    │     │   Revoked    │
│   (new AAT)  │     │   (reject)   │     │  (by registry│
└──────────────┘     └──────────────┘     │  or issuer)  │
                                          └──────────────┘

VALIDATE_AAT(aat):
  # Step 1: Parse and verify JWT structure
  IF NOT valid_jwt_structure(aat):
    RETURN (INVALID, "malformed_aat")

  # Step 2: Verify version
  IF aat.aat_version != "aip/v1alpha3":
    RETURN (INVALID, "unsupported_version")

  # Step 3: Verify issuer
  IF trusted_issuers IS CONFIGURED:
    IF aat.iss NOT IN trusted_issuers:
      RETURN (INVALID, "untrusted_issuer")

  # Step 4: Verify signature
  issuer_key = GET_ISSUER_PUBLIC_KEY(aat.iss, aat.header.kid)
  IF issuer_key IS NULL:
    RETURN (INVALID, "unknown_signing_key")
  IF NOT verify_signature(aat, issuer_key):
    RETURN (INVALID, "signature_invalid")

  # Step 5: Check temporal validity
  now = current_time()
  IF now < aat.nbf - clock_skew:
    RETURN (INVALID, "not_yet_valid")
  IF now > aat.exp + clock_skew:
    RETURN (INVALID, "aat_expired")

  # Step 6: Check audience
  IF aat.aud does not match expected_audience:
    RETURN (INVALID, "audience_mismatch")

  # Step 7: Check revocation (via registry)
  IF registry.enabled:
    revocation_status = CHECK_REGISTRY_REVOCATION(aat)
    IF revocation_status == REVOKED:
      RETURN (INVALID, "aat_revoked")

  # Step 8: Verify agent identity
  IF registry.enabled:
    agent_record = GET_AGENT_FROM_REGISTRY(aat.agent.id)
    IF agent_record IS NULL:
      RETURN (INVALID, "unknown_agent")
    IF agent_record.public_key_thumbprint != aat.agent.public_key_thumbprint:
      RETURN (INVALID, "agent_key_mismatch")
    IF agent_record.status != "active":
      RETURN (INVALID, "agent_inactive")

  # Step 9: Verify JTI uniqueness (replay prevention)
  IF NOT ATOMIC_CHECK_AND_RECORD_JTI(aat.jti):
    RETURN (INVALID, "replay_detected")

  RETURN (VALID, nil)

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "read_file",
    "arguments": {"path": "/etc/hosts"},
    "_aip_aat": "eyJhbGciOiJFUzI1NiIsInR5cCI6ImFhdCtqd3QifQ..."
  }
}

POST /mcp HTTP/1.1
X-AIP-AAT: eyJhbGciOiJFUzI1NiIsInR5cCI6ImFhdCtqd3QifQ...
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "read_file",
    "arguments": {"path": "/etc/hosts"}
  }
}

{
  "aid_version": "aip/v1alpha3",
  "agent_id": "<globally-unique-identifier>",
  "name": "<human-readable-name>",
  "description": "<agent-description>",
  "created_at": "<ISO-8601>",
  "status": "active",

  "public_key": {
    "kty": "EC",
    "crv": "P-256",
    "x": "...",
    "y": "...",
    "kid": "<key-id>",
    "use": "sig"
  },

  "metadata": {
    "platform": "<agent-platform>",
    "version": "<agent-version>",
    "owner": "<owner-email-or-org>",
    "tags": ["<tag>", ...]
  },

  "registry_attestation": {
    "registry_id": "<registry-identifier>",
    "signed_at": "<ISO-8601>",
    "expires_at": "<ISO-8601>",
    "signature": "<base64url-encoded-signature>"
  }
}

ATTEST_AID(aid, registry_key):
  aid_copy = COPY(aid)
  REMOVE aid_copy.registry_attestation
  canonical = JSON_CANONICALIZE(aid_copy)  # RFC 8785
  signature = SIGN(registry_key, canonical)
  RETURN {
    "registry_id": registry.id,
    "signed_at": now(),
    "expires_at": now() + attestation_ttl,
    "signature": base64url_encode(signature)
  }

