Agent Instruction Protocol (AIP) Overview
- AIP is an umbrella term for multiple protocol constructs that formalize agent skills through structured, schema-validated representations and clear delegation mechanisms.
- Graph-based AIP representations convert free-form instructions into modular YAML execution graphs, boosting task performance (e.g., improved pass rates and reduced delays).
- Security-focused AIP approaches incorporate formal assurance analysis and token-based delegation to address cross-protocol vulnerabilities and enforce auditability.
Agent Instruction Protocol (AIP) is not a single, universally fixed standard in the recent agent-systems literature. Instead, the acronym has been used for multiple, partly overlapping constructs: a schema-validated directed execution graph for representing and improving agent skills; a security-relevant protocol surface whose composition with other agent protocols exposes specification, implementation, and responsibility gaps; an adversarial instructional prompt attack on retrieval-augmented generation; and, in adjacent identity work, an Agent Identity Protocol for verifiable delegation across MCP and A2A. This plurality places AIP at the intersection of skill specification, interoperability, delegation, governance, and protocol security (Blumenfeld et al., 3 Jun 2026, Zheng et al., 27 Jun 2026, Prakash, 25 Mar 2026, Chaturvedi et al., 18 Sep 2025).
1. Terminological scope and research context
In current arXiv usage, “AIP” is an overloaded acronym rather than a settled term of art. The most directly protocol-design-oriented usage is the Agent Instruction Protocol that models a skill as a directed execution graph with schema-validated YAML. A separate security paper treats agent instruction and coordination protocols as objects of formal assurance analysis, emphasizing cross-protocol composition. A third paper uses AIP to mean “Adversarial Instructional Prompt,” describing an attack surface in RAG systems. Another paper uses the acronym for “Agent Identity Protocol,” focused on delegation, provenance, and authorization across MCP and A2A (Blumenfeld et al., 3 Jun 2026, Zheng et al., 27 Jun 2026, Chaturvedi et al., 18 Sep 2025, Prakash, 25 Mar 2026).
| Usage of “AIP” | Definition in the literature | Primary concern |
|---|---|---|
| Agent Instruction Protocol | Directed execution graph for agent skills | Skill authoring, execution, governance |
| Adversarial Instructional Prompt | Attack on RAG via instructional prompts | Retrieval manipulation and stealth |
| Agent Identity Protocol | Verifiable delegation across MCP and A2A | Identity, attenuation, provenance |
This multiplicity matters because the same acronym spans both constructive and adversarial settings. A plausible implication is that discussions of “AIP” require immediate disambiguation by paper, context, or subsystem. The surrounding literature on the Internet of Agents, multi-protocol gateways, capability negotiation, AI-SDLC governance, and agent transaction systems further indicates that instruction protocols are increasingly being embedded in broader communication, security, and enforcement stacks rather than treated as isolated prompt templates (Fleming et al., 24 Nov 2025, Shen et al., 22 Mar 2026, Huang et al., 16 Jun 2025, Prifti, 24 May 2026, Muttoni et al., 8 Jan 2025).
2. AIP as a graph-structured representation of agent skills
One major formulation defines AIP as a structured skill representation in which a skill is modeled as a directed execution graph , with discrete steps as nodes, typed input/output edges, and a schema-validated YAML specification (Blumenfeld et al., 3 Jun 2026). In this formulation, node types include a Skill Node, Step Nodes, and Satellite Nodes. Step Nodes are either backed by a deterministic script or described in natural language, while edge types include inputs/outputs, depends_on, script, and references. Control structures such as parallel and one_of can also be specified on steps.
The emphasis is on replacing free-form prose instructions with explicit, typed, and addressable workflow structure. All graphs are defined via YAML files conforming to a JSON schema, and validation occurs at authoring-time rather than runtime. Each node and field is typed, named, and addressable, which the paper associates with modularity, testability, and auditability. The AIP Compiler, described as a meta-skill, translates existing SKILL.md prose, documentation, scripts, and informal notes into a structured package containing YAML, scripts/, references/, and source/ artifacts. The compilation process extracts procedures, input/output dependencies, and decision points; resolves ambiguities; generates or extracts scripts where procedures can be made deterministic; assigns types and names; and then validates the result against the schema.
