]> Nankai University

Tongyan Road Tianjin 300350 China lixiang@nankai.edu.cn

Nankai University

Tongyan Road Tianjin 300350 China sunlu25@mail.nankai.edu.cn

Nankai University

Tongyan Road Tianjin 300350 China qiuyuqi@mail.nankai.edu.cn

Nankai University

Tongyan Road Tianjin 300350 China xuzuyao@mail.nankai.edu.cn

art Internet Engineering Task Force agent communication autonomous agents messaging protocol ATP Internet of Agents The Agent Transfer Protocol (ATP) is a communication protocol designed for autonomous agents to exchange messages, requests, and events in a secure, structured manner. ATP supports the emerging Internet of Agents (IoA) paradigm, where autonomous agents operate across four deployment scenarios: household (small scale), service (medium scale), enterprise (large scale), cloud provider (huge scale), and etc. ATP employs a two-tier architecture where agents connect to the global Internet through ATP servers, enabling server-mediated communication for proper routing, security enforcement, and resource management. The protocol provides DNS-based service discovery using SVCB records, mandatory authentication via Agent Transfer Sender (ATS) policies and Agent Transfer Keys (ATK), and support for multiple interaction patterns including asynchronous messaging, synchronous request/response, and event-driven streaming. This specification defines the discovery mechanism, identity model, authentication framework, transport layer, and message semantics for ATP.

Introduction The evolution of the Internet has always centered around the theme of "connection": Person-to-Person: Email and instant messaging connect people with people Person-to-Service: Web pages and mobile apps connect people with services Thing-to-Thing: IoT devices connect the physical world The next trend is emerging: agents will become part of Internet infrastructure. With the advancement of artificial intelligence technology, autonomous agents are moving from concept to large-scale application: Households deploy intelligent assistants to act on behalf of users for daily tasks Enterprises deploy customer service bots and operations agents to automate business processes Cloud providers offer agent-based capabilities including AI services and IoT coordination When agents are ubiquitous, they need to communicate with each other - this requires a communication protocol designed specifically for agents. The Agent Transfer Protocol (ATP) is proposed as a communication protocol design reference for the era of Internet of Agents.

Motivation The emergence of autonomous agents represents a fundamental shift in how digital services are delivered and consumed. We are entering the era of the Internet of Agents (IoA), where autonomous agents will become ubiquitous in both personal and commercial environments. The Agent Transfer Protocol (ATP) is a communication protocol designed for autonomous agents to exchange messages, requests, and events across the Internet. ATP enables secure, structured agent-to-agent communication through a server-mediated architecture that provides routing, security enforcement, and resource management. This document describes the motivation, architecture, and technical specifications of ATP. We first present the vision of the Internet of Agents (IoA) and the four deployment scenarios that ATP supports. We then describe the design goals, terminology, and core components of the protocol, including discovery, identity, authentication, transport, and message semantics.

The Vision of Internet of Agents In the near future, autonomous agents will be deployed across four primary deployment scenarios, each serving distinct needs and scales: Household (Small Scale): Every household will deploy personal agent systems—either as physical robots or dedicated home servers—that manage daily tasks, coordinate schedules, and interact with external services on behalf of family members. Each household member will have their own agent account, enabling personalized interactions while maintaining shared context. Service (Medium Scale): Commercial organizations will deploy agent services to automate customer interactions, process transactions, and provide intelligent assistance. These service agents handle high-volume interactions with customers worldwide. Enterprise (Large Scale): Large corporations and organizations will deploy internal agent systems to streamline business operations, from HR and IT support to development and operations automation. Cloud Provider (Huge Scale): Major technology providers will operate multi-tenant agent platforms serving millions of global users, providing AI services, data management, IoT coordination, and machine learning capabilities across continents.

Four Deployment Scenarios The agent ecosystem spans four distinct deployment scenarios, each with different scale requirements: Household Agents (Small): A household domain (e.g., family.example.com) hosts a few personal agent identities: parent1@family.example.com - Agent for first parent parent2@family.example.com - Agent for second parent home@family.example.com - Home automation coordination agent Service Agents (Medium): Service providers operate multiple specialized agents: service-bot@company.example - General customer service agent shop-bot@retailer.example - Shopping assistant agent support@tech.example - Technical support agent Enterprise Agents (Large): Organizations deploy agents for various business functions: hr@enterprise.example - Human resources assistant dev@enterprise.example - Development workflow agent ops@enterprise.example - IT operations agent Cloud Provider Agents (Huge): Global platforms serve diverse user bases: user-us@cloud.example - North American user services user-eu@cloud.example - European user services user-cn@cloud.example - Asian user services ai-service@cloud.example - AI/ML service endpoints iot@cloud.example - IoT device coordination

Why ATP is Needed Existing protocols cannot adequately meet the requirements of the Internet of Agents era: Requirement Description Limitations of Existing Protocols Multi-tenant Identity Each domain hosts multiple agent identities (from 2-5 in households to millions on cloud platforms) Email supports multi-user but lacks identity management for automated scenarios Structured Data Exchange JSON/CBOR payloads for automated processing HTTP can transport JSON but lacks native agent semantics Strong Security Guarantees Mandatory authentication and integrity verification for automated operations TLS only protects transport; application-layer authentication depends on implementation Multiple Interaction Patterns Asynchronous messaging, synchronous request/response, event-driven streaming Typically requires combining multiple protocols (e.g., HTTP + WebSocket) Scalable Discovery Cross-internet agent location and authentication Relies on centralized directory services or additional infrastructure Context Awareness Stateful multi-turn dialogues and complex workflow coordination No native support; must be implemented at application layer Variable Scale Support Efficient handling from household to cloud platform scenarios Typically optimized for specific scales, difficult to accommodate all Therefore, agents need their own communication protocol. This vision requires a communication infrastructure that supports: Multi-tenant Identity: Each domain hosts multiple agent identities, from a few agents in households to thousands in cloud platforms, requiring scalable identity management and routing. Structured Data Exchange: Agents communicate using structured payloads (JSON, CBOR) rather than unstructured text, enabling automated processing and decision-making. Strong Security Guarantees: Agent communication involves automated actions on behalf of users, demanding mandatory authentication and integrity verification to prevent unauthorized operations. Multiple Interaction Patterns: Beyond simple messaging, agents need: Synchronous request/response for RPC-style interactions Event-driven streaming for real-time updates Asynchronous messaging for notifications and broadcasts Scalable Discovery: Agents must locate and authenticate each other across the global internet using existing, proven infrastructure. Context Awareness: Agents maintain state across interactions, support multi-turn dialogues, and coordinate complex workflows involving multiple parties. Variable Scale Support: The protocol must efficiently handle scenarios ranging from small household deployments (2-5 agents) to massive cloud platforms (millions of users), with appropriate resource allocation and routing strategies for each scale. ATP addresses these requirements by providing a modern, secure, and extensible protocol built upon existing internet infrastructure while introducing agent-specific semantics. ATP is designed so that it can interoperate with application-layer agent interaction protocols. While protocols such as A2A and MCP define rich semantics for agent capabilities, task management, and tool invocation, ATP provides the underlying cross-domain transport infrastructure with DNS-native discovery and mandatory security guarantees. ATP's payload is opaque by design, enabling it to carry messages from any application-layer agent protocol.

