The open governance framework for autonomous AI agents.
Classify decisions. Enforce policies. Prove compliance.
Quick Start • Why This Exists • Documentation • Contributing • gouvernance.ai
AI agents are making decisions autonomously — selecting vendors, sending communications, accessing personal data, even modifying their own behavior. But no one can answer these questions:
- Which agents are authorized to make which decisions?
- When is human approval required?
- How do you trace the chain of responsibility when something goes wrong?
- How do you prove regulatory compliance to an auditor?
- How do you detect unauthorized self-modification?
Existing observability tools (Langfuse, LangSmith, OpenTelemetry) tell you what happened technically. ADP tells you whether it should have happened at all.
ADP is not an observability tool. It's the governance layer that sits on top of observability to answer: Are my agents acting within policy? Am I compliant?
The Agent Decision Protocol is an open standard that defines how to document, classify, and govern decisions made by autonomous AI agents.
┌─────────────────────────────────────────────────────────┐
│ gouvernance.ai │
│ ┌──────────────┐ ┌───────────────┐ ┌────────────────┐ │
│ │ Agent │ │ Policy │ │ Compliance │ │
│ │ Registry │ │ Engine │ │ Dashboard │ │
│ └──────┬───────┘ └──────┬────────┘ └───────┬────────┘ │
│ │ │ │ │
│ ┌──────┴────────────────┴───────────────────┴────────┐ │
│ │ ADP Core (this specification) │ │
│ │ │ │
│ │ • Autonomy Taxonomy • Decision Classification │ │
│ │ • Trace Format • Authorization Matrix │ │
│ │ • Policy Schema • Regulatory Mapping │ │
│ │ • Agent Registry │ │
│ └────────────────────────┬────────────────────────────┘ │
└───────────────────────────┼───────────────────────────────┘
│ Connectors
┌───────────────┼───────────────┐
│ │ │
┌─────┴─────┐ ┌─────┴──────┐ ┌─────┴─────┐
│ Langfuse │ │OpenTelemetry│ │ LangSmith │
└───────────┘ └────────────┘ └───────────┘
│ │ │
┌─────┴───────────────┴───────────────┴──────┐
│ AI Agent Infrastructure │
│ CrewAI · LangGraph · AutoGen · Custom │
└─────────────────────────────────────────────┘
Interactive architecture diagram (click to expand)
graph TD
subgraph Platform["gouvernance.ai"]
L["Agent Registry UI"]
M["Policy Engine"]
N["Compliance Dashboard"]
end
subgraph ADP["ADP Core — this specification"]
E["Autonomy Taxonomy<br/>A1–A5"]
F["Decision Classification<br/>4 types × 4 risks"]
G["Trace Format<br/>SHA-256 hash-chained"]
H["Authorization Matrix"]
I["Policy Schema<br/>6 templates"]
J["Regulatory Mapping<br/>6 frameworks"]
K["Agent Registry"]
end
subgraph Connectors["Observability Connectors"]
B["Langfuse"]
C["OpenTelemetry"]
D["LangSmith"]
end
subgraph Infra["AI Agent Infrastructure"]
A["CrewAI · LangGraph · AutoGen · Custom"]
end
A --> B & C & D
B & C & D --> ADP
ADP --> Platform
style Platform fill:#1a56db,stroke:#3b82f6,color:#fff
style ADP fill:#7c3aed,stroke:#8b5cf6,color:#fff
style Connectors fill:#374151,stroke:#6b7280,color:#fff
style Infra fill:#1f2937,stroke:#4b5563,color:#fff
| Component | Description | Spec |
