Agent Approval Interchange Specification

What it is

AAIS 1.0 is an open, transport-neutral contract for one critical handoff: an agent runtime needs permission to perform an action, and a person must be able to decide from the interface they are actually using. It covers chats, bot sessions, subagents, background jobs, and graph nodes without defining any of those runtimes.

The first support release was 0.1.0. Python, TypeScript, Go, Rust, and Java libraries share one conformance corpus and implement validation, RFC 8785 action digests, request and decision creation, replay-safe pending state, and durable snapshots. The Python library is now at 0.2.0; the other four remain at 0.1.0, because the language libraries are versioned independently.

The authority boundary

The harness remains the authority. A web or desktop client presents the exact requested action and returns a selected decision; it does not grant itself new capability. Before acting, the harness revalidates the decision against the current request, action digest, expiry, offered choices, and current policy.

That separation lets several applications sit on top of one runtime without moving enforcement into each interface. A terminal, browser, native client, or policy service can all speak the same contract while the runtime keeps one source of truth.

Safety properties

• Exact-action binding. The decision carries a digest of the canonical action the user reviewed.
• Bounded choices. A client may select only a scope the harness offered: once, session, or a constrained persistent rule.
• Fail-closed lifecycle. Expired, stale, conflicting, malformed, or replayed decisions are rejected.
• Clear provenance and risk. Requests identify their harness, session, run, action, and concise reasons for the risk level.
• Receipts and idempotency. Retried delivery cannot silently execute the approved action twice.

Approvals survive reconnects

A pending approval is durable application state, not a process blocked on standard input. Ordered events and restorable snapshots let a client close, reconnect, and recover outstanding decisions. This is what allows a web UI to handle an approval raised by a long-running graph after the user has navigated elsewhere.

How AAIS composes

AGS describes the work and where a graph may require a human gate. OAP describes the agent and the ceiling on its authority. AAIS carries the live request and decision when a specific action reaches that boundary. MCP, AG-UI, HTTP/SSE, WebSocket, and stdio can transport or adapt the messages; none replaces the authority contract.

Five support libraries

The packages are published on PyPI, npm, pkg.go.dev, crates.io, and Maven Central: Python at 0.2.0, TypeScript, Go, Rust, and Java at 0.1.0. The libraries deliberately share behavior and fixtures so an approval emitted in one language can be verified in another instead of merely having a similar-looking JSON shape.

A shared store for Python harnesses

Python library 0.2.0 adds aais.store.FileApprovalStore, a durable approval authority that several processes can share through one JSON file: a web server, a CLI, a background worker, and a stdio bridge can all wait on and resolve the same requests. The specification, schema, and conformance corpus did not change.

The store holds a lock for the whole transaction, writes atomically, quarantines a corrupt file instead of reading it as empty, bounds how much resolved history it keeps, and reports an explicit gap when a client asks for events that have been compacted away. Pending requests record their owner as process id, process start time, and host, so a reused process id cannot make a stopped owner look alive. Storage is split from the approval rules, and a conformance kit lets other backends prove the same behavior.

Loro 0.22 and MagAgent 1.4 now keep their approvals in this store instead of in their own file handling, and Merced AI 0.8 uses the library's owner-identity checks for its approval presenter. Loro's experimental Postgres approval authority is built on the same backend protocols and passes the backend conformance kit.

What it is not

AAIS does not define chat, model reasoning, tools, profiles, workflow graphs, authentication, or a network transport. It also does not expose private chain-of-thought. It carries concise activity, provenance, risk, choices, decisions, and receipts: the information a person and a runtime need to authorize safely.