Every AI agent message
should carry its own trust.
Actions. Routing. State. Identity. Assets. — ARSIA is an open, transport-agnostic envelope protocol that embeds compliance, cryptographic identity, audit, and human oversight into every agent-to-agent message. Not bolted on. Built in.
One envelope. Everything an agent needs to be trusted.
Every message between AI agents is wrapped in a structured envelope that carries cryptographic identity, compliance rules, capability declarations, and audit metadata. The envelope is the protocol. No sidecar, no middleware, no configuration files.
Cryptographic Identity
Every agent has an Ed25519 keypair. Every message is signed. You always know who sent what, and you can always prove it.
Compliance Profile
GDPR, MiFID II, EU AI Act, DORA — the envelope declares which rules apply. Retention, jurisdiction, oversight, PII handling — all explicit.
Audit Trail
Immutable, timestamped records of every interaction. Who did what, when, under which rules. Not an afterthought — a first-class field.
Capabilities & Oversight
Agents declare what they can do. The protocol enforces what they're allowed to do. Human oversight gates are configurable per compliance profile.
Data Residency
Declare jurisdiction at the message level. When data_residency: "EU" is set, messages are routed through compliance brokers whose infrastructure physically resides within the declared zone.
Two-Layer Validation
L1 validates structure against JSON Schema 2020-12. L2 validates semantics: cross-field consistency, compliance rule integrity, temporal logic. Errors are caught before they reach production.
{
"v": "1.0",
"type": "request",
"id": "msg_7f3a...",
"ts": "2026-05-14T10:30:00Z",
// Identity — who is talking
"from": "agent:acme.risk-assessor",
"to": "agent:acme.compliance-checker",
// Compliance — which rules apply
"compliance": {
"profile": "MIFID-II",
"retention_days": 1827,
"data_residency": "EU",
"human_oversight": "required_before_execution",
"audit_required": true,
"pii_involved": true
},
// Security — cryptographic proof
"security": {
"alg": "EdDSA",
"kid": "agent:acme.risk-assessor#k1",
"sig": "base64url..."
},
// Payload — the actual message
"payload": {
"type": "com.acme.risk-assessment",
"args": { "portfolio_id": "PF-2847" }
}
}
Six message types. Every interaction covered.
The protocol defines six intent types that cover the full lifecycle of agent interaction — from requests and responses to human oversight gates and error recovery.
Everything you need. Nothing you don't.
The protocol is deliberately opinionated about what belongs in the envelope and deliberately minimal about everything else. Each capability is specified, schema-validated, and tested.
Cryptographic Identity
Ed25519 by default, ES256 and RS256 also supported. Every agent has a verifiable identity. Every message is signed. Key rotation and multi-key support built in.
Compliance Profiles
Seven built-in profiles covering GDPR, EU AI Act, MiFID II, DORA, DSA, and PAC Agriculture. Each profile inherits retention, jurisdiction, oversight, and audit rules automatically.
Immutable Audit Trail
Every interaction produces a timestamped, tamper-evident audit record. Who did what, when, under which compliance regime. Ready for regulatory inspection.
Human Oversight
Configurable gates: required before execution, post-execution review, or within a time window. The protocol enforces them — not your application code.
Two-Layer Validation
L1 validates structure against JSON Schema 2020-12. L2 validates semantics: cross-field consistency, compliance rule integrity, temporal logic. Catch errors before production.
ECDH-ES Encryption
End-to-end envelope encryption with Elliptic Curve Diffie-Hellman Ephemeral Static. Content is opaque to intermediaries. Only the intended recipient can decrypt.
Data Residency
Declare jurisdiction constraints at the message level. EU, US, BR, or any ISO country code. The envelope travels everywhere; the data stays where it must.
Capability System
Agents declare capabilities they offer and request capabilities they need. The protocol matches them. An agent can only invoke what it's been granted — structurally enforced.
Transport Agnostic
HTTP, WebSocket, message queues, file exchange — ARSIA doesn't care how the envelope gets there. It works above any transport, alongside any agent framework.
Above MCP and A2A. Complements, doesn't compete.
MCP (Anthropic) handles tool access. A2A (Google) handles agent communication. ARSIA handles the trust layer for both. It sits above transport protocols and below your application — the compliance middleware that was missing from the stack.
5+1 Architecture
One Core foundation plus five domain primitives — Actions, Routing, State, Identity, Assets — spelling ARSIA.
Zero coupling
Works with any agent framework. No vendor lock-in, no required runtime, no mandatory infrastructure.
3 Conformance Levels
Level 1 (Core): envelope + signing. Level 2: + compliance profiles. Level 3: all five primitives + encryption.
EU-first. Built for everywhere.
