The latest articles on DEV Community by Tang Haoran (@haorantang). https://dev.to/haorantang https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4015038%2F4a7e5d79-1199-427d-8d15-c1ae6f45703e.png https://dev.to/haorantang en Tang Haoran Sat, 04 Jul 2026 13:07:10 +0000 https://dev.to/haorantang/the-ai-agent-protocol-stack-is-missing-a-layer-heres-the-third-one-26fh https://dev.to/haorantang/the-ai-agent-protocol-stack-is-missing-a-layer-heres-the-third-one-26fh <p>MCP connects agents to tools. A2A connects agents to agents. Both are excellent. Neither answers one question:</p> <p><strong>How do agents know what they're ALLOWED to do?</strong></p> <p>Cisco Research proposed a layered agent protocol architecture in 2025 (arXiv:2511.19699):</p> <ul> <li> <strong>L8</strong> (Agent Communication Layer) → Standardized message envelopes, speech-act performatives</li> <li> <strong>L9</strong> (Agent Semantic Negotiation Layer) → <em>"does not exist today"</em> (direct quote from the paper)</li> </ul> <p>L8 is being implemented by MCP and A2A. <strong>L9 had no answer — until now.</strong></p> <h2> ERDL: The Third Layer </h2> <p><strong>Entity-Rule Definition Language</strong> is an open standard for agent behavioral rules. It sits between the agent's reasoning and its tool execution:</p> <p>MCP → tools. A2A → communication. ERDL → rules.</p> <p>Three layers. One complete agent protocol stack.</p> <p><a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fopenoba.github.io%2Ferdl-landing%2Fstack.html" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fopenoba.github.io%2Ferdl-landing%2Fstack.html" alt="Agent Protocol Stack" width="" height=""></a></p> <h3> What ERDL brings </h3> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Capability</th> <th>Status</th> </tr> </thead> <tbody> <tr> <td>11 operators including <code>within</code> and <code>rate</code> </td> <td>Complete</td> </tr> <tr> <td>16 deterministic action types</td> <td>Complete</td> </tr> <tr> <td>Execution Rings (Ring 0–3)</td> <td>Complete</td> </tr> <tr> <td>Guardian Agent model</td> <td>Complete</td> </tr> <tr> <td>SafeExpr engine (zero code injection)</td> <td>Complete</td> </tr> <tr> <td>Hot reload without restart</td> <td>Complete</td> </tr> <tr> <td>Structured audit trails</td> <td>Complete</td> </tr> <tr> <td>Snapshot + rollback</td> <td>Complete</td> </tr> </tbody> </table></div> <h3> How it works </h3> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code> yaml rule: block_privileged_commands priority: 0 description: "Block dangerous shell commands" when: field: "tool.command" operator: in value: ["sudo", "rm -rf"] then: action: BLOCK message: "Privileged commands require human approval" **One YAML file. When an agent tries to call a blocked tool, ERDL's Action Guard intercepts the call before it reaches the tool. Not after. Not as a suggestion. The engine evaluates conditions, matches rules, and returns a deterministic verdict. The agent never touches sudo. Period. OWASP Top 10 (2026) — How ERDL Maps OWASP Risk ERDL Mitigation R1: Excessive Agency Time windows + rate limiting R2: Prompt Injection Guard rules run before LLM output R3: Supply Chain Agent BOM with rule audit trail R4: Data Leakage Field-level BLOCK rules R5: Overreliance Guardian Agent oversight R6: Multi-Agent Collusion Cross-agent audit chains EU AI Act (effective August 2, 2026) ERDL maps directly to transparency and human oversight requirements. Audit records export to OCSF format, compatible with SIEM systems. The Stack is Now Complete MCP — tools (Anthropic, Linux Foundation) A2A — communication (Google, Linux Foundation) ERDL — rules (OpenOBA, MIT) Landing Page: openoba.github.io/erdl-landing Spec v1.0 (English): spec/index-en.md GitHub: github.com/OpenOBA/ERDL MIT License. RFC open. What do you think — does the agent protocol stack need a dedicated rules layer? Let's discuss.** </code></pre> </div> ai opensource security typescript