Internet of Agents Architecture The Internet of Agents (IoA) follows a two-tier architecture where agents connect to the global internet through ATP servers. This design ensures proper resource allocation, security enforcement, and efficient routing.

In this architecture: ATP Servers act as gateways for agents, handling: Resource allocation and scheduling for local agents Outbound connection management and routing Inbound traffic filtering and security enforcement Policy enforcement (ATS/ATK validation) Message queuing and delivery guarantees Agents operate within their ATP Server's domain: All outbound communication goes through their local ATP Server All inbound communication arrives via their ATP Server Agents benefit from server-side security and filtering Multiple agents share server resources efficiently Scale Considerations: Household (Small): 2-10 agents, minimal resource requirements Service (Medium): 10-100 agents, moderate traffic handling Enterprise (Large): 100-1000+ agents, high availability requirements Cloud Provider (Huge): Millions of users, global distribution, multi-region deployment This architecture reflects the reality that in the Internet of Agents era, every household and organization will deploy an ATP server (or manager) to coordinate local agent activities, manage network connections, and provide security boundaries.

Design Goals Security-first: Authentication and integrity verification are mandatory, not optional. Structured semantics: Native support for multiple interaction patterns (message, request/response, event/subscription). DNS-based discovery: Leverage existing DNS infrastructure for agent discovery and service location. Transport agnostic: Support multiple transport protocols (HTTPS, QUIC) for flexibility and performance. Backward compatible: Coexist with existing internet infrastructure and standards. Extensible: Support capability discovery and protocol negotiation for future evolution. Multi-tenant support: Efficiently handle multiple agents per domain, similar to multi-user email systems. Server-mediated communication: All agent communication MUST flow through ATP servers for proper routing, security enforcement, and resource management. This design reflects the reality that agents operate within managed domains (households, organizations, cloud services) that require centralized coordination.

Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. This document uses the following terms: Agent: An autonomous software entity capable of communication, decision-making, and task execution. Agent ID: A unique identifier in the format local@domain that identifies a specific agent. ATP Server: A server implementing the ATP protocol and handling agent communication. The ATP Server acts as a gateway for agents within its domain, providing resource allocation, connection management, security enforcement, and message routing. All agent communication MUST flow through their respective ATP servers. ATP Client: An agent or application initiating ATP communication. ATP Transfer: The process of transferring messages between ATP servers across the Internet. ATS: Agent Transfer Sender policy - a DNS record defining authorized senders for a domain. ATK: Agent Transfer Key - a DNS record publishing cryptographic keys for message signature verification. SVCB: Service Binding - DNS record type defined in for service discovery. ALPN: Application-Layer Protocol Negotiation - TLS extension for protocol negotiation.

Protocol Stack Overview

SVCB records | +-------------------------------------------------+ ]]>

ATP is built upon a layered protocol stack that leverages existing Internet infrastructure while introducing agent-specific semantics. The stack consists of four layers, from bottom to top: Discovery Layer: Uses DNS SVCB records to enable agents to locate and discover ATP services for any given domain. The discovery query targets _atp.<domain> to retrieve service endpoint information including hostname, port, and supported protocols. Transport Layer: Supports multiple transport protocols for flexibility and performance: HTTPS: Primary transport protocol, enabling deployment behind existing CDNs, load balancers, and firewalls. Uses TLS 1.3+ for encryption and ALPN for protocol negotiation. QUIC: Optional transport protocol for low-latency scenarios, providing 0-RTT handshakes and connection migration capabilities. Message Format Layer: Defines the structure of ATP messages using structured data encodings: JSON: Recommended encoding with Content-Type application/atp+json CBOR: Optional encoding for bandwidth-constrained environments with Content-Type application/atp+cbor Messages consist of an envelope (containing from, to, timestamp, nonce, type) and a payload, with a cryptographic signature for integrity and authenticity. Application Semantics Layer: Provides three interaction patterns for different use cases: Message: Asynchronous, fire-and-forget communication Request/Response: Synchronous RPC-style interactions Event/Subscription: Streaming and publish-subscribe patterns

Discovery Mechanism

DNS SVCB Record Format ATP uses DNS SVCB (Service Binding) records for agent discovery. The SVCB record provides the hostname, port, protocol version, and optional connection hints for the ATP service. The DNS query follows the standard DNS protocol .

Record Name The standard SVCB query name for ATP discovery is:

]]>

Where <domain> is the domain portion of the recipient Agent ID.

Record Format

. IN SVCB ( port= alpn= [ipv4hint=] [ipv6hint=] [atp-capabilities=] ) ]]>

Example

Parameters port: TCP/UDP port number for the ATP service. If not specified, the default port is 7443. alpn: Application-layer protocol negotiation identifier. Supported values: atp/1 - ATP version 1 atp-json - ATP with JSON payload encoding atp-cbor - ATP with CBOR payload encoding atp+proto - ATP with Protocol Buffers encoding ipv4hint (optional): Comma-separated list of IPv4 addresses for faster connection establishment. ipv6hint (optional): Comma-separated list of IPv6 addresses for faster connection establishment. atp-capabilities (optional): Comma-separated list of supported protocol capabilities. atp-auth (optional): Comma-separated list of supported authentication mechanisms. Supported values include ats (ATS policy validation), atk (ATK signature verification), mtls (mutual TLS). This parameter enables clients to determine the server's authentication requirements before connection establishment.

Discovery Process The ATP client performs the following steps to discover the recipient's ATP service: Extract Domain: Parse the recipient Agent ID to extract the domain portion. The domain portion is derived from the local@domain Agent ID format — the same domain that hosts the agent's identity also hosts the ATP service discovery records. DNS SVCB Query: Query the SVCB record for _atp.<domain>. Address Resolution: Resolve the target hostname to IP addresses using A/AAAA records. Implementations MUST query both A and AAAA records and SHOULD prefer IPv6 addresses when available. Connection Establishment: Establish a secure connection to the resolved endpoint using the specified port.

Capability Discovery Agents can advertise their capabilities to enable protocol negotiation and feature discovery. When both DNS-based and HTTP-based capability information are available, the HTTP-based response MUST take precedence, as it can be updated more frequently than DNS records. DNS-based capabilities serve as an initial hint for connection establishment and protocol negotiation; HTTP-based capabilities provide the authoritative and current capability set.

