AT1C gives you a cryptographically signed, independently verifiable proof that a human approved a specific AI agent action — before that action executes.
No approval, no valid action. No exceptions.
Built for developers. Required for EU AI Act compliance (enforcement: August 2026).
git clone https://github.com/at1c-protocol/at1c-protocol-official.git
cd at1c-protocol-official
npm install
npm run demoOr install the SDK directly:
npm install @at1c/sdk- 📄 Whitepaper — EU AI Act compliance, sector analysis, Algorand x402 payment architecture
- 📜 Manifesto — AT1C founding principles: sovereign identity, humans first
- 📚 All docs — protocol spec, receipts, verification, SDK reference
curl https://registry.at1c.com/health- Request — an AI agent asks permission to perform a specific action
- Approve — a human explicitly grants or denies it
- Proof — an Ed25519-signed receipt is generated, binding the user, action, timestamp, and nonce
- Verify — any system independently verifies the receipt before execution — no trust required
Every receipt is single-use (nonce-based replay protection). Approval is scoped to the exact action requested — not transferable to any other action.
The agentic AI space has several overlapping projects. Here is where AT1C differs from the closest ones:
vs. autonomous agent runtimes (Theseus, etc.) — those systems remove humans from the loop by design. AT1C keeps a human in the loop by design. These are not competing approaches — they target different buyers. Autonomous runtimes suit DeFi/crypto use cases where fully autonomous execution is the goal. AT1C suits regulated sectors where human oversight is legally required.
vs. data redaction gateways (TrustLayer, etc.) — those systems control what data AI sees. AT1C controls what actions AI is permitted to take. A developer could use both without conflict.
vs. payment authorization protocols (ATXP, etc.) — those systems authorize agent payments. AT1C authorizes any agent action, with cryptographic proof of human approval, across any domain — not scoped to payments.
The field is converging on a shared framing: treat autonomous agents as instruments acting under a person's authority, with scoped, revocable, auditable chains of responsibility. AT1C implements this today, with a working SDK and live registry.
The EU AI Act begins enforcement in August 2026. It requires:
- Accountability for automated decisions
- Human oversight of high-risk AI actions
- Auditable records of AI behaviour
AT1C gives you all three out of the box. Primary target sectors: fintech, health, legal.
- No implicit authority — nothing acts without explicit approval
- Context binding — approval is valid only for its exact action and resource
- Replay protection — every receipt is single-use
- Verification before execution — actions must be verified before they run
- Non-custodial — AT1C never holds signing keys. Agent keys and user keys stay on their respective devices.
- 📄 Whitepaper: AT1C_Protocol_Whitepaper_v1.4.docx
- 📜 Manifesto: docs/manifesto.md
- 🔧 Protocol Spec: docs/protocol.md
- 📚 All docs: docs/
- npm package: @at1c/sdk
- Live registry: registry.at1c.com
-
Agent key custody — ✅ done (v1.1) — non-custodial by design. Agents generate their own keypairs locally; the registry only ever receives and signs over the public key.
-
Live registry — ✅ done (v1.2) — authenticated agent verification live at
registry.at1c.comover HTTPS. Registry private key held in environment variables only, never on the filesystem. -
End-user onboarding (planned) — passkey-based (WebAuthn/FIDO2) flow. The signing key lives on the user's device, unlocked by biometric — AT1C never holds it.
-
Receipt storage (planned, opt-in) — currently receipts are stored locally. Hosted long-term storage planned as an optional paid tier, framed as evidence/insurance retention, not a protocol requirement.
-
Tier validation (planned) — agent tier is currently caller-supplied with no server-side validation. Will be constrained to server-side assignment before open registration launches.
-
Quantum resistance (future) — AT1C currently uses Ed25519, which is not post-quantum secure. Migration to a NIST-approved post-quantum signature scheme is on the long-term roadmap. Not urgent for August 2026 compliance, but noted transparently.
-
Agent Manifest (future) — structured, signed per-agent document mapping onto EU AI Act Article 13/14 documentation requirements.
These are documented deliberately — AT1C's value depends on being trustworthy, and that includes being transparent about what is solid today versus what is still being built.