Open governance for autonomous AI agents
The Agent Governance Protocol (AGP) is an open specification by BIAN for governing autonomous AI agents — fail-closed execution, delegatable capabilities, and immutable audit trails. Model- and framework-agnostic, and EU AI Act ready.
The Mandate Paradox
In banking, an agent that always says YES is a high-speed liability.
We don't need faster Yes-Bots. We need agents with Purple Lines — deterministic guardrails that can say NO to a dangerous human mandate. Not because the AI refuses, but because the protocol structurally prevents execution without verifiable authority.
Executes every instruction it receives
Fast. Compliant. Optimised for throughput. A high-speed liability the moment the instruction is wrong, the authority is forged, or the mandate is dangerous. No trail. No checkpoint. No way to say no.
Operates inside deterministic guardrails
Still fast. Still autonomous. But structurally incapable of crossing the governance boundary without verifiable authority, policy clearance, and a complete evidence chain — regardless of who gives the instruction.
The Bank Vault for AI intent
Dual-control, applied to every agent action
A high-security vault opens only when independent keys turn together — no single party can override it. AGP applies the same discipline: before any consequential action executes, three independent checks must all clear. If one fails, the vault stays closed.
Intent is declared
The agent registers a Task — who is acting, what they intend, and the assessed risk tier — creating accountability before a single API call is made.
Authority is proven
A signed, scoped Capability Token, issued by an authorised controller and revocable at any time. No valid token means no execution — whatever the instruction source.
Policy is evaluated
The action is checked against your rule set: auto-approve, require human sign-off, escalate, or deny. Every outcome is logged immutably — approval and denial alike.
No agent, operator, or platform can bypass it — by design, not by convention.
Governance, not routing
AGP sits underneath your agents and tools, turning every consequential action into a governed, auditable event.
Fail-closed execution
Every action passes through a gate that blocks unless capability, policy, and approval all clear. No default-permit, no bypass path.
Delegatable capabilities
Scoped, revocable capability tokens. Revoke one and every pending action under it stops instantly — even mid-workflow.
Immutable audit trails
A hash-chained ledger records intent, decision, policy verdict, approval, and execution. Replay any task end to end.
EU AI Act ready
Risk classification, decision rationale, human oversight, and an append-only ledger map directly to Articles 9, 12, 13, 14.
Built for the whole organisation
AGP is a governance question before it is a code question. The why and the what are for the board and the architecture review; the how is for the team that ships it.
The Liability Shield
Convert agent accountability from assertion to cryptographic proof. Every action — approval and denial alike — is a signed, timestamped, tamper-evident record. Demonstrate governance to regulators and auditors, not just assert it. EU AI Act-aligned by design.
Read the liability caseThe Governance Ledger
A fail-closed trust model across three independent domains — Registry, Decision, Execution — with no default-permit path. A hash-chained ledger is the authoritative record of every decision. Protocol-neutral, with a first-class MCP binding and bring-your-own OPA policy.
See the trust modelGovernance in ~10 lines
Install the SDK, declare intent, prove authority, execute — the fail-closed gate handles the rest. OAuth is automatic; MCP tool calls are wrapped in the governance pipeline with zero refactoring. 201 with a signed receipt, or 403 with a structured error.
Start buildingGovern any action in one session
The full lifecycle — register, bind, authorize, decide, evaluate, execute — with a fail-closed gate at the end.
from agp import AGPClientagp = AGPClient("https://your-agp-server", client_id="finance-agent", client_secret="•••")# Declare intent, prove authority, evaluate policy, then execute —# the fail-closed gate rejects anything that doesn't clear.with agp.task_session( principal_id="finance-agent", requested_outcome="Approve $4,200 invoice to Acme Corp", risk_tier="medium",) as session: session.bind(sponsoring_entity="finance-team", accountable_owner="cfo@acme.com", jurisdiction="EU") session.issue_capability(permitted_actions=["approve_payment"]) session.decide(selected_action="approve_payment", rationale="Vendor verified, within delegated limit", uncertainty_score=0.08) session.evaluate(verdict="allow") receipt = session.execute( tool_id="approve_payment", operation={"vendor": "Acme Corp", "amount_usd": 4200}, )print(receipt.ledger_entry) # immutable, hash-chainedStart here
The fastest paths into the documentation.
Introduction
What AGP is and the problem it solves.
Install
Add the SDK and connect a server.
How it works
The governance layer between intent and action.
Architecture
Registry, Decision, and Execution domains.
MCP integration
Govern any MCP server’s tool calls.
API reference
Registry, Decision, and Execution APIs.