AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A

Sunil Prakash

cs.CRMar 25, 2026

AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A

Authors: Sunil Prakash

Organizations: Indian School of Business, India

Abstract

AI agents increasingly call tools via the Model Context Protocol (MCP) and delegate to other agents via Agent-to-Agent (A2A), yet neither protocol verifies agent identity. A scan of approximately 2,000 MCP servers found all lacked authentication. In our survey, we did not identify a prior implemented protocol that jointly combines public-key verifiable delegation, holder-side attenuation, expressive chained policy, transport bindings across MCP/A2A/HTTP, and provenance-oriented completion records. We introduce Invocation-Bound Capability Tokens (IBCTs), a primitive that fuses identity, attenuated authorization, and provenance binding into a single append-only token chain. IBCTs operate in two wire formats: compact mode (a signed JWT for single-hop cases) and chained mode (a Biscuit token with Datalog policies for multi-hop delegation). We provide reference implementations in Python and Rust with full cross-language interoperability. Compact mode verification takes 0.049ms (Rust) and 0.189ms (Python), with 0.22ms overhead over no-auth in real MCP-over-HTTP deployment. In a real multi-agent deployment with Gemini 2.5 Flash, AIP adds 2.35ms of overhead (0.086% of total end-to-end latency). Adversarial evaluation across 600 attack attempts shows 100% rejection rate, with two attack categories (delegation depth violation and audit evasion through empty context) uniquely caught by AIP's chained delegation model that neither unsigned nor plain JWT deployments detect.

Figures & tables

Approach	Public-Key	Holder	Expressive	Cross-	Provenance	No Blockchain/	Lifecycle
	Verif.	Attenuation	Policy	Protocol	Binding	Heavy Infra	Awareness
W3C DIDs	✓	$\times$	$\times$	$\times$	$\times$	$\times$	$\times$
OAuth 2.0/2.1	$\sim$	$\times$	$\times$	$\times$	$\times$	✓	$\times$
Macaroons	$\times$	✓	$\times$	$\times$	$\times$	✓	$\times$
UCAN	✓	✓	$\times$	$\times$	$\times$	$\times$	$\times$
Biscuit	✓	✓	✓	$\times$	$\times$	✓	$\times$

Table 1: Seven-dimension comparison of identity and authorization approaches for AI agents. ✓ = fully supported,

\sim

= partially supported,

\times

= not supported.

JWT Claim	Biscuit Fact
iss	identity($iss)
sub	delegate($sub)
scope[i]	right($scope_item)
budget_usd	budget($budget_usd)
max_depth	max_depth($max_depth)
exp	expires($exp)

Table 2: Compact-to-chained claim mapping. Each JWT claim maps to a Biscuit authority fact during token upgrade.

Component	Rust (crate / LOC)	Python (package / LOC)	Tests
Identity	aip-core / 462	aip_core / 309	6 + 19
Tokens	aip-token / 601	aip_token / 442	7 + 27
Middleware	aip-mcp / 151	aip_mcp / 76	7 + 12
Total	1,214 LOC	827 LOC	20 + 58

Table 3: Implementation summary. LOC counts include library source only (excluding benchmarks and binaries for Rust).

Token size: 356 bytes (identical across languages)
Operation	Rust mean	Rust p99	Python mean	Python p99
Create	0.018	0.022	0.086	0.110
Verify	0.049	0.059	0.189	0.231

Table 4: Compact mode benchmarks (1,000 iterations). Mean and p99 latencies in milliseconds.

Depth	Size (Py)	Size (Rust)	Python verify	Rust verify
0	444	520	0.110	0.188
1	832	940	0.178	0.292
2	1,172	1,316	0.248	0.403
3	1,512	1,696	0.315	0.516
4	1,856	2,072	0.379	0.625
5	2,196	2,448	0.447	0.745

Table 5: Chained mode scaling (100 iterations per depth). Token size in bytes; verify latency in milliseconds.

Condition	Mean	p50	p99	Overhead vs. No Auth
No authentication	0.301	0.294	0.404	–
AIP compact	0.523	0.507	0.819	+0.222 ms
AIP chained	0.481	0.476	0.819	+0.180 ms

Table 6: Real MCP tool call latency over HTTP (100 iterations). All values in milliseconds.

