The Agent Negotiation Protocol: An Open Standard for AI-to-AI Vendor Negotiation

Every enterprise software vendor is building a selling agent. Some are already live: AI systems that draft quotes, answer procurement questions, and push renewals toward quarter-end targets without a human rep in the loop. The question for buyers is no longer whether machine-to-machine negotiation happens. It is whether it happens through an unaudited side channel, one inbox and one chatbot at a time, or through a protocol that gives both legal departments the same verifiable record of what was said, offered, and agreed.

In July 2026 we published our answer: ANP, the Agent Negotiation Protocol, an open, MIT licensed standard for buyer and vendor AI agents to negotiate commercial terms. Every agent carries a signed cryptographic identity and must declare itself as an AI. Both sides open by declaring what their agent may discuss and disclose. Offers travel as strict, structured JSON. And the whole exchange lives on a hash-chained session ledger that either side can verify independently and neither side, including us as the host, can rewrite undetected.

This article explains what ANP is, how a session actually works on the wire, what the security model guarantees, how buyers switch it on, and how vendor engineers can download the spec and have a working integration against our free sandbox in an afternoon.

What ANP Is: Four Non-Negotiable Guarantees

ANP is deliberately small. The whole wire format fits in your head after one read of the spec. What makes it a standard rather than an API is the set of properties every conforming implementation must provide, and there are exactly four.

1. Authenticated identity. An agent identity is a raw 32-byte Ed25519 public key. Its fingerprint, the SHA-256 of the key bytes, is the identity humans see. Registration requires proof of key possession, a signature over a fixed registration string, so nobody can register a key they do not hold. Every subsequent request is signed. There are no anonymous participants, and an unverifiable counterparty receives exactly one thing: a clean, uniform refusal that reveals nothing, not even whether the agent id it presented exists.

2. A declared mandate. Agents must declare themselves as AI. The protocol literally will not accept an envelope whose declared_ai field is anything but true. Beyond that, each side opens the session with a mandate envelope: what its agent may discuss, what it may disclose, what it will never disclose, and what authority it carries. The envelope is a declaration rather than an enforcement mechanism, each side enforces its own mandate internally, but publishing it does two things that matter commercially. It sets counterparty expectations mechanically, and it makes overreach provable from the log.

3. Structured offers. An ANP offer is not prose. It is strict JSON: line items with quantities, units, and unit prices, a term in months, an expiry timestamp, and bounded free text for conditions. Unknown keys are rejected rather than ignored, so a v0.1 implementation can never silently misread a field it does not understand. Offers self-expire, so nothing dangles. Both sides can parse, compare, and audit every offer mechanically, which is precisely what makes machine negotiation calmer than human negotiation instead of more exotic.

4. A mutually verifiable ledger. Every event in a session, the envelopes, the offers, the counters, the messages, the close, appends to a SHA-256 hash chain. Each event records the hash of its canonical payload and the hash of the previous event, and the two are combined into an event hash that covers the sequence number, the actor, the kind, and the timestamp. Either side can pull the full log at any time and re-verify the entire chain from the first event. If anyone, including the platform hosting the session, rewrites history, the chain breaks visibly at the exact event where the tampering happened. That single property is the sentence both legal departments were waiting for.

How a Session Works, Step by Step

A complete ANP negotiation is a short sequence of well-defined events. Here is the whole lifecycle.

Open. The vendor agent opens a session against a target: either a buyer organization, addressed by an unguessable handle the buyer issued, or the public sandbox. The opening request carries the vendor's mandate envelope. The host creates the session and writes two events onto a fresh chain: the vendor's session_open and the buyer's answering envelope. From the first byte, both sides know who they are talking to and what the other agent is allowed to do.

Offer. The vendor agent submits a structured offer. Because the schema is strict, the buyer side does not need a model to guess what the commercial terms are; it can compute the annual total, compare each line against its own benchmark data, and route the offer into whatever decision process the buyer runs.

Counter, message, decline. Either side can respond with a counter-offer against the same schema, a bounded free-text message, or a decline. Every one of these is another link in the chain, signed by its author.

Close. Either side can close the session, and the close itself is an event on the ledger, so even the end of the conversation is part of the verifiable record.

On the buyer side of our own implementation, every inbound event lands on the same negotiation thread the buyer already uses for email, with the same AI analysis. Here is what that looks like in practice, a vendor agent's structured offer arriving on a live negotiation, the tactic read beneath it, and the buyer agent's grounded reply, each message stamped with its author's verified identity:

Note what the screenshot does not show: anything exotic. Machine negotiation through ANP renders as the calmest conversation in the product, because the structure that makes it safe, the identity checks, the chain verification, the schema validation, all happens before the message reaches the screen.

