What question did this study set out to answer?

To establish a formal governance structure that ensures secure actions of autonomous AI agents through admission control.

March 26, 2026Open Access

Agent Control Protocol (ACP) v1.17 — Admission Control for Agent Actions

Key Points

To establish a formal governance structure that ensures secure actions of autonomous AI agents through admission control.
Developed a specification and a reference implementation in Go covering various capabilities.
Introduced a risk engine with a deterministic evaluation of admission requests.
Implemented external verifiability for third-party reproduction of decision behaviors.
Created a suite of sequence test vectors to validate multi-step behaviors.
Applied TLA+ formal modeling for verifying system safety and consistency.
Demonstrated compliant behavior for five stateful sequence test vectors under strict mode.
Achieved under 1.4 microsecond evaluation times on standard hardware.
Maintained zero violations in formal verification across multiple agents and capabilities.

Abstract

Agent Control Protocol (ACP) v1. 17 Agent Control Protocol (ACP) v1. 17 is a formal governance specification for autonomous AI agents operating in institutional environments. ACP defines the admission control layer between agent intent and system state mutation: before any agent action reaches execution, it must pass a cryptographic admission check that validates identity, capability scope, delegation chain, and policy compliance simultaneously. The v1. 17 specification comprises 38 technical documents organized across five conformance levels (L1–L5), a Go reference implementation of 23 packages covering all L1–L4 capabilities, 73 signed conformance test vectors (Ed25519 + SHA-256) plus 65 unsigned RISK-2. 0 vectors, and an OpenAPI 3. 1. 0 specification with 18 HTTP endpoints. v1. 16 introduced ACP-RISK-2. 0, a deterministic integer-arithmetic risk engine extending ACP-RISK-1. 0 with a three-rule anomaly factor (Fₐnom: burst detection, repeated-denial pattern, high-frequency pattern matching) and automatic cooldown enforcement (three DENIED decisions within ten minutes triggers a five-minute block). The engine evaluates requests in under 1. 4 microseconds on commodity hardware (Intel i7-8665U, Go 1. 22) with zero floating-point operations and no external ML inference, yielding provably predictable latency bounds under load. v1. 16 also introduced ACP-SIGN-2. 0, a post-quantum migration specification for hybrid digital signatures combining Ed25519 (current standard) with ML-DSA-65 (NIST FIPS 204, lattice-based), defining a three-phase migration ladder and dual-signature envelope format. v1. 17 introduces external verifiability — the property that ACP's decision behavior can be reproduced and validated by third parties without access to internal implementation details: ACR-1. 0 Sequence Compliance Runner (compliance/runner/): a dual-mode Go runner (library mode + HTTP mode) that validates ACP-RISK-2. 0 implementations against stateful, multi-step test sequences. It implements the full ACP-RISK-2. 0 execution contract: stateless evaluation first, then deterministic state updates (AddRequest → AddPattern → AddDenial → SetCooldown). Five stateful sequence test vectors (compliance/test-vectors/sequence/): SEQ-BENIGN-001, SEQ-BOUNDARY-001, SEQ-PRIVJUMP-001, SEQ-FANOM-RULE3-001, SEQ-COOLDOWN-001. All five pass with CONFORMANT status under strict mode. These vectors test behaviors that require state accumulation across requests and cannot be validated with single-shot runners. TLC-runnable TLA+ formal model (tla/ACP. tla + tla/ACP. cfg): three mechanically checked invariants — Safety (no APPROVED decision above threshold), LedgerAppendOnly (append-only temporal property with entry preservation), and RiskDeterminism (identical capability+resource pairs always produce identical risk scores). Verified with TLC at 2 agents × 4 capabilities × 3 resources, 0 violations. ACP-SIGN-2. 0 HYBRID mode Go implementation (impl/go/pkg/sign2/): SignHybrid () with real Ed25519 signatures and ML-DSA-65 stub (full post-quantum implementation deferred to v1. 18 via cloudflare/circl). The verifiability pipeline forms a three-layer chain: formal model (TLA+) → test data (sequence vectors) → runtime validation (ACR-1. 0 runner). All cryptographic operations use Ed25519 + JCS canonicalization (RFC 8785). The specification is language-agnostic; the reference implementation is provided in Go. Specification and implementation: https: //github. com/chelof100/acp-framework-en Preprint: arXiv: 2603. 18829

Read Full Paperexternally

Demander à l'IA

Bookmark

View Full Paper