DEV Community

Cover image for Zero Trust for AI Agents: Why I Built a "Handshake Protocol" (IATP)
Imran Siddique
Imran Siddique

Posted on

Zero Trust for AI Agents: Why I Built a "Handshake Protocol" (IATP)

#agents #cybersecurity #ai #security

Stop letting your agents talk to strangers. It’s time for cryptographic identity.

We are building Multi-Agent Systems like it's 1995.

We spin up a "Manager Agent" and a "Worker Agent" and let them chat via plain text prompts.

  • Manager: "Please delete the production database."
  • Worker: "Sure! I love deleting things."

This is terrifying. In traditional microservices, we have mTLS, JWTs, and API Gateways. We have Zero Trust. But in AI Agent Swarms, we rely on "System Prompts" to enforce security. We beg the LLM: "You are a helpful assistant. Please do not do bad things."

Prompting is not a security layer.

I realized that if I want to run agents in production (like my Grid Balancing Swarm), I need a protocol, not a prompt.

I built the Inter-Agent Trust Protocol (IATP). Here is how it works.

The Problem: "Prompt Injection" is actually "Privilege Escalation"

The industry is obsessed with stopping users from jailbreaking LLMs. But the real danger in a swarm is Agent-on-Agent attacks.

If a "Web Surfer Agent" gets compromised by a malicious website, it might try to instruct your "Database Agent" to dump tables. If the Database Agent only checks "Is this a valid SQL query?", you are cooked.

We need Identity. The Database Agent needs to ask: “Who are you? And do you have the DB_WRITE capability?”

The Solution: The Handshake (IATP-001)

IATP implements a cryptographic handshake similar to TLS or TCP, but optimized for the high-latency, asynchronous nature of agents.

It turns "Chatting" into "Authenticated Session Establishment."

Step 1: The Hello (Manifest Exchange)

When Agent A wants to talk to Agent B, it doesn't just send the task. It sends its Capability Manifest.

// Agent A sends:
{
  "agent_id": "researcher-01",
  "public_key": "0xABC...",
  "capabilities": ["web_search", "read_docs"],
  "nonce": "12345"
}
Enter fullscreen mode Exit fullscreen mode

Step 2: The Challenge (Proof of Identity)

Agent B receives this. It doesn't trust it yet. It generates a cryptographic challenge (a random string) and asks Agent A to sign it with its private key.

Step 3: The Verification (Session Token)

Agent A signs the challenge. Agent B verifies the signature against the public key.

  • Signature Valid? -> Identity Confirmed.
  • Role Check: Does "researcher-01" have permission to access me?

Only then does Agent B issue a SESSION_TOKEN.

The Code: RBAC for Agents

Here is what this looks like in Python using the iatp module I built.

The Server (Secure Resource):
We define an agent that requires the admin role to access its tools.

# demo_rbac.py
from iatp.server import SecureAgentServer
from iatp.policy import RBACPolicy

# Define the policy
policy = RBACPolicy()
policy.add_role("admin", ["system_reset", "view_logs"])
policy.add_role("guest", ["view_logs"])

# Start the server
server = SecureAgentServer(
    agent_id="core_system",
    private_key=load_key(),
    policy_engine=policy
)

# This tool is protected!
@server.secure_tool(required_permission="system_reset")
def reset_database():
    return "Database reset."
Enter fullscreen mode Exit fullscreen mode

The Client (The Caller):
The client must present a valid manifest during the handshake.

# The Client initiates the handshake
client = TrustClient(
    agent_id="guest_user_01",
    roles=["guest"] # I only have guest access!
)

# ❌ BLOCKED: "guest" role cannot call "system_reset"
response = client.call_tool("core_system", "reset_database")
# Output: PermissionDenied: Agent 'guest_user_01' missing capability 'system_reset'
Enter fullscreen mode Exit fullscreen mode

The blocking happens deterministically in the protocol layer. The LLM never even sees the request. It is rejected at the network level.

Why "Protocols" > "Prompts"

We need to stop treating AI Agents as magical beings and start treating them as untrusted compute endpoints.

  1. Determinism: A cryptographic signature is either valid or invalid. There is no "temperature" or "hallucination."
  2. Auditability: Every action is signed. If the system crashes, I can prove exactly which agent authorized the command.
  3. Scale: I can rotate keys for a compromised agent without retraining the entire swarm.

The Future: The "Agent Web"

Right now, agents live in silos. They can't talk to other people's agents because there is no trust layer.

IATP is my proposal for that layer. It allows a "Travel Agent" from Company A to talk to a "Booking Agent" from Company B securely, negotiating capabilities and payments without exposing internal prompts.

Stop building chatbots. Start building secure distributed systems.

Code & Specs:

Top comments (0)