Micro Agent Protocol

MAP

The firewall for AI actions. MAP is an open protocol that enforces security policies, triggers human approvals, and generates cryptographically signed receipts for every single decision your agent makes.

Status

Developer Preview

Repository

GitHub →

Capabilities

Why MAP

Runtime policy engine with hot-swap capabilities

Cryptographically signed, tamper-evident receipts

Human-in-the-loop approval workflows via webhooks

Native SDKs for TypeScript, Python, and Go

Built-in adapters for HTTP, payments, and database reads

Three-level conformance certification with an open MEP governance process

The Problem

What breaks
today.

No gate. Agents fire payments, database writes, and deployments with nothing checking policy first.

No audit trail. Decisions live in memory and vanish with the process: there is nothing to show an auditor.

Approvals are bolt-on scripts. Human-in-the-loop is hand-rolled per project instead of being part of the protocol.

The Architecture

Dispatch: capability + TaskEnvelope

map() wraps your agent with SimpleRule policy. Every action is a DispatchRequest: task_id, requester_identity, intent, risk_class.

Allow

Policy passes: execution proceeds through the built-in adapters: HTTP, payments, db.read.

Require approval

Execution stops with an approval_reference; humans approve via webhook or .approve().

Deny

Blocked immediately: nothing executes, and the denial is logged.

Signed receipt

Every path (allow, approval, deny) logs a receipt: HMAC-SHA256 / RSA MAPSIG signatures, tamper-evident.

Wire formats verified against micro-agent-protocol: src/protocol, src/map.ts, schemas/

01. Agent Request

The autonomous agent attempts to execute a consequential command. MAP receives the dispatch with its task envelope.

{
  "capability": "npm.publish",
  "envelope": {
    "task_id": "task-001",
    "requester_identity": { "type": "service", "id": "cli-agent-01" },
    "target_agent": "release-agent-v1",
    "intent": "Publish the package",
    "risk_class": "medium",
    "delegation_token": "..."
  }
}

02. MAP Evaluation

MAP intercepts the action and evaluates it against the policy rules in-process.

policy rules (SimpleRule DSL)

{
  "when": "npm.publish",
  "require": "approval"
}

03. Cryptographic Receipt

A deterministic receipt is generated, signed (HMAC-SHA256 / RSA, MAPSIG format), and logged.

{
  "receipt_id": "receipt:task-001:0",
  "task_id": "task-001",
  "agent_id": "release-agent-v1",
  "action_taken": "npm.publish",
  "resource_touched": "npm registry",
  "policy_checks": ["strict-release-gate"],
  "approval_used": "approval_998",
  "timestamp": "2026-03-19T17:55:10Z",
  "result_hash": "sha256:...",
  "signature": "eyJhbGciOiJIUzI1NiIs..."
}

Protocol Specifications

Runtime policy engine with hot-swap capabilities

Cryptographically signed, tamper-evident receipts

Human-in-the-loop approval workflows via webhooks

Native SDKs for TypeScript, Python, and Go

Built-in adapters for HTTP, payments, and database reads

Three-level conformance certification with an open MEP governance process

Performance

Policy evaluation is sub-millisecond. MAP adds essentially zero overhead next to the AI call it gates.

Policy eval · 5 rules~1 µs · 1.2M/sec

Policy eval · 100 rules~20 µs · 50K/sec

Full execution · no I/O~4 µs · 256K/sec

Policy hot-swap~6 µs · instant

SDK Coverage · 15-Surface Matrix

TypeScript · @sidianlabs/map13/15 · 87%

Python · mapprotocol12/15 · 80%

Go · mapproto9/15 · 60%

60-Second Install

One install. One map() call. Your agent is now gated.

# terminal

$ npm install @sidianlabs/map

// your agent, unchanged except for this

import { map } from '@sidianlabs/map';

const agent = map({

policy: [

// payments over $1000 need a human

{ when: 'payment.*', amount_gt: 1000, require: 'approval' },

// block writes to production

{ when: 'db.write', env: 'production', require: 'deny' },

// everything else: allow

{ when: '*', require: 'allow' },

onApprovalRequired: async ({ capability, approve }) => {

// ping Slack, wait for the human, done

if (await askHuman(`Approve ${capability}?`)) await approve();

});

That's it. No TaskEnvelope. No AgentDescriptor. No DelegationToken. Just policy, handlers, and receipts. Every decision your agent makes now gets a cryptographically signed receipt.

BEFORE

AI agent runs payment.execute $5,000. Nothing stops it. No record. No approval.

AFTER

Same action. MAP checks policy in ~1µs, pings your Slack, and only executes on approval, with a signed receipt.

YOU WROTE

Six lines of policy. Zero infrastructure. npm install and go.

Conformance Certification

LEVEL 01

Protocol
Compliant.

Basic schema correctness plus the dispatch and approval flow. The entry bar for any MAP implementation.

LEVEL 02

Security
Verified.

Signing, replay protection, and tenant isolation. Cross-tenant access denial must be demonstrated, not claimed.

LEVEL 03

Production
Ready.

Reliability, chaos engineering, disaster recovery drills, and a 30-day production stability report. Certifications are valid for 12 months.

Interoperability

MAP is designed to compose with, not replace, the protocols you already run.

MCP

Tool connectivity: MAP wraps MCP tools with policy enforcement.

A2A

Agent-to-agent tasks: MAP governs execution within A2A task flows.

ACP

Commerce and payments: MAP provides the policy layer for ACP payment flows.

Why use MAP?

Implementation Scenarios

Gate AI payments, database writes, and infrastructure changes

Route high-risk agent actions to human approval workflows

Produce audit trails and signed receipts for regulated systems

Deploy as an HTTP gateway with policy and audit endpoints

MAP