DNS-Based Capability Advertisement Capabilities can be included in the SVCB record using the atp-capabilities parameter:

HTTP-Based Capability Query Agents can query capabilities via an HTTP endpoint:

Response:

The metadata_url field (OPTIONAL) points to an external agent description document that provides additional metadata about agents at this server. The format of the referenced document is out of scope for this specification. This field enables zero-cost cross-ecosystem discovery without binding ATP to any specific agent description standard.

Identity Model

Agent Identifier Format Agent identifiers follow the standard email address format but with extended semantics for agent communication.

The local-part identifies a specific agent within the domain, and the domain identifies the ATP server responsible for routing messages to that agent. ATP uses a restricted character set compared to RFC 5321 to ensure safe handling across diverse agent implementations. A key design feature of ATP is that each domain hosts multiple agent identities using the local@domain format, similar to how email domains host multiple user mailboxes. This multi-tenant identity model is fundamental to ATP's architecture: Households: parent1@family.example.com, parent2@family.example.com, home@family.example.com Services: support@company.example, billing@company.example, shop-bot@company.example Enterprises: hr@enterprise.example, dev@enterprise.example, ops@enterprise.example Cloud Providers: user-us@cloud.example, user-eu@cloud.example, ai-service@cloud.example Unlike centralized agent discovery systems that assign globally unique identifiers, ATP's local@domain model allows each domain administrator to independently manage their agent namespace. This mirrors the email ecosystem's proven scalability: no central registry is needed, and identity management is delegated to domain owners.

Examples a1@example.com - Individual agent chatbot@service.example - Service agent billing.taskbot@example.com - Task-specific agent with hierarchical naming weather-agent-v2@provider.example - Versioned agent identifier

Local-part Semantics The local-part uses alphanumeric characters, period (.), hyphen (-), underscore (_), and plus (+). The maximum length of the local-part is 63 characters. Domains MUST support case-insensitive matching of local-parts, similar to email systems.

Domain Requirements The domain portion MUST be a valid Internationalized Domain Name (IDN) as defined in . ATP servers MUST support both ASCII and UTF-8 encoded domain names.

Delegation Domains can delegate agent handling to external ATP servers using DNS CNAME records or SVCB alias mode.

CNAME Delegation

This allows users to maintain their identity (@user.example.com) while using third-party ATP services.

SVCB Alias Mode

SVCB alias mode provides a more modern delegation mechanism with additional metadata capabilities.

Security Framework

Transport Layer Security All ATP connections MUST use TLS 1.3 or higher.

TLS Requirements Mandatory Encryption: All ATP traffic MUST be encrypted using TLS. Cipher Suites: Servers MUST support the mandatory-to-implement cipher suites specified in Section 9.1 of . Forward Secrecy: Ephemeral key exchange MUST be used.

Mutual TLS For server-to-server communication, ATP servers SHOULD support mutual TLS (mTLS) authentication. mTLS is specified as SHOULD rather than MUST because sender authentication in ATP is provided primarily at the application layer by ATS (authorized-sender policy) and ATK (DNS-published signature verification); mTLS provides an additional, transport-level layer of authentication. ATP servers MAY require mTLS for all connections in high-security deployments.

Agent Transfer Sender Policy (ATS) The Agent Transfer Sender policy (ATS) defines which entities are authorized to send ATP messages on behalf of a domain. ATS is designed specifically for agent communication with strict enforcement.

ATS Record Format ATS policies are published as DNS TXT records at the following location:

. IN TXT "v=atp1 " ]]>

Example ATS Records Simple IP-based policy:

Multi-source policy:

Permissive policy:

Restrictive policy:

Policy Directives ATS policy directives are evaluated in order, with later directives overriding earlier ones when conflicts occur. v=atp1: Version identifier (REQUIRED). Indicates ATP version 1 policy format. allow=ip:<cidr>: Authorize messages from specific IP address ranges. allow=domain:<domain>: Authorize messages from agents at the specified domain. allow=all: Authorize messages from any source (NOT RECOMMENDED). deny=ip:<cidr>: Explicitly deny messages from specific IP ranges. deny=domain:<domain>: Explicitly deny messages from agents at the specified domain. deny=all: Deny all sources (must be followed by specific allow directives). include:<record>: Include policy from another ATS record. redirect=<domain>: Redirect policy evaluation to another domain. exp=<domain>: Specify a domain for explanation text (human-readable).

ATS Query Process When an ATP server receives a message claiming to be from a sender in domain <domain>, it performs the following ATS verification: Query ATS Record: Query the DNS TXT record for ats._atp.<domain>. Extract IP: Determine the source IP address of the incoming connection. Policy Evaluation: Evaluate the ATS policy against the source IP and sender domain. Authorization Decision: If policy evaluation results in PASS, accept the message. If policy evaluation results in FAIL, reject the message with HTTP 403 and error body {"error": "ATS_VALIDATION_FAILED"}. If no ATS record exists, treat as NEUTRAL (accept but flag for monitoring).

ATS Processing Algorithm The ATS verification algorithm processes policy directives as follows:

' AND source_ip matches : result = PASS ELSE IF directive is 'deny=ip:' AND source_ip matches : result = FAIL ELSE IF directive is 'allow=domain:' AND sender_domain matches : result = PASS ELSE IF directive is 'deny=domain:' AND sender_domain matches : result = FAIL ELSE IF directive is 'allow=all': result = PASS ELSE IF directive is 'deny=all': result = FAIL ELSE IF directive is 'include:': include_result = query_ats() IF include_result is PASS or FAIL: result = include_result RETURN result ]]>

ATS Error Codes ATS validation errors are returned as HTTP responses with structured JSON error bodies: 403 Forbidden with body: {"error": "ATS_VALIDATION_FAILED", "detail": "Sender not authorized by ATS policy"} 502 Bad Gateway with body: {"error": "ATS_TEMPORARY_FAILURE", "detail": "DNS lookup timeout for ATS record"} 403 Forbidden with body: {"error": "ATS_RECORD_INVALID", "detail": "ATS record syntax error"}

Cloud Deployment Considerations In cloud environments where agents share IP addresses (e.g., CDN, serverless platforms, container orchestration), IP-based ATS policies may be insufficient. Deployments in such environments SHOULD: Use allow=domain:<domain> directives instead of IP-based directives where possible. Combine ATS with mutual TLS for stronger sender verification. Rely on ATK signature verification as the primary authentication mechanism, with ATS as an additional signal. Note: ATS is designed as a first-pass filter, not a sole authentication mechanism. ATK signature verification provides cryptographic proof of sender identity regardless of network topology.