POST /v1/agents HTTP/1.1
Host: registry.aip.example.com
Content-Type: application/json
Authorization: Bearer <registration-token>

{
  "name": "My AI Agent",
  "description": "Development assistant for code review",
  "public_key": {
    "kty": "EC",
    "crv": "P-256",
    "x": "...",
    "y": "..."
  },
  "metadata": {
    "platform": "cursor",
    "version": "1.0.0",
    "owner": "[email protected]"
  }
}

HTTP/1.1 201 Created
Content-Type: application/json

{
  "agent_id": "ag_550e8400-e29b-41d4-a716-446655440000",
  "aid": { ... },
  "registration_token_expires_at": "2026-03-19T00:00:00Z"
}

GET /v1/agents/{agent_id} HTTP/1.1
Host: registry.aip.example.com

HTTP/1.1 200 OK
Content-Type: application/json

{
  "agent_id": "ag_550e8400-e29b-41d4-a716-446655440000",
  "status": "active",
  "aid": { ... },
  "public_key": { ... }
}

GET /v1/revocations HTTP/1.1
Host: registry.aip.example.com
If-None-Match: "<etag>"

HTTP/1.1 200 OK
Content-Type: application/json
ETag: "<new-etag>"
Cache-Control: max-age=30

{
  "version": 42,
  "updated_at": "2026-02-19T10:30:00Z",
  "revoked_agents": [
    {
      "agent_id": "ag_...",
      "revoked_at": "2026-02-19T10:00:00Z",
      "reason": "Security incident"
    }
  ],
  "revoked_aats": [
    {
      "jti": "...",
      "revoked_at": "2026-02-19T10:15:00Z",
      "reason": "Token compromise"
    }
  ],
  "revoked_sessions": [
    {
      "session_id": "...",
      "revoked_at": "2026-02-19T10:20:00Z",
      "reason": "User logout"
    }
  ]
}

POST /v1/agents/{agent_id}/rotate-key HTTP/1.1
Host: registry.aip.example.com
Content-Type: application/json
Authorization: Bearer <agent-proof-of-possession>

{
  "new_public_key": {
    "kty": "EC",
    "crv": "P-256",
    "x": "...",
    "y": "..."
  }
}

GET /v1/jwks HTTP/1.1
Host: registry.aip.example.com

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: public, max-age=3600

{
  "keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "kid": "registry-key-2026-02",
      "use": "sig",
      "alg": "ES256",
      "x": "...",
      "y": "..."
    }
  ]
}

┌─────────┐          ┌──────────────┐          ┌──────────────┐
│  Agent   │          │ Token Issuer │          │ AIP Registry │
└────┬─────┘          └──────┬───────┘          └──────┬───────┘
     │                       │                         │
     │ 1. Token Request      │                         │
     │ (signed challenge)    │                         │
     ├──────────────────────▶│                         │
     │                       │ 2. Verify agent in      │
     │                       │    registry              │
     │                       ├────────────────────────▶│
     │                       │                         │
     │                       │ 3. Agent record +        │
     │                       │    revocation status     │
     │                       │◀────────────────────────┤
     │                       │                         │
     │                       │ 4. Verify proof of      │
     │                       │    possession            │
     │                       │                         │
     │                       │ 5. Verify user           │
     │                       │    authorization          │
     │                       │                         │
     │ 6. AAT                │                         │
     │◀──────────────────────┤                         │
     │                       │                         │

POST /v1/token HTTP/1.1
Host: issuer.aip.example.com
Content-Type: application/json

{
  "grant_type": "agent_authentication",
  "agent_id": "<agent-id>",
  "proof": {
    "type": "signed_challenge",
    "challenge": "<server-provided-challenge>",
    "signature": "<base64url-encoded-signature>",
    "algorithm": "ES256"
  },
  "user_authorization": {
    "type": "oauth2_token",
    "token": "<user-oauth-access-token>"
  },
  "requested_capabilities": {
    "tools": ["read_file", "list_directory", "git_status"],
    "resource_scopes": ["repo:read"],
    "allowed_servers": ["mcp://localhost:8080"]
  },
  "audience": "<target-proxy-or-server>"
}

