An open protocol · v0.1 draft for community review

The driver's license for AI agents

Agents already act on our behalf. APH gives every action a verifiable credential proving a specific human authorized it — checkable by any recipient, across vendors and organizations, with nothing but public standards and public keys.

The APH emblem — a human figure and an AI chip joined in an infinity loop inside a chained seal, surrounded by people and their agents working together.
2independent implementations, cross-verifying
4language bindings — JS, Python, Elixir, Go
670+automated tests across five toolchains
12published vectors, every mandatory signing path
1live notary you can resolve today
A2A is the road network. AP2 is the toll booth.
APH is the driver's license.

How it works

Three parties, one credential, zero shared platform. The human's key never leaves their device — which is why a notary can be run by anyone, and why its word alone is never mistaken for the human's.

1

The human authorizes

A person signs a Delegation Mandate with their own key: which agent, which channels, what scope, for how long. Revocable at any time — and revocation reaches strangers in minutes through a published status list.

2

A notary witnesses

When the agent acts, a Notary Service checks the action against the mandate, records the decision, and countersigns a W3C Verifiable Credential binding the exact message bytes, channel, and recipient to that authority.

3

Anyone verifies

The recipient resolves the notary's public key from DNS or did:web — infrastructure they already trust — and checks every signature offline. No account with the sender's platform. No prior relationship. No trust in the agent's runtime.

Why it's different

The human layer proves consent. A notary alone can only assert; the human's signature is the authorization — and APH keeps the two claims impossible to confuse.
Portable like a license. Issued under one organization's notary, verifiable by any other — the interstate-license property, from public standards alone.
Revocation with teeth. Pull the mandate and verifiers everywhere refuse within minutes — enforced by a freshness bound, not a best effort.
Tamper-evident to the byte. The credential commits to the message body's hash: change one byte in transit and verification fails with a named error.
No custodians, ever. Keys stay on the operator's own machines; the protocol works without any third-party service to depend on — a written design constraint, not a preference.
Open and auditable. Apache-2.0, a public spec, published test vectors, an operator runbook, and a governance process with a public request-for-change entry point.

Get started in your language

One reference implementation in Rust, one fully independent implementation in TypeScript — they mint and verify each other's envelopes — and bindings that hand the reference to four ecosystems.

Rust — the reference

cargo add aph-core        # types, validation, signing
cargo add aph-resolver    # DNS + did:web key discovery

Go — pure Go, no cgo

go get github.com/squillo/aph/interpreters/go

TypeScript — the independent implementation

git clone https://github.com/squillo/aph
cd aph/interpreters/typescript
npm install && npm run build && npm test

Python & Elixir — bindings

# Python (pyo3)
cargo test -p aph-py
# Elixir (rustler NIF)
cd interpreters/elixir && mix test

Validate your first envelope in one command: cargo run -p aph-cli -- validate examples/principal_signed_envelope.json — a published credential carrying four real signatures your own code can re-verify.

Built on standards you already run

Nothing novel where novel is dangerous: no new cryptography, no new trust anchors — the same primitives that already secure email authentication and the credential web, composed.

W3C Verifiable Credentials 2.0 W3C Data Integrity (eddsa-jcs-2022 · ecdsa-jcs-2019) RFC 8785 canonical JSON RFC 7515 detached JWS Ed25519 & P-256 W3C Bitstring Status List DID — did:key · did:web DKIM-style DNS publication