AT1C

Cryptographic approval protocol for AI agent actions

AT1C introduces verifiable human authorization, signed approval receipts, and replay-safe execution for autonomous AI systems.

request → approve → proof → verify

Overview

AI agents are rapidly gaining the ability to:

• execute tools

• deploy code

• move data

• call APIs

• trigger workflows

• automate infrastructure

• make consequential decisions

But most AI systems still cannot reliably prove:

• who approved an action

• what exactly was approved

• whether authorization was modified

• whether approval was replayed

• whether execution was legitimately authorized

AT1C exists to solve this problem.

AT1C is a lightweight authorization protocol that adds cryptographic approval and verifiable execution to AI agent workflows.

Instead of trusting that an agent “probably had permission,” AT1C provides signed proof that an action was explicitly authorized.

Core Primitive

AT1C is built around a minimal authorization flow:

request → approve → proof → verify

1. Request

An AI agent proposes an action.

Example:

• deploy code

• execute transaction

• modify infrastructure

• access sensitive data

• trigger external systems

The request is structured into a deterministic payload.

2. Approve

A human reviews and authorizes the action.

Approval may include:

• identity

• timestamp

• scope

• expiration

• constraints

• action metadata

3. Proof

AT1C generates a signed approval receipt.

The receipt acts as cryptographic proof that:

• a specific action

• was approved

• by a specific authority

• at a specific time

4. Verify

Before execution, the system verifies:

• signature validity

• payload integrity

• receipt authenticity

• replay protection

• expiration rules

Only verified actions are considered authorized.

Why AT1C Exists

Modern AI systems can already act autonomously.

The missing layer is authorization.

Current agent architectures focus heavily on:

• orchestration

• reasoning

• memory

• tool execution

But very few systems provide:

• verifiable human approval

• tamper-proof authorization

• replay-safe execution

• auditable action provenance

AT1C introduces these primitives as a dedicated protocol layer.

Design Philosophy

AT1C treats AI actions like signed transactions.

High-trust systems already require:

• authentication

• signatures

• authorization

• verification

• audit trails

AI agents should operate under the same principles.

AT1C is designed around:

• explicit authorization

• cryptographic accountability

• deterministic verification

• minimal trust assumptions

• auditability by default

Current Status — v0.1

Implemented:

• TypeScript core

• AI approval flow

• Signed approval receipts

• Signature verification

• Replay detection

• Persistent receipt storage (receipts.json)

• End-to-end approval demo

Current focus:

• protocol design

• receipt standards

• verification flow

• approval primitives

• developer tooling

Example Flow

AI Agent
   ↓
Action Request
   ↓
Human Approval
   ↓
Signed Receipt
   ↓
Verification Layer
   ↓
Authorized Execution

Example Receipt Concept

{
  "action": "deploy_production",
  "approvedBy": "admin",
  "timestamp": 1740000000,
  "nonce": "7d8a2f...",
  "signature": "ed25519:..."
}

Verification ensures:

• the receipt is authentic

• the payload was not altered

• the receipt has not been replayed

• authorization is still valid

Potential Applications

AT1C is designed for systems where AI actions require accountability.

Examples include:

• AI coding agents

• DevOps automation

• financial workflows

• infrastructure management

• enterprise copilots

• autonomous operations

• compliance-sensitive systems

• regulated environments

Vision

AI systems will increasingly act on behalf of humans.

As autonomy increases, authorization becomes critical.

AT1C explores a future where:

• every important AI action is authorized

• approvals are cryptographically verifiable

• execution can be independently audited

• trust is based on proof, not assumption

The goal is not to slow down AI systems.

The goal is to make autonomous systems verifiable.

Roadmap

Near-Term

• multi-user approvals

• threshold approvals

• expiration windows

• scoped permissions

• approval policies

• webhook integrations

• SDK support

Longer-Term

• hardware-backed signing

• decentralized verification

• policy engines

• cross-agent authorization

• machine-verifiable governance

• enterprise compliance tooling

Guiding Principle

AI systems should be able to prove they were authorized to act.

Technical Direction

AT1C is currently focused on:

• authorization primitives

• cryptographic receipts

• verification logic

• protocol structure

• replay-safe execution models

The project is intentionally minimal in early versions to keep the core primitives simple, inspectable, and composable.

Status

AT1C is an experimental protocol project under active development.

Early versions are intended for:

• research

• experimentation

• architecture exploration

• protocol iteration

License

MIT

Closing

AT1C explores a simple idea:

AI actions should carry proof of authorization.

That proof should be:

• verifiable

• replay-safe

• tamper-resistant

• independently auditable

AT1C is an attempt to make that primitive real.