GENERATE_PROOF(agent_key, challenge):
  payload = {
    "challenge": challenge,
    "agent_id": agent.id,
    "timestamp": now()
  }
  canonical = JSON_CANONICALIZE(payload)
  signature = SIGN(agent_key.private, canonical)
  RETURN {
    "type": "signed_challenge",
    "challenge": challenge,
    "signature": base64url_encode(signature),
    "algorithm": agent_key.algorithm
  }

{
  "user_authorization": {
    "type": "oauth2_token",
    "token": "ya29.A0ARrdaM..."
  }
}

{
  "user_authorization": {
    "type": "local_user",
    "uid": 501,
    "username": "developer",
    "hostname": "dev-machine.local"
  }
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "aat": "eyJhbGciOiJFUzI1NiIsInR5cCI6ImFhdCtqd3QiLCJraWQiOiJpc3N1ZXIta2V5LTIwMjYtMDIifQ...",
  "token_type": "aat+jwt",
  "expires_in": 3600,
  "refresh_token": "<opaque-refresh-token>",
  "capabilities_granted": {
    "tools": ["read_file", "list_directory", "git_status"],
    "resource_scopes": ["repo:read"]
  },
  "capabilities_denied": {
    "tools": [],
    "reason": "All requested capabilities granted"
  }
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": "<error-code>",
  "error_description": "<human-readable>",
  "error_details": { ... }
}

DETERMINE_CAPABILITIES(requested, agent_record, user_permissions):
  # Start with requested capabilities
  granted = requested.tools

  # Intersect with agent's registered permissions (from registry)
  IF agent_record.allowed_tools IS NOT EMPTY:
    granted = INTERSECTION(granted, agent_record.allowed_tools)

  # Intersect with user's delegated permissions
  IF user_permissions.delegatable_tools IS NOT EMPTY:
    granted = INTERSECTION(granted, user_permissions.delegatable_tools)

  RETURN granted

GET /v1/jwks HTTP/1.1
Host: issuer.aip.example.com

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: public, max-age=3600

{
  "keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "kid": "issuer-key-2026-02",
      "use": "sig",
      "alg": "ES256",
      "x": "...",
      "y": "..."
    }
  ]
}

┌────────────┐     Grants Delegation     ┌────────────┐
│    User     │─────────────────────────▶│   Agent    │
│  (Human)    │                          │   (AI)     │
│             │     AAT carries:          │            │
│  user_id    │  - user_id               │  agent_id  │
│  auth_time  │  - auth_method           │  public_key│
│             │  - delegation_scope      │            │
└────────────┘                           └─────┬──────┘
                                               │
                                        Uses AAT for
                                        tool calls
                                               │
                                               ▼
                                        ┌────────────┐
                                        │ AIP Proxy  │
                                        │            │
                                        │ Verifies:  │
                                        │ - agent_id │
                                        │ - user_id  │
                                        │ - scope    │
                                        └────────────┘

VERIFY_DELEGATION_CHAIN(aat):
  # 1. Verify agent identity (AAT signature + registry check)
  IF NOT valid_aat_signature(aat):
    RETURN (INVALID, "signature_invalid")

  # 2. Verify user binding is present
  IF aat.user_binding IS EMPTY:
    RETURN (INVALID, "missing_user_binding")

  # 3. Verify user authentication freshness
  max_auth_age = configured_max_auth_age OR 86400  # 24h default
  IF now() - aat.user_binding.auth_time > max_auth_age:
    RETURN (INVALID, "user_auth_stale")

  # 4. Verify delegation scope covers the requested action
  IF aat.user_binding.delegation_scope == "read_only":
    IF requested_tool is write_operation:
      RETURN (INVALID, "delegation_scope_exceeded")

  RETURN (VALID, nil)

{
  "timestamp": "2026-02-19T10:30:45.123Z",
  "direction": "upstream",
  "method": "tools/call",
  "tool": "write_file",
  "decision": "ALLOW",
  "policy_mode": "enforce",
  "violation": false,