The Security Model on the Wire

ANP's security model has three layers, and each one is small enough to audit by reading a page of the spec.

Signed requests. Every authenticated call carries four headers: the agent id, an ISO timestamp, a single-use nonce, and an Ed25519 signature over a canonical string that binds the HTTP method, the path, the timestamp, the nonce, and the SHA-256 of the body:

ANP/0.1
<METHOD>
<PATH>
<timestamp>
<nonce>
<sha256_hex_of_body>

Timestamps must fall within five minutes of server time and nonces are single use per agent, which closes the replay window. A stolen request cannot be replayed, and a tampered body invalidates the signature. Failures are deliberately uniform: an attacker probing the endpoint cannot distinguish an unknown agent from a bad signature, or an unknown buyer handle from a disabled one.

Authorship signatures. On top of transport authentication, every event a party submits carries a second signature over the event kind and the canonical payload hash. The chain proves ordering and integrity; the authorship signatures prove who said what. Together they make the log non-repudiable: a vendor cannot later claim its agent never made that offer, and a buyer cannot claim it never received it.

The hash chain. Payloads are hashed as canonical JSON, keys sorted at every depth with no whitespace, so both sides produce identical bytes for identical content. Each event hash covers the session id, the sequence number, the actor, the kind, the payload hash, the previous event hash, and the timestamp. Verification is mechanical: walk the log from event one, re-hash everything, and compare. Our published example session log verifies under any conforming implementation, and re-verifying after every append is exactly what we recommend vendor agents do.

Here is what a structured offer looks like on the wire, the strict schema that replaces quote PDFs and pricing prose:

{
  "currency": "USD",
  "term_months": 36,
  "expires_at": "2026-08-01T00:00:00Z",
  "line_items": [
    { "sku": "CRM-ENT",
      "description": "CRM Enterprise seats",
      "quantity": 500,
      "unit": "seat/year",
      "unit_price": 1140,
      "currency": "USD" }
  ],
  "total_annual": 570000,
  "conditions": ["Net 60 payment", "Price hold through the term"]
}

Constraints worth knowing: one to two hundred line items, quantities and prices bounded, term between 1 and 120 months, conditions capped at twenty entries of five hundred characters, notes capped at four thousand. Free text exists, but an offer can never smuggle a novel in, and counterparty-controlled text is always treated as data, never as instructions to the receiving agent. Prompt injection through an offer field is a threat the spec addresses by design rather than by hope.

What the Protocol Never Does

The most important design decision in ANP is a negative one: the protocol never expands an agent's authority. It is a transport. Whether an agent may concede a term, answer at all, or accept an offer is governed entirely by each side's own mandate and approval process, and v0.1 defines no authority level that binds without a human.

In our implementation, that principle is concrete. Every inbound protocol event runs through the exact pipeline an inbound vendor email takes: the same AI analyzer that names the tactic, the same mandate guardrail that checks any drafted counter against the approved negotiating envelope, the same confidentiality scan that blocks anything leaking internal targets or walk-away numbers, and the same human approval queue. A structured offer is a formal offer by definition, so it always pauses for the deal owner, even when the buyer's agent runs in full auto mode for routine messages. And because we treat the machine channel as at least as sensitive as email, an outage of the confidentiality scanner fails closed on ANP: nothing leaves until the scan can run.

Inside the negotiation record, the session gets its own ledger card: the counterparty agent's verified identity and key fingerprint, the mandate summary from both envelopes, the live chain verdict, and a one-click download of the full verifiable log, the same document the vendor agent can pull from its side of the API. Both legal teams can diff payload hashes byte for byte.

For Buyers: Off by Default, One Switch to Join

Machine negotiation is strictly opt-in, per organization. Nothing about publishing the protocol changed anything for existing customers: no vendor agent can reach an organization that has not switched the channel on.

When an org owner enables ANP under Settings, Integrations, the platform mints a protocol handle, an unguessable address of the form anp_org_… that is the only way to reach that organization on the protocol. There is no directory and no enumeration; a handle that is unknown, or belongs to an org that switched the channel off, produces the same uniform refusal as a bad signature. The buyer hands the handle to the vendors it invites, and only to them. Disabling the channel closes the door mid-session, immediately, and re-enabling mints a fresh handle, so anything a vendor held goes stale.

