EMILIA Protocol

Let your agent prepare the payment. Control what it can release.

An agent prepares an $82,000 supplier payment. Someone approves it. Then the amount or bank destination changes. The earlier approval must not release the changed payment.

EMILIA Gate checks authority before a protected tool runs. The open protocol makes the resulting evidence independently checkable under the verifier's own trusted keys and rules. Keep your existing identity provider, agent framework, and business systems.

Run the payment example

With Node.js 20.19 or newer and npm installed:

git clone https://github.com/emiliaprotocol/emilia-protocol.git
cd emilia-protocol
npm ci
FAST=1 node examples/mcp/payment-server.mjs

The example refuses a call without approval, binds approval to the amount, currency, vendor, and destination, admits the matching call once, and refuses changed payment details, replay, and forged evidence. See the example and its limits.

This is a local demonstration: generated signing keys, in-memory consumption, and a mock payment tool. It does not perform a real human ceremony or move money. Production needs enrolled credentials, durable shared state, and Gate on every path to the protected provider credential. A valid approval does not establish that the bank details are legitimate.

Prefer a browser? Try a passkey on a sample payment. That separate demo shows receipt integrity with your platform authenticator; no payment is sent.

Protect one tool you already use

Start at the service that holds the real provider credential, not only inside the agent's process. The owner defines the allowed work and when a fresh approval is required. An agent can work inside those limits without a person approving every call.

• MCP or HTTP: Gate Starter walks through one covered action.
• Hugging Face smolagents: wrap an existing tool.
• GitHub: Merge Gate binds a check to the proposed merge. The check must be required and alternate merge paths closed.

Protocol proves. Gate prevents on the paths the deployment completely mediates. Gate cannot constrain a bypass path. If a provider's result is unknown, the production lifecycle preserves that uncertainty for reconciliation rather than blindly retrying.

AI systems and repository reviewers: start with AI_CONTEXT.md. Current machine-readable evidence, provenance, assumptions, and exclusions are published at EMILIA-REPO-CONTEXT-v1. Archived or staged documents do not establish current implementation or IETF status. Public due-diligence evidence and claim boundaries: DUE_DILIGENCE.md.

Engineering evidence, not architecture claims