emiliaprotocol/emilia-protocol

Authority control plane for autonomous work. EMILIA Gate enforces finite customer-owned mandates at protected executor boundaries; the open protocol keeps evidence verifiable.

What it solves

EMILIA Protocol addresses the security risk of autonomous AI agents performing consequential actions (like making large payments or deleting repositories) without strict, verifiable authority. It prevents agents from executing unauthorized changes to a requested action—such as altering a payment amount or destination—after a human has approved it, ensuring that the only action executed is the exact one that was authorized.

How it works

The protocol separates identity (who is calling) and policy (what is generally allowed) from authority (the specific job an agent may perform). It uses a "Gate" mechanism that acts as a control point before a protected tool runs.

  1. Mandate: A customer defines the specific limits, evidence requirements, and expiry for a task.
  2. Exact Work Binding: The protocol binds the specific method, target, and all material fields of a request into a canonical object.
  3. Verification and Reservation: The relying party verifies the evidence, makes a local authorization decision, and reserves the authority before the agent enters the provider system.
  4. Execution: The system permits only one admitted provider attempt for that authorization instance to prevent replay attacks or blind retries.

Who it’s for

  • AI Agent Developers: Those building autonomous workers that need to integrate with sensitive business systems via MCP (Model Context Protocol) or HTTP.
  • Enterprise Security Teams: Organizations requiring durable, externalized authority state and strict audit trails for AI-driven actions.
  • Software Engineers: Developers wanting to wrap existing tools (e.g., via LangChain) to ensure they are only called with approved parameters.

Highlights

  • Exact Action Binding: Prevents the "what you saw is what you signed" gap by binding approvals to specific data fields.
  • Formal Verification: Includes a security case with Tamarin lemmas and Dolev-Yao models to prove security claims.
  • MCP Integration: Provides a dedicated MCP server and tools to protect declared consequential actions.
  • SDKs: Offers a thin SDK wrapper for languages like Python (LangChain) and JavaScript/TypeScript.
  • Open Standard: Based on a portfolio of IETF Internet-Drafts for interoperability.

Related

  • Project
    decionis/agent-safe-pipeline

    An execution boundary proxy that intercepts AI agent actions and requires authorization from a control plane before forwarding them to target APIs.

  • Project
    microsoft/agent-governance-toolkit

    A comprehensive governance framework for autonomous AI agents that provides deterministic policy enforcement, identity management, and audit logging to prevent unauthorized actions.

  • Project
    dengyier/OpenWorkProof

    An open protocol for AI Agent work contracts and verifiable execution, ensuring that agent actions are authorized, evidenced, and formally accepted by humans.

  • Project
    Justin0504/Aegis

    AEGIS is an open-source security firewall for AI agents that intercepts every tool call before execution, classifies it, checks it against policies, and either allows, blocks, or pauses it for human approval — with a dashboard, audit trail, and threat-coverage tracking.

  • Project
    canyonroad/agentsh

    A secure, policy-enforced execution gateway for AI agents that intercepts and governs file, network, process, and database activity at runtime.