The original title is "Sign the message, not the tunnel: Introducing N-AALP for AI agents"

Short summary

N-AALP is a proposed application-layer protocol where the message itself—not the transport connection—carries identity, authorization, and audit proof for AI agents. It uses deterministic CBOR and COSE signatures so that any signed agent action remains verifiable after being queued, relayed, or replayed. The author invites community review of the draft spec, acknowledging it has no IETF consensus yet.

• •Agent security today relies on connection-level proofs (TLS, mTLS, bearer tokens) that don't survive message forwarding or replay
• •N-AALP signs the message itself using deterministic CBOR + COSE, making identity and authorization verifiable offline on any transport
• •Content-addressed IDs and self-certifying signer keys eliminate need for directories or certificate authorities

Generated with AI, which can make mistakes.