The empirical evaluation reported for this representation is unusually concrete. On 27 real agent tasks from SkillsBench, compiling human-written skills to AIP raised Claude Sonnet’s mean task reward from 0.60 to 0.71 and pass rate from 53% to 67%, with a statistically significant Wilcoxon signed-rank result of ; the paper also reports 12 task wins, 2 losses, and 13 ties, often in less wall-clock time (Blumenfeld et al., 3 Jun 2026). A more detailed tabulation gives mean task reward as and pass rate as , while average wall-clock time fell from 585s to 510s but was not statistically significant. The stated explanation is that the graph delivers vetted, runnable units rather than requiring the agent to re-derive code, commands, and tool calls from prose at each session.
A second contribution of this graph formulation is the skill-improvement loop. Because each skill is schema-validated, functionally testable, and addressable node-by-node, failures can be localized and repaired precisely. The paper reports that two authored-skill failures were traced to the script level; after adjusting the AIP specification and recompiling, both recovered with zero regressions, including one task that moved from 0/5 to 5/5 (Blumenfeld et al., 3 Jun 2026). The same graph structure is also presented as a substrate for corpus-level governance, graph-database projection, reusable subgraph discovery, and reinforcement learning over skills.
3. Formal security analysis and protocol composition
A second major line of work treats agent instruction and coordination protocols as objects of formal assurance analysis. The paper introducing AgentThread argues that AI agent protocols define how agents use tools, delegate work, and coordinate across software systems, yet their security requirements remain incomplete and inconsistently enforced across deployments (Zheng et al., 27 Jun 2026). Its central contribution is a source-linked framework that goes from specification text to running SDKs through a layered security scope, TLA+ invariants, and a two-phase checker.
The layered security scope spans both RPC and agent semantics. The RPC layer includes L1 message or wire-format integrity, L2 session lifecycle, and L3 identity or capability binding. The agent layer adds L4 semantic operation controls, such as preventing unauthorized content-to-action flows and enforcing explicit consent, and L5 audit or accountability, including end-to-end provenance and completeness of audit trails (Zheng et al., 27 Jun 2026). This framing is important because it makes explicit that agent protocols must be evaluated not only for transport correctness but also for semantic authority transfer and traceability.
To bridge natural-language specifications and model checking, the framework constructs a Protocol IR that extracts normative clauses from specification text, preserves RFC 2119 modalities such as MUST and SHOULD, and encodes roles, triggers, preconditions, state updates, and provenance to source text. Actors are compiled into quantified TLA+ principals, triggers become guards, preconditions become conjuncts, and state writes become primed updates. The paper gives invariant patterns such as
and also presents a composition-safety form over multiple protocols (Zheng et al., 27 Jun 2026).
AgentThread’s checker operates in two phases. Phase 1 compiles the IR to a TLA+ model, model-checks security invariants, and classifies counterexamples as Spec-Fail, Model-Fail, or Ambiguity-Fail. Phase 2 replays executable counterexamples against SDKs or reference implementations through adapters and then classifies implementation evidence as Both-Fail, Impl-Fail, or Source/Type Evidence (Zheng et al., 27 Jun 2026). The paper evaluates five emerging agent protocols—MCP, A2A, ANP, ACP, and ACP-Client—and reports 35 specification-level findings, 80 implementation tests against production SDKs and reference servers, and 30 additional failures that emerge only under protocol composition. It further states that only one protocol enforces a security-relevant control in practice and that no protocol assigns enforcement for cross-protocol behavior.
The most distinctive claim of this work is that insecurity in agent protocols is not only a specification or implementation problem, but also a responsibility gap across protocols, SDKs, and deployments (Zheng et al., 27 Jun 2026). The reported composition failures include hidden intermediaries causing provenance loss, semantic or authority mismatches, and “composition-orphan” responsibilities assigned to no protocol or SDK. This suggests that any operational notion of AIP must include explicit ownership of cross-boundary enforcement rather than relying on local conformance alone.
4. Identity, delegation, and verifiable provenance
A separate protocol proposal uses the acronym AIP for “Agent Identity Protocol” and addresses a narrower but foundational problem: verifiable delegation across MCP and A2A (Prakash, 25 Mar 2026). The paper begins from the claim that neither protocol verifies agent identity and reports that a scan of approximately 2,000 MCP servers found all lacked authentication. It introduces Invocation-Bound Capability Tokens (IBCTs), described as a primitive that fuses identity, attenuated authorization, and provenance binding into a single append-only token chain.