|---|---|---|
| Autonomy Taxonomy | 5 standardized levels of agent autonomy (A1–A5) | View → |
| Decision Classification | 4 decision types × 4 risk levels × 3 reversibility classes | View → |
| Trace Format | Hash-chained event schema for immutable decision logging | View → |
| Authorization Matrix | Rules determining when human approval is required | View → |
| Policy Schema | Pre-built governance rules mapped to regulations | View → |
| Regulatory Mapping | How ADP maps to EU AI Act, Loi 25, NIST, ISO, Singapore MGF | View → |
| Agent Registry | Structured inventory of all AI agents in an organization | View → |
npm install # requires Node.js 20+import { AgentRegistryBuilder } from '@adp/core';
const agent = new AgentRegistryBuilder()
.agentId('agent-billing-001')
.name('Billing Reconciliation Agent')
.description('Reconciles monthly billing discrepancies')
.autonomy('A3', ['D1', 'D2'], 'R2')
.owner({ name: 'Finance Team', email: 'finance@company.com' })
.build();import { classify, authorize } from '@adp/core';
const code = classify('D2', 'R2', 'partial');
// → "D2-R2-partial"
const result = authorize('A3', 'D2');
// → { result: "authorized", overrideApplied: false, reasons: [] }import { TraceEventBuilder } from '@adp/core';
const trace = new TraceEventBuilder()
.agentId('agent-billing-001')
.eventType('decision')
.decision({
type: 'D2', risk_level: 'R2', reversibility: 'partial',
classification_code: 'D2-R2-partial',
description: 'Selected vendor B over vendor A',
reasoning: 'Vendor B offers 15% lower fees with equivalent SLA',
})
.authorization({ required: false, matrix_result: 'A3 × D2 = AUTHORIZED' })
.withIntegrity()
.build();
// → Complete trace event with auto-generated trace_id, timestamp, and SHA-256 hash D1 D2 D3 D4
Operational Tactical Strategic Self-Modification
┌──────────┬──────────────┬─────────────┬──────────────┬──────────────────┐
│ A1–A2 │ ✅ Authorized │ ⚠️ Approval │ 🛑 Prohibited │ 🛑 Prohibited │
│ A3 │ ✅ Authorized │ ✅ Authorized │ ⚠️ Approval │ 🛑 Prohibited │
│ A4 │ ✅ Authorized │ ✅ Authorized │ ✅ + Review │ ⚠️ Approval │
│ A5 │ ✅ Authorized │ ✅ Authorized │ ✅ + Monitor │ ⚠️ Approval │
└──────────┴──────────────┴─────────────┴──────────────┴──────────────────┘
⚡ Immutable override: D4 (self-modification) ALWAYS requires human approval.
⚡ Risk R3–R4 ALWAYS triggers escalation, regardless of matrix.
import { PolicyBuilder } from '@adp/core';
const policy = new PolicyBuilder()
.policyId('POL-COM-001')
.name('External Communication Control')
.category('communication')
.severity('high')
.rule({
condition: { action_type: 'external_communication', autonomy_levels: ['A1','A2','A3','A4','A5'] },
requirement: 'human_approval',
max_response_time: 'PT1H',
})
.regulatoryMapping(['loi25_art12', 'eu_ai_act_art14'])
.build();import { validateTrace, validatePolicy, validateAgentRegistry } from '@adp/core';
const result = validateTrace(traceData);
if (!result.valid) console.error(result.errors);ADP includes an MCP (Model Context Protocol) server that lets Claude and other AI assistants use governance tools directly.