  "agent_id": "ag_550e8400-e29b-41d4-a716-446655440000",
  "agent_name": "Cursor IDE Agent",
  "user_id": "[email protected]",
  "user_auth_method": "oidc",
  "delegation_scope": "tools",
  "aat_jti": "aat_660e8400-e29b-41d4-a716-446655440001",
  "aat_issuer": "https://issuer.aip.example.com",
  "session_id": "550e8400-e29b-41d4-a716-446655440000",
  "policy_hash": "a3c7f2e8d9b4f1e2c8a7d6f3e9b2c4f1..."
}

REVOKE_USER_DELEGATION(user_id):
  # Find all active AATs for this user
  affected_aats = FIND_AATS_BY_USER(user_id)

  FOR EACH aat IN affected_aats:
    ADD_TO_REVOCATION_LIST(aat.jti, "user_delegation_revoked")

  # Also revoke all sessions
  affected_sessions = FIND_SESSIONS_BY_USER(user_id)
  FOR EACH session IN affected_sessions:
    ADD_TO_REVOCATION_LIST(session.session_id, "user_delegation_revoked")

  LOG_REVOCATION_EVENT(user_id, affected_aats.count, affected_sessions.count)

{
  "jsonrpc": "2.0",
  "id": "<request_id>",
  "error": {
    "code": "<error_code>",
    "message": "<error_message>",
    "data": {
      "tool": "<tool_name>",
      "reason": "<human_readable_reason>"
    }
  }
}

{
  "code": -32015,
  "message": "AAT required",
  "data": {
    "tool": "write_file",
    "reason": "Agent Authentication Token required for this proxy"
  }
}

{
  "code": -32016,
  "message": "AAT invalid",
  "data": {
    "tool": "write_file",
    "reason": "AAT signature verification failed",
    "aat_error": "signature_invalid"
  }
}

{
  "code": -32017,
  "message": "AAT capability denied",
  "data": {
    "tool": "delete_database",
    "reason": "Tool not in AAT capabilities",
    "agent_id": "ag_550e8400...",
    "granted_capabilities": ["read_file", "list_directory"]
  }
}

{
  "code": -32018,
  "message": "Agent not registered",
  "data": {
    "agent_id": "ag_unknown",
    "reason": "Agent not found in AIP Registry"
  }
}

{
  "code": -32019,
  "message": "Delegation expired",
  "data": {
    "tool": "write_file",
    "reason": "User delegation has expired",
    "user_auth_time": "2026-02-18T10:00:00Z",
    "max_auth_age": 86400
  }
}

{
  "code": -32020,
  "message": "Issuer untrusted",
  "data": {
    "issuer": "https://unknown-issuer.example.com",
    "reason": "AAT issuer not in trusted_issuers configuration"
  }
}

{
  "timestamp": "2026-02-19T10:30:45.123Z",
  "direction": "upstream",
  "method": "tools/call",
  "tool": "delete_file",
  "args": {"path": "/etc/passwd"},
  "decision": "BLOCK",
  "policy_mode": "enforce",
  "violation": true,
  "failed_arg": "path",
  "failed_rule": "^/home/.*",
  "session_id": "550e8400-e29b-41d4-a716-446655440000",
  "agent_id": "ag_550e8400-e29b-41d4-a716-446655440000",
  "agent_name": "Cursor IDE Agent",
  "user_id": "[email protected]",
  "user_auth_method": "oidc",
  "delegation_scope": "tools",
  "aat_jti": "aat_660e8400-e29b-41d4-a716-446655440001",
  "aat_issuer": "https://issuer.aip.example.com",
  "policy_hash": "a3c7f2e8d9b4f1e2c8a7d6f3e9b2c4f1a8e7d3c2b5f4e9a7c3d8f2b6e1a9c4f7"
}

{
  "timestamp": "2026-02-19T10:30:00.000Z",
  "event": "AAT_VALIDATED",
  "agent_id": "ag_550e8400...",
  "user_id": "[email protected]",
  "aat_jti": "aat_660e8400...",
  "issuer": "https://issuer.aip.example.com",
  "capabilities_granted": ["read_file", "list_directory"]
}

{
  "timestamp": "2026-02-19T10:30:00.000Z",
  "event": "AAT_REJECTED",
  "agent_id": "ag_550e8400...",
  "aat_jti": "aat_660e8400...",
  "error": "aat_expired",
  "tool": "write_file"
}

