For people who know the web
Mapped to PKI & the web
OpenA2A invents very little. Almost every piece corresponds to something that already secures the internet. If you know how a padlock works, you already know most of this, here is the dictionary.
The whole system in one table
- [1] Today the reference resolver returns the registry's signing key for every DID, not the agent's own key, and a registry assigns names directly, with no delegation like DNS zones.
- [2] AIM, the reference implementation, does not serve the challenge endpoint AIP defines; the Go and Python conformance verifiers check the transcript, and an ATX on its own proves no key possession.
- [3] Under 60 seconds is the ATP delivery budget, not measured behavior: the reference registry today has no peer push; verifiers poll its lists, an hourly signed CRL and the ATP revocation list, which is unsigned.
ATX is a TLS certificate, almost literally
The clearest analogy in the whole family. A TLS certificate is a signed statement, issued by a CA, that a given public key belongs to a given domain, and your browser checks it locally without phoning the CA on every page load. ATX is the same artifact for agents, with a few deliberate upgrades:
ATP's log is Certificate Transparency
After a CA mis-issued certificates, the web added Certificate Transparency: every certificate is written to a public, append-only Merkle log that independent monitors audit, so mis-issuance cannot stay hidden. ATP adopts this directly, same RFC 6962 tree, same Signed Tree Heads, same inclusion and consistency proofs, for trust assertions about agents.
Why this matters for agents specifically
Trust you cannot audit is trust you have to take on faith. Under ATP, granting a malicious agent a high trust level leaves a public log entry with an inclusion proof, rather than a private database row. Issuance and revocation events are appended to an RFC 6962 Merkle log; the Registry publishes signed tree heads and inclusion and consistency proofs that anyone can fetch and check; no monitor outside OpenA2A runs today.AAP is OAuth, with the secret amputated
OAuth token exchange (RFC 8693) lets one party swap an identity assertion for a narrowly-scoped access token. AAP's broker does exactly that, but adds the rule OAuth never needed, because OAuth clients aren't language models: the resulting token must never reach the agent. The agent gets the result of the action; the broker keeps the credential behind a trust boundary.
Where the analogy breaks (on purpose)
- Certificates don't describe behavior. ATX does, because an agent's risk is in what it does, not just who it is.
- OAuth assumes the client can hold a token. AAP assumes the opposite, because a persuadable model is a leaky vault.
- Web identity is per-domain. Agent identity is per-build, bound to a content hash, so a tampered binary fails verification.
Everywhere else, the lesson is the same: this is the web's own security model, carefully re-aimed at software that thinks.