Add to your claude_desktop_config.json:
{
"mcpServers": {
"adp-governance": {
"command": "npx",
"args": ["tsx", "src/mcp/index.ts"],
"cwd": "/path/to/agent-decision-protocol"
}
}
}| Tool | Description |
|---|---|
adp_classify |
Classify a decision (D1-D4 type, R1-R4 risk, reversibility) |
adp_authorize |
Check authorization via 5x4 matrix with risk overrides |
adp_evaluate_policy |
Evaluate governance policies against an action context |
adp_log_trace |
Log a decision with automatic hash chain integrity |
adp_validate |
Validate JSON against ADP schemas |
adp_register_agent |
Register an agent in the session registry |
adp_add_policy |
Add a governance policy |
adp_verify_chain |
Verify trace chain SHA-256 integrity |
| Resource | URI | Content |
|---|---|---|
| Agent Registry | adp://registry |
All registered agents |
| Policies | adp://policies |
Active governance policies |
| Traces | adp://traces |
Recent decision trace events |
| Matrix | adp://matrix |
Authorization matrix configuration |
| Specs | adp://specs/{name} |
ADP specification documents |
| Level | Name | Description | Human Role |
|---|---|---|---|
| A1 | Operator | Executes specific step-by-step commands | Full direction |
| A2 | Collaborator | Assists human decisions with recommendations | Approval per action |
| A3 | Consultant | Provides analysis and recommendations, human decides | Decision-maker with agent input |
| A4 | Delegate | Acts autonomously, human reviews after the fact | Post-action review |
| A5 | Autonomous | Fully autonomous operation, human monitors | Monitoring & kill switch |
Every agent decision is classified on 3 axes:
Type — What kind of decision?
- D1 Operational: Task execution within defined scope (API call, DB query)
- D2 Tactical: Choice between approaches (vendor selection, prioritization)
- D3 Strategic: Significant organizational impact (client communication, financial commitment)
- D4 Self-Modification: Agent modifying its own behavior or parameters
Risk — What's the potential impact?
- R1 Negligible: Reversible, no sensitive data, limited scope
- R2 Moderate: Potential operational impact, partially reversible
- R3 Elevated: Direct impact on people or critical operations
- R4 Critical: Irreversible, fundamental rights, critical infrastructure
Reversibility — Can it be undone?
- Total: Fully reversible with no consequences
- Partial: Partially reversible with reasonable effort
- Irreversible: Cannot be undone once executed
ADP is designed to satisfy multiple regulatory frameworks simultaneously:
| Regulation | Jurisdiction | Status | ADP Coverage |
|---|---|---|---|
| Quebec Law 25 | 🇨🇦 Canada/QC | Enacted | Decision traceability, right to explanation, notification |
| EU AI Act | 🇪🇺 Europe | Enacted (phased) | Risk management, documentation, human oversight, registry |
| NIST AI RMF | 🇺🇸 USA | Published | All 4 functions: GOVERN, MAP, MEASURE, MANAGE |
| ISO 42001 | 🌍 International | Published | Management system, risk, documentation, improvement |
| Singapore MGF | 🇸🇬 Singapore | Published (Jan 2026) | Autonomy levels, accountability, technical controls |
| IEEE 7001 | 🌍 International | Published | Transparency levels, measurable standards |
| ADP Component | Loi 25 | EU AI Act | NIST RMF | ISO 42001 |
|---|---|---|---|---|
| Agent Registry | — | Art. 49 | GOVERN | A.6 |
| Risk Classification | — | Art. 6-7 | MAP | A.5 |
| Decision Traceability | Art. 12.1 | Art. 12 | MEASURE | A.7 |
| Right to Explanation | Art. 12.1 | Art. 13 | GOVERN | A.8 |
| Human Oversight | Implicit | Art. 14 | MANAGE | A.9 |
| Risk Management | — | Art. 9 | MAP+MANAGE | A.5 |
| Post-deployment Monitoring | — | Art. 72 | MEASURE | A.10 |
ADP uniquely addresses self-modification governance — no existing regulation explicitly covers an agent's ability to modify its own behavior. ADP classifies all self-modification as D4 with mandatory human approval.