ATS Best Practices Start Restrictive: Begin with a restrictive policy and gradually add authorized sources. Use Includes: Use include: directives to inherit policies from trusted providers. Monitor Logs: Regularly review ATS validation logs to identify unauthorized attempts. Gradual Deployment: Deploy ATS gradually, starting with monitoring mode before enforcement.

Agent Transfer Key (ATK) The Agent Transfer Key (ATK) record publishes cryptographic public keys used for message signature verification. ATK is mandatory in ATP and uses modern cryptographic algorithms.

ATK Record Format ATK records are published as DNS TXT records at the following location:

.atk._atp.. IN TXT "v=atp1 " ]]>

Where <selector> is an identifier for the specific key (e.g., default, 2026q1, rotated-key).

Example ATK Records Ed25519 key (RECOMMENDED):

RSA key (3072-bit):

ECDSA key (P-256):

Key Parameters v=atp1: Version identifier (REQUIRED). Indicates ATP version 1 key format. k=<algorithm>: Key algorithm (REQUIRED). Supported values: ed25519 - Ed25519 (RECOMMENDED for new deployments) rsa - RSA (3072-bit minimum for new keys, 2048-bit minimum accepted for verification) ecdsa - ECDSA (P-256, P-384, or P-521) p=<base64-key>: Base64-encoded public key (REQUIRED). n=<curve-name>: Elliptic curve name (REQUIRED for ECDSA). Supported values: prime256v1, secp384r1, secp521r1. h=<hash-alg>: Hash algorithm (OPTIONAL). Defaults to sha256. Supported values: sha256, sha384, sha512. s=<service>: Service type (OPTIONAL). Indicates which ATP services use this key. t=<flags>: Flags (OPTIONAL). Comma-separated list of flags: r - Key is revoked (MUST NOT be used for new signatures) x=<expiry>: Key expiry (OPTIONAL). Unix time, in seconds, after which the key MUST NOT be used.

ATK Query Process When an ATP server receives a signed message, it performs the following ATK verification: Extract Signature Information: Parse the message signature to extract key selector, domain, signature algorithm, and signature value. Query ATK Record: Query the DNS TXT record for <selector>.atk._atp.<domain>. Validate Key Parameters: Verify that the key algorithm and parameters match the signature. Canonicalization: Canonicalize the message payload according to the specified algorithm. Signature Verification: Verify the signature using the public key from the ATK record. Validation Decision: If signature verification succeeds, accept the message. If signature verification fails, reject the message with HTTP 403 and error body {"error": "ATK_SIGNATURE_INVALID", "detail": "Signature verification failed"}. If ATK record is not found, reject the message with HTTP 403 and error body {"error": "ATK_KEY_NOT_FOUND", "detail": "No ATK record found for selector"}.

ATK Key Management

Key Rotation Domains SHOULD rotate ATK keys periodically (e.g., every 90 days).

Key Revocation If a key is compromised, it SHOULD be revoked immediately by updating the ATK record to include the r flag.

ATK Best Practices Use Ed25519: Prefer Ed25519 keys for new deployments due to their security and performance characteristics. Key Size: For RSA keys, generate new keys with at least 3072 bits (4096-bit RECOMMENDED). Implementations MUST accept RSA keys of 2048 bits or longer for signature verification. For ECDSA, use P-256 or stronger curves. Multiple Keys: Maintain multiple keys (current, next, previous) for smooth rotation. DNSSEC: Sign ATK records with DNSSEC to prevent DNS spoofing attacks. Monitoring: Monitor signature validation failures to detect potential attacks or misconfigurations.

Message Signature All ATP messages MUST be cryptographically signed to ensure integrity and authenticity.

Signature Envelope The signature is included in the message envelope as a signature field:

The timestamp field within the signature object records when the signature was generated, expressed as Unix time in seconds.

Signature Algorithm The signature algorithm depends on the key type: Ed25519: Sign the canonicalized message bytes directly. RSA: Use RSASSA-PSS with SHA-256 (or stronger). ECDSA: Use ECDSA with the specified curve and hash algorithm.

Signature Coverage The signature MUST cover all fields of the message envelope except the signature field itself. The headers field within the signature object is informational and lists the fields that were present at signing time; it MUST NOT be used to selectively exclude fields from signature verification. Verifiers MUST reject messages where the set of fields in the message envelope does not match the headers list in the signature object.

Canonicalization Messages MUST be canonicalized before signing to ensure consistent signature verification. JSON Canonicalization Process: ATP uses JSON Canonicalization Scheme (JCS) for JSON payloads: Remove the signature field from the message object. Apply JCS canonicalization to the remaining JSON object. Convert the canonicalized JSON to UTF-8 bytes. Sign the UTF-8 bytes using the specified algorithm. CBOR Canonicalization Process: For CBOR payloads, ATP uses deterministic CBOR encoding as defined in RFC 8949 Section 4.2 (Core Deterministic Encoding Requirements): Remove the signature field from the CBOR map. Re-encode the remaining map using deterministic CBOR encoding: Map keys MUST be sorted in bytewise lexicographic order of their deterministic encodings. Indefinite-length items MUST NOT be used. Preferred serialization rules from Section 4.1 of MUST be applied. Sign the resulting byte string using the specified algorithm.

Signature Verification The recipient verifies the signature as follows: Extract the signature field from the message. Verify that the headers list in the signature object matches the set of fields present in the message envelope (excluding signature). Reject the message if they do not match. Reconstruct the message object without the signature field. Apply the appropriate canonicalization process (JCS for JSON, deterministic encoding for CBOR). Verify the signature using the public key from the ATK record.

Signature Error Handling If signature verification fails, the recipient MUST reject the message and MAY log the failure for monitoring.

Transport Protocol

HTTPS Transport The primary transport for ATP is HTTPS, enabling easy deployment behind existing infrastructure such as CDNs, load balancers, and firewalls.

Default Port The default port for ATP over HTTPS is 7443. IANA registration for this port is requested in the IANA Considerations section of this document. Deployments MUST support custom port configuration via SVCB records. ATP servers MAY listen on alternative ports (including 443) as specified in the SVCB record's port parameter. The use of a dedicated port provides operational advantages in enterprise environments: security teams can identify and audit ATP traffic by port number without requiring deep packet inspection, and it avoids path conflicts with existing HTTPS services on port 443.

Endpoints ATP servers MUST implement the following standard endpoints:

Send Message Endpoint

Request Body: ATP message envelope Response: 202 Accepted: Message accepted for delivery 400 Bad Request: Invalid message format 401 Unauthorized: Authentication failed 429 Too Many Requests: Rate limit exceeded 500 Internal Server Error: Server error

Capability Discovery Endpoint

Response: JSON object describing server capabilities

Health Check Endpoint

Response:

Connection Management Keep-Alive: Clients SHOULD use HTTP keep-alive for multiple requests. Timeout: Servers SHOULD implement idle timeout (RECOMMENDED: 60 seconds). Rate Limiting: Servers MAY implement rate limiting with appropriate HTTP headers.

