SINT Protocol: Runtime Authorization and Evidence Logging for LLM-Driven Physical AI Systems

Large language model (LLM) agents increasingly issue commands to tools, robots, drones, smart-home devices, and industrial systems. Existing agent protocols (MCP, A2A, ACP, ANP) standardize communication, but no widely adopted runtime authorization model currently covers the full LLM-to-actuator path with graduated human oversight, physical-constraint enforcement, and tamper-evident evidence trails. We present SINT Protocol, a capability-based runtime authorization framework for LLM-driven physical AI. SINT interposes a single Policy Gateway between agent intent and actuator execution. Every request is normalized to a canonical schema, validated against Ed25519-signed capability tokens, classified into one of four approval tiers (T0_OBSERVE, T1_PREPARE, T2_ACT, T3_COMMIT), evaluated against physical constraints (velocity, force, geofence, body-region force limits per ISO/TS 15066), and recorded in a SHA-256 hash-chained evidence ledger. The reference implementation provides bridge adapters for MCP, ROS 2, MAVLink, A2A, gRPC, MQTT, OPC-UA, Open-RMF, Sparkplug, Matter, Home Assistant, FHIR R5, swarm coordination, and economic operations; SDKs in TypeScript, Python, Go, and Rust; and conformance fixtures mapped to the OWASP Top 10 for Agentic Applications. On an Apple M3 Pro with in-memory persistence, the gateway adds a 5.1 ms steady-state p99 latency over 600 single-process iterations, fitting within the 10 ms budget of a 100 Hz ROS 2 control loop. We discuss how SINT supports implementation evidence for IEC 62443 FR1–FR7, EU AI Act Articles 9/11/12/13/14(4)(e)/15 stop-control and logging obligations, and NIST AI RMF functions, and we identify open limitations: no real-robot validation yet, heuristic drift thresholds, no mechanized formal verification, and operator-burden risks under high escalation rates. SINT does not replace model alignment, hardware emergency-stop controllers, or domain-rated safety standards (ISO 13849, IEC 61508). It provides a deterministic authorization and evidence layer between agent cognition and physical execution.