agent-decision-protocol/
├── README.md ← You are here
├── package.json ← @adp/core v0.3.0 (ESM)
├── tsconfig.json ← TypeScript strict config
├── vitest.config.ts ← Test runner config
├── LICENSE ← Apache 2.0
├── CHANGELOG.md ← Version history
├── docs/
│ ├── README.md ← Documentation index
│ └── specs/
│ ├── 01-autonomy-taxonomy.md
│ ├── 02-decision-classification.md
│ ├── 03-trace-format.md
│ ├── 04-authorization-matrix.md
│ ├── 05-policy-schema.md
│ ├── 06-regulatory-mapping.md
│ ├── 07-agent-registry.md
│ └── schemas/ ← JSON Schema validation (v0.2)
│ ├── common.schema.json
│ ├── trace-format.schema.json
│ ├── policy-schema.schema.json
│ ├── agent-registry.schema.json
│ └── authorization-matrix.schema.json
├── examples/ ← Schema-validated integration examples
│ ├── register-agent.json
│ ├── log-decision.json
│ ├── define-policy.json
│ └── trace-self-modification.json
├── src/ ← TypeScript reference implementation
│ ├── index.ts ← Public API exports
│ ├── types/ ← TypeScript interfaces & enums
│ ├── core/ ← classify, authorize, evaluatePolicy, hash
│ ├── validators/ ← AJV-based schema validators
│ ├── builders/ ← Fluent API builders
│ ├── mcp/ ← MCP server (v0.3)
│ │ ├── index.ts ← Entry point (STDIO transport)
│ │ ├── server.ts ← Tool & resource registration
│ │ ├── store.ts ← In-memory session store
│ │ ├── types.ts ← Zod input schemas
│ │ ├── tools/ ← 8 tool handlers
│ │ └── resources/ ← 5 resource handlers
│ ├── __tests__/ ← 90 tests (vitest)
│ └── scripts/ ← CI validation script
├── assets/ ← Logo, diagrams
└── .github/ ← CI, issue templates, funding
└── workflows/
└── validate-schemas.yml ← tsc + vitest + schema validation
- v0.1 — Core specification (7 technical documents)
- v0.2 — JSON Schema validation + TypeScript reference implementation (60 tests)
- v0.3 — MCP server reference implementation (8 tools, 5 resources, 90 tests)
- v0.4 — Langfuse / OpenTelemetry connectors
- v1.0 — Stable specification + governance platform beta
See the CHANGELOG for detailed version history.
Building with ADP? Open a PR to add your organization here.
Be the first to adopt ADP and get featured in this section.
| ADP | Langfuse | LangSmith | Datadog LLM | Credo AI | |
|---|---|---|---|---|---|
| Focus | Governance & compliance | Observability | Observability | Monitoring | Model governance |
| Agent autonomy levels | ✅ A1–A5 taxonomy | ❌ | ❌ | ❌ | Partial |
| Decision classification | ✅ 4 types × 4 risks | ❌ | ❌ | ❌ | ❌ |
| Authorization matrix | ✅ With escalation | ❌ | ❌ | ❌ | ❌ |
| Policy engine | ✅ 6 templates | ❌ | ❌ | ❌ | Partial |
| Self-modification detection | ✅ D4 category | ❌ | ❌ | ❌ | ❌ |
| Regulatory mapping | ✅ 6 frameworks | ❌ | ❌ | ❌ | Partial |
| Vendor-independent | ✅ Open standard | ✅ | ❌ LangChain | ❌ Datadog | ❌ |
| Open source | ✅ Apache 2.0 | ✅ | ❌ | ❌ | ❌ |
ADP complements observability tools — it doesn't replace them. Use Langfuse/LangSmith for technical tracing. Use ADP for governance, compliance, and policy enforcement.
We welcome contributions! ADP is an open standard and benefits from community input.
Issues labeled good first issue are great starting points for new contributors.
- 🌐 gouvernance.ai — Commercial governance platform
- 📖 White Paper (FR/EN) — Founding document
- 💬 Discussions — Questions and ideas
GitHub provides a "Cite this repository" button in the sidebar (powered by CITATION.cff).
@misc{adp2026,
title = {Agent Decision Protocol: An Open Governance Framework for Autonomous AI Agents},
author = {Bromberger, Florian},
year = {2026},
url = {https://github.com/OpenAgentGovernance/agent-decision-protocol},
note = {Version 0.3.0}
}Apache 2.0 — Free for commercial and non-commercial use.
Built by gouvernance.ai — The compliance platform for autonomous AI agents.
ADP is vendor-independent and framework-agnostic by design.