{
  "timestamp": "2026-02-19T10:30:00.000Z",
  "event": "REGISTRY_REVOCATION_CHECK",
  "mode": "cached",
  "revocation_list_version": 42,
  "agents_revoked": 3,
  "aats_revoked": 1,
  "sessions_revoked": 2
}

┌─────────────────────────────────────────────────────────────────┐
│                         UNTRUSTED                               │
│  ┌──────────┐                                                   │
│  │  Agent   │  AI agent may be manipulated via prompt injection │
│  └────┬─────┘                                                   │
│       │                                                         │
├───────┼─────────────────────────────────────────────────────────┤
│       │              TRUST BOUNDARY (AIP)                       │
│       ▼                                                         │
│  ┌──────────────┐                                               │
│  │ AIP Policy   │  Policy engine is TRUSTED                     │
│  │   Engine     │  Policy file integrity assumed                │
│  └──────┬───────┘                                               │
│         │                                                       │
├─────────┼───────────────────────────────────────────────────────┤
│         │              TRUST BOUNDARY (MCP)                     │
│         ▼                                                       │
│  ┌──────────────┐                                               │
│  │  MCP Server  │  Server behavior is UNTRUSTED                 │
│  │              │  Tool definitions may be malicious            │
│  └──────────────┘                                               │
│                          UNTRUSTED                              │
└─────────────────────────────────────────────────────────────────┘

Request Flow:

  Agent Request (with AAT)
       │
       ▼
  ┌────────────────┐
  │ 1. Method      │  Block unauthorized JSON-RPC methods
  │    Check       │
  └───────┬────────┘
          │
          ▼
  ┌────────────────┐
  │ 2. AAT         │  Verify signature, issuer, expiry,
  │    Validation  │  agent identity, user binding
  │    (v1alpha3)  │  Check registry revocation list
  └───────┬────────┘
          │
          ▼
  ┌────────────────┐
  │ 3. AAT         │  Check AAT capabilities against
  │    Capability  │  requested tool
  │    Check       │
  └───────┬────────┘
          │
          ▼
  ┌────────────────┐
  │ 4. Identity    │  Validate session token, binding
  │    Check       │
  └───────┬────────┘
          │
          ▼
  ┌────────────────┐
  │ 5. Rate Limit  │  Prevent resource exhaustion
  │    Check       │
  └───────┬────────┘
          │
          ▼
  ┌────────────────┐
  │ 6. Tool        │  Allowlist enforcement
  │    Check       │
  └───────┬────────┘
          │
          ▼
  ┌────────────────┐
  │ 7. Argument    │  Regex validation, protected paths
  │    Check       │
  └───────┬────────┘
          │
          ▼
  ┌────────────────┐
  │ 8. HITL        │  Human approval for sensitive ops
  │    (if ask)    │
  └───────┬────────┘
          │
          ▼
     MCP Server
          │
          ▼
  ┌────────────────┐
  │ 9. DLP         │  Redact sensitive response data
  │    Scan        │
  └───────┬────────┘
          │
          ▼
     Agent Response

ATOMIC_CHECK_AND_RECORD_JTI(jti):
  # Same atomic semantics as nonce checking
  IF ATOMIC_SET_IF_NOT_EXISTS(jti, ttl=max_token_age):
    RETURN TRUE   # JTI was new
  ELSE:
    RETURN FALSE  # JTI already seen (replay attempt)

# Complete AgentPolicy schema (v1alpha3)

apiVersion: aip.io/v1alpha3      # REQUIRED
kind: AgentPolicy                 # REQUIRED

metadata:                         # REQUIRED
  name: string                    # REQUIRED - Policy identifier
  version: string                 # OPTIONAL - Semantic version
  owner: string                   # OPTIONAL - Contact email
  signature: string               # OPTIONAL - Policy signature

spec:                             # REQUIRED
  mode: enforce | monitor         # OPTIONAL, default: enforce