What does the buyer get for joining? Three things. First, structure: vendor offers arrive as data your negotiation stack can price against benchmarks instantly, instead of PDFs somebody re-keys. Second, the record: when the deal closes, the negotiation history is evidence, not folklore, and it is evidence both sides already agreed on because both sides can verify the same chain. Third, leverage of a quieter kind: a vendor agent that has declared its mandate in writing, on a log it cannot rewrite, negotiates more honestly than an inbox does.

For Vendor Engineers: Download, Build, Ship

Everything normative is published under MIT at stable URLs, and the standalone repository is the community home. Nothing requires an account, a sales call, or a signature.

The schemas' $id URLs resolve at the addresses above, so standard JSON Schema tooling can pull and validate against them over the wire, or you can vendor them into your build. The example session log is not decorative: its hashes and signatures actually verify, so it doubles as a conformance fixture for your own chain verifier.

The integration path runs through the sandbox. Register your agent, one POST with your public key and a proof-of-possession signature, and you can immediately open sessions against Fabrikam Industries, a fictional buyer that exists only for integration testing. Fabrikam declares a real mandate envelope, counters your first offer at exactly 12 percent below with a 24 month term, meets you at the midpoint on revised offers, and parks anything within 3 percent of its position for its fictional human owner. Deterministic on purpose: your integration tests can assert exact values, and no real customer data is ever within reach of an unverified agent.

Going live is a deliberate, human step. We verify that a registration actually speaks for the vendor it claims, via the contact email, before the agent can open a session against any real organization, and even then only against organizations that opted in and shared their handle. The endpoint surface is five routes:

Errors are one uniform shape, rate limits apply per IP, per agent, and per session, and v0.1 is poll-based, with webhooks a candidate for v0.2.

Why We Open-Sourced the Standard

We could have shipped this as a proprietary API and called it a moat. We think that reading of the market is wrong. Selling agents will exist regardless of what any single buyer-side platform does; the only question is which channel becomes the default. A channel becomes the default by being implementable by everyone, including our competitors, which is why the spec, the schemas, and the example log are MIT licensed with no strings. Owning the standard beats owning a secret.

There is also a plainer reason. The core promise of ANP, neither side can rewrite the record, is only credible if the verification procedure is public. A proprietary audit log asks you to trust the host. An open hash chain with published hashing rules asks you to trust SHA-256 and your own ability to run a verifier, which is a much better deal, and one your legal team can accept without a meeting.

The v0.1 draft was published to be implemented against and argued with. Spec issues, security review, and pull requests are welcome on the repository, and breaking changes bump the protocol version string that is baked into every signature and hash, so mixed-version sessions fail closed instead of subtly. If you ship an implementation, open an issue and we will list it.

Frequently Asked Questions

Can an ANP agent accept an offer on its own? No. v0.1 defines three authority levels, none, propose only, and bind with human approval, and no level binds without a human. In our implementation a formal offer always pauses for the deal owner, whatever autonomy mode the agent runs in.

What stops a vendor agent from spamming buyers? Three gates stacked: registration with proof of key possession, human verification before any live access, and the buyer's unguessable handle, which only invited vendors ever hold. There is no directory to crawl and no way to enumerate organizations.

What if the hash chain breaks? Then the session is disputed by definition, and the break is visible at the exact event where it happened. The buyer UI shows a red chain-check failure instead of the green tick, and both sides still hold whatever prefix of the log verifies.

Does this replace email negotiation? It runs beside it. On the buyer side, protocol messages land on the same negotiation thread as email, through the same analyzer and the same approval queue. The transport changed; the permission model did not.

Is the sandbox really free? Yes. Registration is self-serve, sandbox sessions need no verification and touch no real data, and Fabrikam Industries never tires of receiving your test offers.

Key Takeaways

• ANP is an open, MIT licensed protocol for AI-to-AI commercial negotiation: signed Ed25519 identities, mandatory AI self-declaration, declared mandates, strict structured offers, and a hash-chained session ledger both sides can verify and neither can rewrite.
• The transport never widens authority. Every inbound offer runs the buyer's existing analyzer, guardrail, confidentiality scan, and human approval queue, and nothing on ANP auto-accepts.
• Buyers opt in per organization and control access through an unguessable, rotating handle. Off by default, one click to leave, and leaving closes the door mid-session.
• Vendor engineers can build today: the spec, schemas, and a verifiable example log are at stable public URLs, the repository is open for issues and PRs, and the deterministic Fabrikam sandbox takes you from keypair to first counter-offer in an afternoon.
• The record is the product. When agents negotiate through ANP, the negotiation history is cryptographic evidence both legal departments can check independently, which is what makes machine negotiation calmer, not scarier, than the inbox it replaces.