google/sam

What it solves

SAM (Sovereign Agent Mesh) provides a decentralized, zero-trust networking layer specifically designed for autonomous AI agents. It solves the problem of how agents can discover each other and communicate securely across different environments (cloud, local, or edge) without relying on a single proprietary vendor or centralized authority.

How it works

SAM creates a peer-to-peer (P2P) network of lightweight nodes (sam-node) that allow agents to plug in and invoke tools dynamically. The architecture consists of three main components:

• Control Plane (sam-control-plane): Manages node identity registration, authorization policies, and router coordination.
• Router (sam-router): Acts as bootstrap nodes and relays for data-plane connectivity using libp2p.
• Node (sam-node): Local clients that provide mesh transport and MCP sidecar routing.

To ensure "sovereignty," the system allows operators to maintain full control over their root cryptographic keys, use their own identity providers (OIDC), and enforce geographic or jurisdictional boundaries using label gates to ensure data doesn't leave specific regions.

Who it’s for

Developers and organizations that need to deploy autonomous AI agents that can communicate securely and privately across distributed infrastructure while maintaining strict control over identity, data residency, and regulatory compliance (such as GDPR).

Highlights

• Zero Config & Zero Trust: Nodes discover each other automatically and every connection is strictly authenticated.
• Sovereign Control: Operators can hold their own root keys and deploy their own dedicated control plane and routers on private infrastructure.
• Environment Agnostic: Cryptographic identities allow nodes to move seamlessly between cloud, local, and edge environments.
• Jurisdictional Boundaries: Uses cryptographically attested label gates to mathematically guarantee that prompts and tool invocations stay within authorized geographic scopes.