IBCTs operate in two wire formats. Compact mode uses a signed JWT for single-hop cases, while chained mode uses a Biscuit token with Datalog policies for multi-hop delegation. The protocol supports two identity schemes, DNS-based aip:web:<domain>/<path> and self-certifying aip:key:ed25519:<multibase>, and its chain structure consists of an authority block, one or more delegation blocks, and optional completion blocks binding outcomes, status, and resource consumption to the delegation history (Prakash, 25 Mar 2026). The attenuation rule is stated explicitly:
The paper reports concrete performance numbers. Compact-mode verification takes 0.049ms in Rust and 0.189ms in Python; in a real MCP-over-HTTP deployment, compact mode adds 0.22ms of overhead over no-auth; and in a real multi-agent deployment with Gemini 2.5 Flash, the protocol adds 2.35ms of overhead, stated as 0.086% of total end-to-end latency (Prakash, 25 Mar 2026). Adversarial evaluation across 600 attack attempts shows a 100% rejection rate, with delegation depth violation and audit evasion through empty context described as two attack categories uniquely caught by the chained delegation model and not detected by unsigned or plain JWT deployments.
This identity-oriented AIP is complementary to other negotiation and binding proposals rather than a replacement for them. ACNBP, for example, defines a structured 10-step process spanning capability discovery, candidate pre-screening, secure negotiation, binding commitment, execution, commit or abort, and distributed commitment update, with digital signatures, capability attestation, and an Agent Name Service infrastructure (Huang et al., 16 Jun 2025). Its protocolExtension mechanism is explicitly designed for backward-compatible protocol evolution. By contrast, the identity AIP concentrates on delegation chains, attenuation, and provenance across MCP, A2A, and HTTP. Together, these works indicate that instruction protocols increasingly depend on explicit identity, capability negotiation, and signed commitments rather than on self-declared roles or informal delegation alone (Prakash, 25 Mar 2026, Huang et al., 16 Jun 2025).
5. Placement within layered agent architectures
Recent protocol architecture papers consistently place instruction-oriented mechanisms inside larger communication stacks. The “Internet of Agents” proposal adds two new layers above conventional application transport: an Agent Communication Layer (L8) and an Agent Semantic Negotiation Layer (L9) (Fleming et al., 24 Nov 2025). L8 standardizes message envelopes, performatives such as REQUEST, INFORM, PROPOSE, and ACCEPT, and interaction patterns including request-reply and publish-subscribe. L9 introduces machine-verifiable semantic negotiation in which agents discover, negotiate, and lock a Shared Context, defined as a formal schema for concepts, tasks, and parameters relevant to their interaction.
Within this architecture, AIP is described not as a direct synonym for L8 or L9 but as something that presumes both: standardized message envelopes from L8 and formal, validated instruction schemas from L9 (Fleming et al., 24 Nov 2025). The SNL handshake—SNL-HELLO, SNL-SELECT, and SNL-LOCK—turns semantic agreement into a protocol-defined handshake rather than ad hoc application logic. This placement is significant because it reframes instruction protocols as consumers of standardized communication and semantic grounding layers rather than as standalone prompt or workflow artifacts.
Other layered proposals elaborate adjacent parts of the same design space. Co-TAP defines a three-layer framework consisting of HAI for event-driven human-agent interaction, UAP for service registration, discovery, and protocol conversion, and MEK for transforming memory into shareable knowledge units (An et al., 9 Oct 2025). UAP’s gateway uses a bidirectional adapter pattern and plugin chain processing to convert among heterogeneous protocols, while MEK standardizes knowledge objects and their distribution across the agent network. The resulting picture is one in which instruction protocols coexist with interface streaming, interoperability middleware, and collective learning subsystems.
STEM Agent provides a concrete implementation-oriented architecture for multi-protocol systems. It unifies five interoperability protocols—A2A, AG-UI, A2UI, UCP, and AP2—behind a single gateway; externalizes domain capabilities through MCP; and routes normalized requests into a protocol-agnostic agent core (Shen et al., 22 Mar 2026). In the exposition of extending the system to a new instruction protocol such as AIP, the required steps are implementing a new Protocol Handler, mapping or normalizing instruction formats, routing to the agent core, and returning results using AIP semantics. The paper also reports a 413-test suite validating protocol handler behavior and component integration across five architectural layers, completing in under three seconds. A plausible implication is that instruction protocols are becoming gateway-pluggable components in larger orchestration frameworks rather than monolithic end-to-end systems.
Beyond communication and execution stacks, some works extend protocolization into economic exchange. ATCP/IP, an Agent-to-Agent transaction system for intellectual property, standardizes request, terms formulation, negotiation, agreement token minting, payment, IP delivery, and audit logging, with programmable licensing and a legal wrapper for offchain enforcement (Muttoni et al., 8 Jan 2025). Although ATCP/IP is not presented as an AIP, it shows how instruction-like inter-agent agreements can be embedded in auditable, programmable contract flows.