IPv6 Considerations ATP deployments SHOULD support IPv6 connectivity. ATP servers MUST publish both A and AAAA records when IPv6 is available. Clients SHOULD implement Happy Eyeballs for dual-stack connection establishment. In the SVCB record, the ipv6hint parameter provides IPv6 address hints for faster connection establishment without an additional AAAA query:

For new ATP deployments, IPv6-only operation is a valid configuration. IPv4 support is NOT REQUIRED when the deployment environment is IPv6-capable.

QUIC Transport (Future Work) ATP is designed to support QUIC transport for low-latency scenarios. The ALPN identifier for ATP over QUIC is atp/1. The full specification of QUIC transport for ATP, including message-to-stream mapping, QUIC error code registry, and 0-RTT security considerations, is deferred to a companion document. This section provides an overview of the intended design.

Expected Benefits 0-RTT Handshake: Establish connections with zero round-trip time for resumed connections. Multiplexing: Multiple ATP messages over a single connection without head-of-line blocking. Connection Migration: Maintain connections across network changes. Better Performance: Reduced latency over lossy networks.

Security Note QUIC 0-RTT data is subject to replay attacks. ATP messages sent over 0-RTT MUST be idempotent, or servers MUST implement application-level replay protection in addition to the timestamp/nonce mechanism defined in this specification.

Message Format

Common Fields All ATP messages share a common envelope structure with the following fields:

Field Definitions from: The Agent ID of the message sender (REQUIRED). MUST be a valid agent identifier. to: The Agent ID of the primary recipient (REQUIRED). MUST be a valid agent identifier. cc: Array of Agent IDs for carbon-copy recipients (OPTIONAL). timestamp: Unix timestamp (seconds since epoch) when the message was created (REQUIRED). Recipients MUST reject messages with timestamps more than 300 seconds (5 minutes) in the past or more than 60 seconds in the future relative to the recipient's clock. Implementations SHOULD use NTP-synchronized clocks. nonce: Cryptographically random unique identifier for the message (REQUIRED). MUST be unique per sender within the timestamp validity window. Recipients MUST maintain a cache of recently seen (sender, nonce) pairs for at least the duration of the timestamp validity window (300 seconds) and MUST reject duplicate (sender, nonce) pairs. type: Message type indicator (REQUIRED). Values: message, request, response, event. in_reply_to: The nonce of the original message that this message is responding to (OPTIONAL). REQUIRED for response type messages. Used for request-response correlation. task_id: Identifies the task or workflow this message belongs to (OPTIONAL). All messages related to the same task SHOULD use the same task_id. context_id: Identifies the conversation or session context (OPTIONAL). Used for multi-turn interactions. payload: Message-specific content (REQUIRED). Structure depends on message type. signature: Cryptographic signature envelope (REQUIRED). routing: Routing information for multi-hop scenarios (OPTIONAL).

Message Types ATP supports three primary message types, each with distinct semantics and use cases.

Message (Asynchronous) The message type is used for asynchronous, fire-and-forget communication.

Request/Response The request/response pattern supports synchronous RPC-style interactions.

Request Format

Response Format

Event/Subscription The event type supports streaming and event-driven communication.

Subscription Request

=high" }, "delivery_mode": "push", "subscription_id": "sub-12345" }, "signature": {} } ]]>

Event Message

Payload Encoding ATP supports multiple payload encoding formats. ATP defines a single abstract data model for the message envelope and payload. All data structures in this document are presented in JSON, which is the reference encoding; the CBOR encoding represents the same abstract data model, and a CBOR message is structurally equivalent to its JSON counterpart. The two encodings are interconvertible without loss of information.

JSON Encoding JSON is the RECOMMENDED encoding format. Content-Type: application/atp+json

CBOR Encoding CBOR is an OPTIONAL encoding format for bandwidth-constrained environments. CBOR messages carry the same abstract data model as the JSON examples in this document and are canonicalized for signing using the deterministic CBOR encoding described in . Content-Type: application/atp+cbor

Message Size Limits ATP servers SHOULD enforce message size limits: Default Maximum: 1 MB (1,048,576 bytes) Minimum Supported: 64 KB (65,536 bytes)

Protocol Semantics

Message (Asynchronous) Asynchronous messages follow a store-and-forward model.

Delivery Model

| | | | | | | | |---[Transfer]--->| | | | | | | | |----[Deliver]------>| | | | | ]]>

In this model: The Sender Agent submits a message to its local ATP Server A ATP Server A performs policy enforcement (ATS/ATK validation) and transfers the message to ATP Server B ATP Server B performs security checks and delivers the message to the Recipient Agent Each hop (Submit/Transfer/Deliver) involves independent ATS/ATK validation for security enforcement.

Delivery Guarantees ATP asynchronous messages provide store-and-forward delivery with the following semantics: Default: Best-effort delivery. Servers attempt delivery but do not guarantee success. With acknowledgment: When delivery acknowledgment is requested (via payload.ack_required: true), servers provide at-least-once delivery semantics.

Retry Policy Servers SHOULD retry failed deliveries using exponential backoff: Initial retry interval: 1 second Maximum retry interval: 1 hour Maximum retry duration: 48 hours Maximum retry count: 10 After exhausting retries, servers MUST generate a bounce notification if the sender requested acknowledgment.

Request/Response (Synchronous) Synchronous request/response follows an RPC pattern.

Interaction Model All agent communication MUST go through their respective ATP servers. This design ensures proper routing, security filtering, and policy enforcement.

| | | | | | | | |---[Transfer]--->| | | | | | | | |---[Request]---->| | | | | | | |<--[Response]----| | | | | | |<--[Transfer]----| | |<--[Response]---| | | | | | | ]]>

In this model: The Client Agent submits a request to its local ATP Server A via HTTP POST ATP Server A performs policy enforcement (ATS/ATK validation) and transfers the request to ATP Server B ATP Server B performs security checks and delivers the request to the Service Agent The Service Agent processes the request and returns a response The response flows back through the same path (Service Agent → ATP Server B → ATP Server A → Client Agent) Each hop (Submit/Transfer/Deliver) involves independent ATS/ATK validation for security enforcement.

Deadline Propagation For multi-hop request/response interactions, the timeout field (in seconds) MUST be converted to an absolute deadline for relay forwarding. Because the deadline is obtained by adding timeout to the sender's timestamp, both values use the same unit (seconds). The absolute deadline is computed as:

When a relay forwards a request: Calculate the remaining time: remaining = deadline - now If remaining <= 0, return a TIMEOUT error immediately with HTTP 504 and error body {"error": "DEADLINE_EXCEEDED", "detail": "Request deadline expired in transit"}. Set the forwarded request's timeout to the remaining time.