Component	Mean	Min	Max
AIP create	0.385	0.146	0.934
AIP delegate	0.510	0.248	0.820
AIP verify	1.455	0.650	2.340
AIP total	2.351
LLM orchestrator	1,019.886	832.813	1,293.494
LLM specialist	1,727.052	1,557.999	1,897.933

Table 7: Multi-agent delegation with Gemini 2.5 Flash (10 iterations). All values in milliseconds.

Attack	Description	AIP	Unsigned	JWT	AIP Unique Defense
Scope widening	Agent invokes tool:email when only tool:search was delegated	100%	0%	100%	Chained Datalog checks enforce scope at every delegation hop
Depth violation	Second delegation attempted when max_depth=1	100%	0%	0%	max_depth in authority block prevents unbounded delegation
Expired token replay	Token with exp=now-60s presented for verification	100%	0%	100%	Both compact (JWT exp ) and chained (Datalog time check) enforce expiry
Wrong key verification	Token signed by key A, verified against unrelated key B	100%	0%	100%	Ed25519 signature binding at every layer
Empty context (audit evasion)	Delegation with empty context string to evade audit trail	100%	0%	0%	Mandatory non-empty context on every delegation enforces audit provenance
Token forgery	Base64 token tampered (character flip), then verified	100%	0%	100%	Biscuit signature covers every block; any tampering is detected

Table 8: Adversarial security evaluation (100 iterations per attack, 600 total). Rejection rate shown as fraction of attempts blocked.

Adversary	Prevented	Detected	Not Addressed
Scope widening	Datalog check-all-blocks	–	Misuse within scope
DNS hijack	–	Self-signature mismatch	Key compromise
Replay	Expiry check	–	Real-time replay in TTL
Dishonest verifier	–	Conformance tests	Skipped checks
Fraudulent completion	–	Attribution binding	Fabricated results
Colluding agents	–	Audit trail	In-scope collusion

Table 9: Threat model summary. Each row maps an adversary to what AIP prevents, detects, or does not address.

Explore similar work

HDP: A Lightweight Cryptographic Protocol for Human Delegation Provenance in Agentic AI Systems
Apr 6, 2026Asiri DalugodaAI Accountability Multi-Agent System Security
Helixar Limited, Auckland, New Zealand
aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents
Jul 6, 2026Sai Varun KodathalaAI Agent Security LLM Agent Security
Research & Development SportsVision AI Minnetonka, MN
SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems
Apr 3, 2026KrishnaSaiReddy PatilAI Agent Governance Multi-Agent System Security

Apr 6, 2026J/K move · Enter open · S save

HDP: A Lightweight Cryptographic Protocol for Human Delegation Provenance in Agentic AI Systems

Asiri Dalugoda

Helixar Limited, Auckland, New Zealand

AI Accountability Multi-Agent System Security Data Provenance

Open paper AskPDF arXiv

Agentic AI systems increasingly execute consequential actions on behalf of human principals, delegating tasks through multi-step chains of autonomous agents. No existing standard addresses a fundamental accountability gap: verifying that terminal actions in a delegation chain were genuinely authorized by a human principal, through what chain of delegation, and under what scope. This paper presents the Human Delegation Provenance (HDP) protocol, a lightweight token-based scheme that cryptographically captures and verifies human authorization context in multi-agent systems. An HDP token binds a human authorization event to a session, records each agent's delegation action as a signed hop in an append-only chain, and enables any participant to verify the full provenance record using only the issuer's Ed25519 public key and the current session identifier. Verification is fully offline, requiring no registry lookups or third-party trust anchors. We situate HDP within the existing landscape of delegation protocols, identify its distinct design point relative to OAuth 2.0 Token Exchange (RFC 8693), JSON Web Tokens (RFC 7519), UCAN, and the Intent Provenance Protocol (draft-haberkamp-ipp-00), and demonstrate that existing standards fail to address the multi-hop, append-only, human-provenance requirements of agentic systems. HDP has been published as an IETF Internet-Draft (draft-helixar-hdp-agentic-delegation-00) and a reference TypeScript SDK is publicly available.

Abstract

Explore similar work

HDP: A Lightweight Cryptographic Protocol for Human Delegation Provenance in Agentic AI Systems

aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents

SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems