STANDARD / HUMAN AUTHORITY

Agent Approval Interchange Specification

AAIS makes approval a durable, portable protocol instead of a terminal prompt: the harness stays authoritative while a CLI, web UI, desktop app, or policy service presents and returns the decision.

Technology

What it is

AAIS 1.0 is an open, transport-neutral contract for one critical handoff: an agent runtime needs permission to perform an action, and a person must be able to decide from the interface they are actually using. It covers chats, bot sessions, subagents, background jobs, and graph nodes without defining any of those runtimes.

The first support release is 0.1.0. Python, TypeScript, Go, Rust, and Java libraries share one conformance corpus and implement validation, RFC 8785 action digests, request and decision creation, replay-safe pending state, and durable snapshots.

The authority boundary

The harness remains the authority. A client presents the exact requested action and returns a selected decision; it does not grant itself new capability. Before acting, the harness revalidates the decision against current policy, the action digest, expiry, and offered choices.

Safety properties

  • Exact-action binding. The decision is tied to the canonical action reviewed.
  • Bounded choices. A client selects only a scope the harness offered.
  • Fail-closed lifecycle. Expired, stale, conflicting, malformed, and replayed decisions are rejected.
  • Provenance and receipts. Requests identify their origin and retries remain idempotent.

Approvals survive reconnects

A pending approval is durable application state, not a process blocked on standard input. Ordered events and snapshots let browser and desktop clients reconnect and recover outstanding decisions, including approvals raised by long-running graph nodes.

How AAIS composes

AGS describes the work and its gates. OAP describes the agent and its authority ceiling. AAIS carries the live request and decision when a specific action reaches that boundary. MCP, AG-UI, HTTP/SSE, WebSocket, and stdio can transport or adapt the messages.

Five support libraries

The 0.1.0 packages are published on PyPI, npm, pkg.go.dev, crates.io, and Maven Central. Shared fixtures ensure messages created in one language verify in another.

What it is not

AAIS does not define chat, model reasoning, tools, profiles, graphs, authentication, or a network transport. It carries concise activity, provenance, risk, choices, decisions, and receipts—not private chain-of-thought.

Where to learn more

Primary sources first. Documentation and specifications move faster than any summary, so treat the links below as the authority and this page as orientation.