# AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A

arXiv: https://arxiv.org/abs/2603.24775 · HTML: https://mlsanity.com/paper/2603.24775/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 1 of its 18 references that are in the map.
- First posted on arXiv 25 Mar 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 1 of 1)

- [Intelligent AI Delegation](https://mlsanity.com/paper/2602.11865/) (2026)

## Built on by (most cited first, 11 of 11)

- [AID-Guard: Stateful Authorization for Delegated Agent Effects](https://mlsanity.com/paper/2608.21159/) (2026)
- [MasDrift: Benchmarking Authorization Preservation Across Multi-Agent Architectures](https://mlsanity.com/paper/2608.07556/) (2026)
- [Safe Multi-Agent Behavior Must Be Maintained, Not Merely Asserted: Constraint Drift in LLM-Based Multi-Agent Systems](https://mlsanity.com/paper/2605.10481/) (2026)
- [VERA: Authority-Preserving Edge Revocation for Federated AI-Agent Workflows](https://mlsanity.com/paper/2608.30091/) (2026)
- [Attesting Outputs and Delegation Ancestry in Multi-Agent AI Systems](https://mlsanity.com/paper/2608.30387/) (2026)
- [SoulAuth: An Actor-native Identity Architecture and Rust Reference Implementation for Humans and Long-lived AI Actors](https://mlsanity.com/paper/2609.11258/) (2026)
- [Cryptographically verifiable authorization for autonomous AI agents: a falsifiable hypothesis and proof of concept](https://mlsanity.com/paper/2607.21325/) (2026)
- [InterSAGE: The Secure and Verifiable Interoperability Protocol for An Internet of Agents](https://mlsanity.com/paper/2608.13030/) (2026)
- [NostrAgent: A Decentralized Identity and Delegation Architecture for Sovereign Agentic Systems](https://mlsanity.com/paper/2609.22944/) (2026)
- [Subjects, Not Authors: The Authorship Hazard in Agentic Dataspaces](https://mlsanity.com/paper/2609.30614/) (2026)
- [Fault-Tolerant Budget Conservation in Distributed Multi-Agent Delegation](https://mlsanity.com/paper/2610.00349/) (2026)

## Abstract (arXiv)

AI agents increasingly call tools via the Model Context Protocol (MCP) and delegate to other agents via Agent-to-Agent (A2A), yet neither protocol verifies agent identity. A scan of approximately 2,000 MCP servers found all lacked authentication. In our survey, we did not identify a prior implemented protocol that jointly combines public-key verifiable delegation, holder-side attenuation, expressive chained policy, transport bindings across MCP/A2A/HTTP, and provenance-oriented completion records. We introduce Invocation-Bound Capability Tokens (IBCTs), a primitive that fuses identity, attenuated authorization, and provenance binding into a single append-only token chain. IBCTs operate in two wire formats: compact mode (a signed JWT for single-hop cases) and chained mode (a Biscuit token with Datalog policies for multi-hop delegation). We provide reference implementations in Python and Rust with full cross-language interoperability. Compact mode verification takes 0.049ms (Rust) and 0.189ms (Python), with 0.22ms overhead over no-auth in real MCP-over-HTTP deployment. In a real multi-agent deployment with Gemini 2.5 Flash, AIP adds 2.35ms of overhead (0.086% of total end-to-end latency). Adversarial evaluation across 600 attack attempts shows 100% rejection rate, with two attack categories (delegation depth violation and audit evasion through empty context) uniquely caught by AIP's chained delegation model that neither unsigned nor plain JWT deployments detect.