State Management Stateless: Each request is independent. Correlation ID: Clients MAY include a correlation_id to track workflows. Idempotency: Requests SHOULD be idempotent.

Event/Subscription (Streaming) Event/subscription follows a publish-subscribe pattern.

Pub/Sub Model All event publications and subscriptions MUST go through ATP servers for proper routing and access control.

| | | | | | | | |--[Transfer]-->| | | | | | | | |-----[Event]---->| | | | | | | |<--[Subscribe]---| | | | | | |<--[Transfer]--| | |<-[Subscribe]--| | | | | | | ]]>

The event/subscription flow consists of two phases: Subscription Phase: The Subscriber initiates a subscription request to its local ATP Server, which transfers the request to the Publisher's ATP Server, which then delivers it to the Publisher. This establishes the subscription relationship across the server chain. Event Notification Phase: When an event occurs, the Publisher sends the event to its local ATP Server (Server B), which transfers it across the Internet to the Subscriber's ATP Server (Server A), which then delivers the notification to the Subscriber. This bidirectional flow ensures: Proper access control at each ATP server boundary ATS/ATK policy enforcement for both subscription and event messages Subscription state management at the Publisher's server

Subscription Lifecycle TTL: Subscriptions SHOULD include a ttl field (in seconds) in the subscribe request payload. If not specified, the default TTL is 3600 seconds (1 hour). Renewal: Subscribers MUST renew subscriptions before TTL expiry by sending a new subscribe request with the same subscription_id. Heartbeat: Publishing servers SHOULD send periodic heartbeat events (type: event, event_type: heartbeat) to subscribing servers. Note that heartbeat is a server-to-server mechanism, not agent-to-agent; it verifies the liveness of the subscription channel between ATP servers. Subscribing servers that do not receive a heartbeat within 2x the expected interval SHOULD re-subscribe. Auto-expiry: Subscriptions that are not renewed within their TTL period are automatically expired. Publishers MUST stop sending events to expired subscriptions.

Server-to-Server Event Delivery For push-mode event delivery, the publishing server sends events to the subscribing server's ATP message endpoint. The subscribing server's endpoint is discovered through the standard DNS SVCB discovery process using the subscriber's domain. Future versions of this specification MAY define additional transport mechanisms for real-time event delivery, including: Server-Sent Events (SSE) for unidirectional streaming WebSocket for bidirectional streaming These mechanisms are out of scope for the current version.

Security Considerations ATP is designed with security as a first-class requirement. This section analyzes the threat model and security considerations for each component of the protocol.

Threat Model The threat model for ATP considers the following adversaries and attack vectors: Network Adversaries: Passive or active attackers on the network path between agents and ATP servers, or between ATP servers. Capabilities may include: Eavesdropping on unencrypted traffic Man-in-the-middle (MitM) attacks to intercept or modify communications Replay attacks using captured messages Traffic analysis to infer communication patterns Malicious Agents: Compromised or malicious agents that attempt to: Send unauthorized messages on behalf of other agents (spoofing) Flood servers with excessive requests (DoS) Exploit protocol vulnerabilities to gain unauthorized access Rogue ATP Servers: Compromised or malicious ATP servers that may: Fail to enforce ATS/ATK policies Leak sensitive message content Drop or delay messages selectively DNS Attackers: Adversaries that attempt to compromise DNS infrastructure: DNS cache poisoning to redirect ATP traffic DNS spoofing to provide fraudulent SVCB records DNS amplification attacks

Authentication

TLS Security Threat: Network adversaries attempting eavesdropping or MitM attacks. Mitigation: All ATP connections MUST use TLS 1.3 or higher Certificate validation against trusted Certification Authorities is mandatory Cipher suites MUST provide forward secrecy Cipher suites SHOULD use authenticated encryption (AES-GCM, ChaCha20-Poly1305) Residual Risk: Certificate authority compromise or mis-issuance. Deployments with high security requirements SHOULD implement certificate pinning or use DANE .

ATS (Agent Transfer Sender Policy) Threat: Malicious agents attempting to send messages on behalf of domains they do not control (spoofing). Mitigation: ATS records define authorized sending sources per domain Policy directives include IP ranges, domains, and explicit deny rules Each ATP server performs ATS validation on every incoming message Failed ATS validation results in immediate rejection Residual Risk: ATS record tampering via DNS attacks. Deployments SHOULD sign ATS records with DNSSEC .

ATK (Agent Transfer Key) Threat: Message tampering or forgery by network adversaries or malicious agents. Mitigation: ATK records publish cryptographic public keys for signature verification All ATP messages MUST be cryptographically signed Supported algorithms: Ed25519 (RECOMMENDED), RSA (3072+ bit for new keys), ECDSA (P-256+) Signature covers all critical message fields (from, to, timestamp, nonce, type, payload) Residual Risk: Key compromise. Domains MUST implement key rotation and maintain revocation procedures via the r flag in ATK records.

Message Signature Threat: Message modification in transit, replay attacks. Mitigation: Cryptographic signatures cover canonicalized message content Nonce prevents replay attacks Timestamp enables expiration checking Signature includes headers list to prevent header manipulation Residual Risk: Long-term key compromise enables retroactive forgery. Future work may introduce forward-secure signature schemes.

Privacy

Metadata Exposure Threat: Traffic analysis revealing communication patterns, relationships, or sensitive business information. Exposure: from and to fields are visible to ATP servers and network observers timestamp reveals timing of communications type indicates interaction pattern (message, request, response, event) Mitigation: Payload content SHOULD be encrypted end-to-end when confidentiality is required Agents MAY use pseudonymous identifiers for sensitive communications ATP servers SHOULD minimize metadata logging Residual Risk: Metadata analysis remains possible. Applications with strong privacy requirements SHOULD implement additional obfuscation at the application layer.

Payload Confidentiality Threat: Unauthorized access to message content by ATP servers or network adversaries. Mitigation: TLS encryption protects payload in transit between hops Agents MAY encrypt payload content end-to-end using recipient's public key CBOR encoding supports embedded encrypted content Residual Risk: ATP servers must inspect messages for policy enforcement. Deployments handling sensitive data SHOULD implement server-side encryption with customer-managed keys.