Seven normative profiles ship with the protocol, covering Europe's major regulatory frameworks. But the architecture is jurisdiction-agnostic — a compliance profile is a JSON object. If you can define the rules, the protocol can enforce them.
| Profile | Regulation | Retention | Human Oversight | Audit |
|---|---|---|---|---|
| GDPR-STANDARD | GDPR Art. 5, 6 | Per operator | Not required | Optional |
| EU-AI-ACT-HIGH-RISK | AI Act Art. 13, 14, 17, 26 | 180 days | Required before execution | Required |
| EU-AI-ACT-LIMITED-RISK | AI Act Art. 50 | 90 days | Not required | Optional |
| MIFID-II | MiFID II Art. 16(7), DORA, PSD2 | 5 years | Required before execution | Required |
| PAC-AGRICULTURE | CAP Reg. 2021/2116 | 3 years | Post-execution | Required |
| DSA-VLOP | DSA Art. 15, 34, 37, 40, 42 | 2 years | Within 24h | Required |
| DORA | DORA Art. 5, 17, 19, 28 | 5 years | Within 24h | Required |
Six normative documents. RFC-style rigor.
The ARSIA Protocol specification is a complete, self-contained set of normative documents. Every behavior is defined, every structure has a schema, every rule has test vectors. Built to the standards that standards bodies expect.
Core Envelope
Message structure, EdDSA signing, discovery, authorization, compliance field, transport bindings. The foundation everything else builds on.
Actions
Capabilities, human oversight (pending_approval / approval_decision), explainability, action registry, rollback semantics.
Routing
Message routing, compliance broker topology, data residency enforcement, delivery guarantees, idempotency.
State
State lifecycle (GET, SET, DELETE, QUERY, PURGE), GDPR obligations (erasure, portability), audit trail generation.
Identity
Agent identity, certificates, trust levels, 6-phase onboarding flow, JWKS discovery, key rotation.
Assets
Transaction validation, escrow conditions, asset transfers, MiFID II / DORA / PSD2 controls. Financial intent, not execution.
From pip install to compliant agents in minutes.
The Python SDK gives you the full protocol: envelope lifecycle, signing, validation, compliance profiles, encryption, and CLI tools. Fully typed, zero external dependencies for core features.
Install the SDK
pip install arsia-protocol for the library, or pip install "arsia-protocol[cli]" for the command-line tools.
Create an envelope
Build a request, response, or event envelope with typed constructors. Set sender, receiver, capabilities, and payload.
Sign & validate
Generate Ed25519 keys, sign the envelope, validate against L1 (schema) and L2 (semantic) rules. Three function calls.
Apply compliance
Set compliance.profile to any of the 7 built-in profiles. The SDK inherits retention, jurisdiction, oversight, and audit requirements automatically.
Ship it
The envelope is transport-agnostic. Send it over HTTP, WebSocket, message queue, or pipe it into MCP/A2A. The protocol doesn't care how — only that it's compliant.
from arsia_protocol import ( create_request, generate_ed25519_keypair, sign_message, verify_message, validate_schema, apply_profile, ) # Generate keys priv, pub = generate_ed25519_keypair() kid = "agent:acme.bot#k1" # Build a signed request envelope envelope = create_request( from_agent="agent:acme.bot", to_agent="agent:other.svc", payload_type="com.acme.analyze", capabilities=["com.acme.analyze"], args={"data": "ready"}, ) signed = sign_message(envelope, priv, kid) # Verify + validate assert verify_message(signed, pub) is True assert validate_schema(signed) == [] # Apply MiFID-II compliance signed["compliance"] = { "profile": "MIFID-II" } enriched = apply_profile(signed) # retention_days, data_residency, # human_oversight — all inherited
Built in the open. Governed by standards.
The protocol is open-source under CC BY-SA 4.0. The SDK is production-ready on PyPI. Standards win through institutional trust and community adoption — we're building both.
GitHub Repository
Full specification source, JSON Schemas, test vectors, and contribution guidelines. Star, fork, or open an issue.
arsialabs/arsia-protocolSDK on PyPI
Production-ready Python SDK. Envelope lifecycle, signing, validation, compliance profiles, encryption, CLI tools. Fully typed.
pip install arsia-protocolExamples & Demos
14 examples covering every protocol feature. 2 production demos: fintech securities trade (MiFID II) and healthcare data pipeline (GDPR Art. 9).
Explore demosW3C Community Group
Member of the AI Agent Protocol Community Group. Shaping the standards for agent interoperability alongside the industry.
Active memberEU AI Pact — Pillar II
Direct channel with the European Commission and AI Office. Building the protocol inside the rooms where the rules are written.
Active participantContribute
The spec is open. Propose new compliance profiles, submit test vectors, improve documentation, or build SDK bindings for your language.
Get involvedJoin the conversation.
Build with us.
Whether you want to implement the protocol, provide feedback on the spec, or explore commercial tooling — we'd like to hear from you.