  allowed_tools:                  # OPTIONAL
    - string

  allowed_methods:                # OPTIONAL
    - string

  denied_methods:                 # OPTIONAL
    - string

  protected_paths:                # OPTIONAL
    - string

  strict_args_default: boolean    # OPTIONAL, default: false

  tool_rules:                     # OPTIONAL
    - tool: string                # REQUIRED
      action: allow|block|ask     # OPTIONAL, default: allow
      rate_limit: string          # OPTIONAL, format: "N/period"
      strict_args: boolean        # OPTIONAL
      schema_hash: string         # OPTIONAL - Tool schema integrity
      allow_args:                 # OPTIONAL
        <arg_name>: <regex>

  dlp:                            # OPTIONAL
    enabled: boolean              # OPTIONAL, default: true
    scan_requests: boolean        # OPTIONAL, default: false
    scan_responses: boolean       # OPTIONAL, default: true
    detect_encoding: boolean      # OPTIONAL, default: false
    filter_stderr: boolean        # OPTIONAL, default: false
    max_scan_size: string         # OPTIONAL, default: "1MB"
    on_request_match: string      # OPTIONAL, default: "block"
    on_redaction_failure: string  # OPTIONAL, default: "block"
    log_original_on_failure: boolean  # OPTIONAL, default: false
    patterns:                     # REQUIRED if dlp present
      - name: string              # REQUIRED
        regex: string             # REQUIRED
        scope: string             # OPTIONAL, default: "all"

  identity:                       # OPTIONAL
    enabled: boolean              # OPTIONAL, default: false
    token_ttl: string             # OPTIONAL, default: "5m"
    rotation_interval: string     # OPTIONAL, default: "4m"
    require_token: boolean        # OPTIONAL, default: false
    session_binding: string       # OPTIONAL, default: "process"
    nonce_window: string          # OPTIONAL, default: equals token_ttl
    policy_transition_grace: string  # OPTIONAL, default: "0s"
    audience: string              # OPTIONAL, default: metadata.name
    nonce_storage:                # OPTIONAL
      type: string                # memory | redis | postgres
      address: string
      key_prefix: string          # default: "aip:nonce:"
      clock_skew_tolerance: string  # default: "30s"
    keys:                         # OPTIONAL
      signing_algorithm: string   # default: "ES256"
      key_source: string          # generate | file | external
      key_path: string
      rotation_period: string     # default: "7d"
      jwks_endpoint: string       # default: "/v1/jwks"

  server:                         # OPTIONAL
    enabled: boolean              # OPTIONAL, default: false
    listen: string                # OPTIONAL, default: "127.0.0.1:9443"
    failover_mode: string         # OPTIONAL, default: "fail_closed"
    timeout: string               # OPTIONAL, default: "5s"
    tls:
      cert: string
      key: string
    fail_open_constraints:        # OPTIONAL
      allowed_tools:
        - string
      max_duration: string
      max_requests: integer
      alert_webhook: string
      require_local_policy: boolean
    endpoints:                    # OPTIONAL
      validate: string            # default: "/v1/validate"
      revoke: string              # default: "/v1/revoke"
      jwks: string                # default: "/v1/jwks"
      health: string              # default: "/health"
      metrics: string             # default: "/metrics"

  registry:                       # OPTIONAL (v1alpha3)
    enabled: boolean              # OPTIONAL, default: false
    endpoint: string              # REQUIRED if enabled
    tls:
      ca_cert: string
      client_cert: string
      client_key: string
    cache:
      enabled: boolean            # default: true
      ttl: string                 # default: "5m"
      max_entries: integer        # default: 10000
    revocation:
      check_interval: string      # default: "30s"
      mode: string                # online | cached | crl
      crl_path: string
    auth:
      type: string                # bearer | mtls | api_key
      token: string
      api_key: string

  aat:                            # OPTIONAL (v1alpha3)
    enabled: boolean              # OPTIONAL, default: false
    require: boolean              # OPTIONAL, default: false
    validation:
      verify_signature: boolean   # default: true
      verify_user_binding: boolean  # default: true
      verify_capabilities: boolean  # default: true
      max_token_age: string       # default: "1h"
      clock_skew: string          # default: "30s"
    capabilities_mode: string     # intersect | aat_only | policy_only
    trusted_issuers:              # OPTIONAL
      - string
    header_name: string           # default: "X-AIP-AAT"