Denial of Service

Resource Exhaustion Attacks Threat: Adversaries flooding ATP servers with excessive messages or connections. Attack Vectors: Message flooding to exhaust server storage or bandwidth Connection exhaustion to deplete server connection pools Computational DoS via expensive cryptographic operations Mitigation: Rate limiting based on sender reputation and domain Message size limits (default 1 MB maximum) Connection limits per sender IP and domain Exponential backoff for retry attempts Quota enforcement per agent and per domain

Amplification Attacks Threat: Attackers using ATP to amplify traffic toward victims. Mitigation: ATS validation prevents unauthorized relaying Response messages only sent to request initiators Subscription confirmation required before event delivery No broadcast or multicast mechanisms

DNS Security

DNS Spoofing and Cache Poisoning Threat: Attackers providing fraudulent DNS responses to redirect ATP traffic. Mitigation: ATP servers SHOULD validate DNS responses using DNSSEC SVCB records SHOULD be cached with appropriate TTL Multiple independent DNS resolvers SHOULD be consulted Residual Risk: DNSSEC adoption is not universal. Applications requiring high assurance SHOULD implement additional verification.

DNS Query Privacy Threat: DNS queries revealing which domains agents communicate with. Mitigation: DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) for query confidentiality DNS query caching to reduce query frequency Batch queries when discovering multiple domains

ATP Server Security

Server Compromise Threat: Compromised ATP server leaking or modifying messages. Mitigation: End-to-end message signatures detect modification Payload encryption protects content from server inspection Audit logging for security monitoring Regular security updates and hardening

Multi-tenant Isolation Threat: One tenant's agents accessing or interfering with another tenant's agents. Mitigation: Strict domain-based access control Per-tenant quota enforcement Isolated processing contexts ATS/ATK validation per message

Security Best Practices Deployments SHOULD implement the following security practices: DNSSEC: Sign all DNS zones containing ATS and ATK records Key Rotation: Rotate ATK keys every 90 days minimum Monitoring: Log and alert on ATS/ATK validation failures Certificate Management: Monitor certificate expiration and implement automated renewal Incident Response: Maintain procedures for key revocation and emergency policy updates Defense in Depth: Implement multiple layers of security controls

Known Limitations Metadata Visibility: ATP does not hide communication metadata from ATP servers DNS Trust: DNS security depends on DNSSEC adoption Server Trust: ATP servers can observe unencrypted payload content Key Management: Compromised keys enable message forgery until revocation Future revisions of ATP may address these limitations through techniques such as onion routing, encrypted DNS, or decentralized trust models.

IANA Considerations

Application-Layer Protocol Negotiation (ALPN) Protocol Identifier IANA is requested to register the following ALPN protocol identifier: Protocol: atp/1 Identification Sequence: 0x61 0x74 0x70 0x2f 0x31 (atp/1) Specification: This document

Well-Known URI IANA is requested to register the following well-known URI: URI Suffix: atp Change Controller: IETF Specification: This document

Media Types IANA is requested to register the following media types: application/atp+json: JSON-encoded ATP messages as defined in Section 6 application/atp+cbor: CBOR-encoded ATP messages as defined in Section 6

Service Name and Transport Protocol Port Number Registry IANA is requested to register the following service: Service Name: atp Port Number: 7443 Transport Protocol: TCP, UDP Description: Agent Transfer Protocol Reference: This document

SVCB SvcParamKey Registrations IANA is requested to register the following entries in the "Service Binding (SVCB) SvcParamKey" registry defined in : SvcParamKey Meaning Format Reference Change Controller atp-capabilities Comma-separated list of ATP protocol capabilities Section 2.3 of this document IETF atp-auth Comma-separated list of supported authentication mechanisms Section 2.1 of this document IETF

ATP Capabilities Values The initial registered values for the atp-capabilities parameter are: Value Description Reference message Asynchronous messaging Section 7.1 request Synchronous request/response Section 7.2 event Event/subscription streaming Section 7.3 Additional values may be registered via Specification Required policy.

ATP Auth Values The initial registered values for the atp-auth parameter are: Value Description Reference ats ATS policy validation Section 4.2 atk ATK signature verification Section 4.3 mtls Mutual TLS authentication Section 4.1

ATP Message Type Registry IANA is requested to create the "ATP Message Types" registry with the following initial values: Type Description Reference message Asynchronous message Section 6.2.1 request Synchronous request Section 6.2.2 response Synchronous response Section 6.2.2 event Event notification Section 6.2.3 New message types are registered via Specification Required policy.

This document is one of a collection that, together, describe the protocol and usage context for a revision of Internationalized Domain Names for Applications (IDNA), superseding the earlier version. It describes the document collection and provides definitions and other material that are common to the set. [STANDARDS-TRACK] JavaScript Object Notation (JSON) is a lightweight, text-based, language-independent data interchange format. It was derived from the ECMAScript Programming Language Standard. JSON defines a small set of formatting rules for the portable representation of structured data. This document removes inconsistencies with other specifications of JSON, repairs specification errors, and offers experience-based interoperability guidance. This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery. This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, 5246, and 6961. This document also specifies new requirements for TLS 1.2 implementations. Cryptographic operations like hashing and signing need the data to be expressed in an invariant format so that the operations are reliably repeatable. One way to address this is to create a canonical representation of the data. Canonicalization also permits data to be exchanged in its original form on the "wire" while cryptographic operations performed on the canonicalized counterpart of the data in the producer and consumer endpoints generate consistent results. This document describes the JSON Canonicalization Scheme (JCS). This specification defines how to create a canonical representation of JSON data by building on the strict serialization methods for JSON primitives defined by ECMAScript, constraining JSON data to the Internet JSON (I-JSON) subset, and by using deterministic property sorting. The Concise Binary Object Representation (CBOR) is a data format whose design goals include the possibility of extremely small code size, fairly small message size, and extensibility without the need for version negotiation. These design goals make it different from earlier binary serializations such as ASN.1 and MessagePack. This document obsoletes RFC 7049, providing editorial improvements, new details, and errata fixes while keeping full compatibility with the interchange format of RFC 7049. It does not create a new version of the format. This document defines the core of the QUIC transport protocol. QUIC provides applications with flow-controlled streams for structured communication, low-latency connection establishment, and network path migration. QUIC includes security measures that ensure confidentiality, integrity, and availability in a range of deployment circumstances. Accompanying documents describe the integration of TLS for key negotiation, loss detection, and an exemplary congestion control algorithm. The Hypertext Transfer Protocol (HTTP) is a stateless application-level protocol for distributed, collaborative, hypertext information systems. This document describes the overall architecture of HTTP, establishes common terminology, and defines aspects of the protocol that are shared by all versions. In this definition are core protocol elements, extensibility mechanisms, and the "http" and "https" Uniform Resource Identifier (URI) schemes. This document updates RFC 3864 and obsoletes RFCs 2818, 7231, 7232, 7233, 7235, 7538, 7615, 7694, and portions of 7230. This document specifies the "SVCB" ("Service Binding") and "HTTPS" DNS resource record (RR) types to facilitate the lookup of information needed to make connections to network services, such as for HTTP origins. SVCB records allow a service to be provided from multiple alternative endpoints, each with associated parameters (such as transport protocol configuration), and are extensible to support future uses (such as keys for encrypting the TLS ClientHello). They also enable aliasing of apex domains, which is not possible with CNAME. The HTTPS RR is a variation of SVCB for use with HTTP (see RFC 9110, "HTTP Semantics"). By providing more information to the client before it attempts to establish a connection, these records offer potential benefits to both performance and privacy. In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. This RFC is the revised basic definition of The Domain Name System. It obsoletes RFC-882. This memo describes the domain style names and their used for host address look up and electronic mail forwarding. It discusses the clients and servers in the domain name system and the protocol used between them. This RFC is the revised specification of the protocol and format used in the implementation of the Domain Name System. It obsoletes RFC-883. This memo documents the details of the domain name client - server communication. The Domain Name System Security Extensions (DNSSEC) add data origin authentication and data integrity to the Domain Name System. This document introduces these extensions and describes their capabilities and limitations. This document also discusses the services that the DNS security extensions do and do not provide. Last, this document describes the interrelationships between the documents that collectively describe DNSSEC. [STANDARDS-TRACK] Encrypted communication on the Internet often uses Transport Layer Security (TLS), which depends on third parties to certify the keys used. This document improves on that situation by enabling the administrators of domain names to specify the keys used in that domain's TLS servers. This requires matching improvements in TLS client software, but no change in TLS server software. [STANDARDS-TRACK] Many protocols make use of points of extensibility that use constants to identify various protocol parameters. To ensure that the values in these fields do not have conflicting uses and to promote interoperability, their allocations are often coordinated by a central record keeper. For IETF protocols, that role is filled by the Internet Assigned Numbers Authority (IANA). To make assignments in a given registry prudently, guidance describing the conditions under which new values should be assigned, as well as when and how modifications to existing values can be made, is needed. This document defines a framework for the documentation of these guidelines by specification authors, in order to assure that the provided guidance for the IANA Considerations is clear and addresses the various issues that are likely in the operation of a registry. This is the third edition of this document; it obsoletes RFC 5226. Many communication protocols operating over the modern Internet use hostnames. These often resolve to multiple IP addresses, each of which may have different performance and connectivity characteristics. Since specific addresses or address families (IPv4 or IPv6) may be blocked, broken, or sub-optimal on a network, clients that attempt multiple connections in parallel have a chance of establishing a connection more quickly. This document specifies requirements for algorithms that reduce this user-visible delay and provides an example algorithm, referred to as "Happy Eyeballs". This document obsoletes the original algorithm description in RFC 6555.