6. Governance, human-agent boundaries, and adversarial surfaces
Instruction protocols are also increasingly analyzed as governance artifacts. A protocol language for AI-SDLC processes proposes a domain-specific language for specifying human-agent responsibility boundaries, approval gates, and governance constraints as formally defined protocols (Prifti, 24 May 2026). Its top-level form is
where modes, validators, disagreement policy, and constraints are first-class specification elements. The language distinguishes policy from mechanism and introduces enforcement primitives such as validation tokens and capability boundaries. The capability-boundary invariant is stated as
The same work defines well-formedness conditions such as strict mode separation, validator coverage, policy completeness, and constraint consistency; operational semantics for validator application and token issuance; and enforcement invariants including token integrity, non-overridable blockers, and audit completeness (Prifti, 24 May 2026). Its “2+N team pattern” formalizes classical Separation of Duties for AI-SDLC as two human-in-control roles plus specialized agent members. The paper further argues that structural enforcement bounds system failure rates, whereas behavioral compliance permits cumulative or near-saturating growth. For AIP-like systems, this frames instruction protocols not merely as execution plans but as mechanisms for bounding non-determinism and assigning responsibility.
At the same time, the literature includes explicitly adversarial uses of the acronym. “AIP: Subverting Retrieval-Augmented Generation via Adversarial Instructional Prompt” defines AIP as an attack that manipulates RAG outputs by altering instructional prompts rather than user queries (Chaturvedi et al., 18 Sep 2025). The attack is organized into three stages: prompt and document initialization with stealth triggers; diverse query generation to ensure robustness across paraphrases; and a genetic algorithm-based joint optimization over adversarial prompts and adversarial documents. Its multi-objective formulation balances attack effectiveness, avoidance of false retrieval, and preservation of clean utility.
The reported results are strong and specific. On MedSquad, AIP achieves up to 95.23% ASR while preserving benign functionality; the paper states that similar strong improvements are shown on AmazonQA and MoviesQA, that ACA is maintained, and that the prompts and documents are rated natural, with a GRUEN score of 0.883 (Chaturvedi et al., 18 Sep 2025). Standard textual anomaly detectors based on perplexity, spamicity, and fluency detect the attack at low rates of roughly 25%–33%. The proposed countermeasures include multi-stage or redundant retrieval, cross-verification against auxiliary knowledge bases, and rigorous instructional prompt auditing with provenance tracking.
Taken together, these governance and adversarial works show that instruction artifacts are not only execution aids. They are approval gates, responsibility boundaries, audit objects, and attack surfaces. This suggests that any mature conception of AIP must accommodate formal enforcement, provenance, and prompt or specification auditing alongside functional execution.
7. Significance and emerging directions
Across these papers, AIP-related research converges on several stable themes even though the acronym itself remains unstable. First, instruction is being formalized: graph-structured skills, typed edges, schema validation, and formal protocol semantics all replace or constrain free-form prose (Blumenfeld et al., 3 Jun 2026, Prifti, 24 May 2026). Second, instruction is being embedded in broader stacks: message envelopes, semantic negotiation, service discovery, gateways, protocol conversion, and MCP-mediated tool use increasingly sit underneath or around instruction protocols (Fleming et al., 24 Nov 2025, An et al., 9 Oct 2025, Shen et al., 22 Mar 2026). Third, instruction is being secured: TLA+ invariants, replayable counterexamples, delegation chains, attenuation rules, and completion-bound provenance move security from ad hoc conventions toward explicit protocol properties (Zheng et al., 27 Jun 2026, Prakash, 25 Mar 2026).
The literature also shows that protocol composition is a decisive frontier. AgentThread reports 30 failures that emerge only under composition, while the Internet of Agents and Co-TAP proposals introduce explicit layers for communication, semantic negotiation, and protocol conversion (Zheng et al., 27 Jun 2026, Fleming et al., 24 Nov 2025, An et al., 9 Oct 2025). A plausible implication is that future AIP designs will be judged less by isolated syntax than by how well they specify ownership and enforcement at bridges, runtimes, and cross-protocol boundaries.
Finally, the coexistence of constructive AIP proposals and the Adversarial Instructional Prompt attack indicates that “instruction” is now treated simultaneously as a programming substrate and as a threat surface (Blumenfeld et al., 3 Jun 2026, Chaturvedi et al., 18 Sep 2025). In that environment, mature protocol design appears to require four properties at once: explicit structure, validated semantics, cryptographically grounded delegation or accountability where relevant, and enforceable governance over who may act, with which tools, under what evidence, and across which protocol boundaries.