# Agent Identity Protocol (AIP): Verifiable Delegation for AI Agent Systems AIP

[3 · Permit](/category/permit/)
Candidate · auto-drafted, unreviewed · confidence 80%

| Agent Identity Protocol (AIP): Verifiable Delegation for AI Agent Systems |
| --- |
| Category | [Permit](/category/permit/) |
| Governed by | Individual Internet-Draft by a single independent author; Intended Status: Standards Track |
| Status | Internet-Draft, Intended Status: Standards Track; expires 13 April 2027 |
| Phase | draft |
| Implementation | unknown |
| Adoption | unmeasured |
| Version | draft-prakash-aip-02 (2026-10-10) |
| Specification | [https://datatracker.ietf.org/doc/html/draft-prakash-aip-02](https://datatracker.ietf.org/doc/html/draft-prakash-aip-02) |
| Found at | /.well-known/aip/<path>.json |
| Acronym collisions | aip |
| Last checked | 2026-10-18 |
| Freshness | current · checked 2026-10-18 |
| Solves | Delegate a user's authority to an agent, Prove an agent's identity |

Agent Identity Protocol (AIP): Verifiable Delegation for AI Agent Systems is an agentic-web standard (document format) at step 3, Permit, governed by Individual Internet-Draft by a single independent author; its own status is "Internet-Draft, Intended Status: Standards Track; expires 13 April 2027" (draft). It answers: How can a relying party verify from a token and the issuer's public key who delegated authority, which agents it passed through, and that no hop widened it, when no authorization server is on the path? Adoption is unmeasured, last verified 2026-10-18.

[Permit](/category/permit/) AIP conveys delegated authority along a chain of AI agents so a relying party can verify the grantor, the path, and that each hop only narrowed authority. It defines an encoding-neutral chain model with a single attenuation invariant, a normative verification algorithm, and two encodings (a JWT chain and a Biscuit token with Datalog policy). It defines bindings for MCP, A2A and generic HTTP, and is intended to compose with the AIMS framework. Agent identifiers are aip:web (DNS-based) or aip:key (self-certifying Ed25519).

## Discovery and probe

Self-signed agent identity document at a well-known HTTPS path derived from the aip:web identifier · /.well-known/aip/<path>.json

```
GET /.well-known/aip/.json
parse:     Parse JSON; check aip equals "1.0", id is an AIP identifier, and document_signature verifies over the JCS-canonicalized document
on absent: Treat the site or agent as not supporting AIP
```

Not probed live: no-fixed-path. candidate record; probe rule pending

## History
- 2026-10-16 — auto-drafted candidate from exa (https://datatracker.ietf.org/doc/html/draft-prakash-aip-02)

## Instances

No instances recorded yet.

## See also

- Not to be confused with: aip

## References

- The draft specifies AIP, a delegation chain model with an attenuation invariant, a verification algorithm, JWT-chain and Biscuit encodings, and bindings for MCP, A2A and HTTP. — [https://datatracker.ietf.org/doc/html/draft-prakash-aip-02](https://datatracker.ietf.org/doc/html/draft-prakash-aip-02) (2026-10-10) REPORTED

[JSON](/data/protocols/aip-delegation-chain.json) · [Markdown](/protocols/aip-delegation-chain/index.md)