Example Message Flows

Sending an ATP Message

| | | | | |<----- SVCB Response -----| | | _atp.example.com | | | agent.example.com:7443| | | | | |---- A/AAAA Query ------->| | | | | |<------- IP Address ------| | | 192.0.2.1 | | | | | |==========================|======================| | | |<-------------------TLS Handshake--------------->| | | |--- POST /.well-known/atp/v1/message ----------->| | Content-Type: application/atp+json | | { | | "from": "a1@sender.example", | | "to": "a2@example.com", | | "type": "message", | | "payload": {...}, | | "signature": {...} | | } | | | |<---------------------- 202 Accepted ------------| | | ]]>

Request/Response Flow The request/response flow demonstrates synchronous RPC-style interaction between agents. The Client Agent connects to its local ATP Server (Server A), which enforces policy and transfers the request to the destination ATP Server (Server B), which delivers it to the Service Agent. The response follows the reverse path.

| | | | | | | | |<- IP Address --------- | | | | 198.51.100.1 | | | | | | | | | |======================|====================|=============|=============| | | | | |<-------------TLS Handshake--------------->| | | | | | | |-- POST /.well-known/atp/v1/message ------>| | | | Content-Type: application/atp+json | | | | { | | | | "from": "client@example.com", | | | | "to": "service@service.example", | | | | "timestamp": 1710000000, | | | | "nonce": "req-67890-fghij", | | | | "type": "request", | | | | "payload": { | | | | "action": "get_weather", | | | | "params": {"location": "New York"} | | | | }, | | | | "signature": {...} | | | | } | | | | | | | | |-[Transfer]->| | | | | | | | |-[Request]-->| | | | | | | |<-[Response]-| | |<-[Transfer]-| | | | | | |<- 202 Accept/Response --------------------| | | | { | | | | "from": "service@service.example", | | | | "to": "client@example.com", | | | | "timestamp": 1710000002, | | | | "nonce": "resp-67890-klmno", | | | | "type": "response", | | | | "in_reply_to": "req-67890-fghij", | | | | "payload": { | | | | "status": "success", | | | | "data": {"temperature": 22} | | | | }, | | | | "signature": {...} | | | | } | | | | | | | ]]>

Event Subscription Flow The event subscription flow demonstrates the publish-subscribe pattern with streaming notifications. The flow has two phases: Phase 1 - Subscribe: The Subscriber sends a subscription request to its local ATP Server (Server A), which transfers it to the Publisher's ATP Server (Server B), which delivers it to the Publisher. Phase 2 - Event Notification: When an event occurs, the Publisher sends the event to Server B, which transfers it to Server A, which delivers the notification to the Subscriber.

| | | | | | | | |<- IP Address --------- | | | | 203.0.113.1 | | | | | | | | | |======================|====================|=============|=============| |<-------------TLS Handshake--------------->| | | |============================ Subscribe Phase ==========================| | | | | |-- POST /.well-known/atp/v1/message ------>| | | | Content-Type: application/atp+json | | | | { | | | | "from": "subscriber@example.com", | | | | "to": "publisher@publisher.example", | | | | "timestamp": 1710000000, | | | | "nonce": "sub-11111-pqrst", | | | | "type": "request", | | | | "payload": { | | | | "action": "subscribe", | | | | "event_types": ["price_update"], | | | | "subscription_id": "sub-12345" | | | | }, | | | | "signature": {...} | | | | } | | | | |-[Transfer]->| | | | |-[Subscribe]>| |<-- 202 Accepted --------------------------| | | | | | | |======================== Event Notification Phase =====================| | | | | | | |<---[Event]--| | |<-[Transfer]-| | |<--[Event Delivery]------------------------| | | | { | | | | "from": "publisher@publisher.example",| | | | "to": "subscriber@example.com", | | | | "timestamp": 1710000010, | | | | "nonce": "evt-22222-uvwxy", | | | | "type": "event", | | | | "payload": { | | | | "event_type": "price_update", | | | | "subscription_id": "sub-12345", | | | | "data": {"symbol": "AAPL", | | | | "price": 150} | | | | }, | | | | "signature": {...} | | | | } | | | ]]>

Acknowledgments This protocol draws inspiration from multiple existing protocols and standards: DNS SVCB - for service discovery HTTP/2 - for multiplexing QUIC - for low-latency transport TLS - for secure transport