Agent Privacy-Preserving Protocol (AP3) is an open protocol that enables distributed collective intelligence, without sacrificing confidentiality and regulatory posture. Collective intelligence here means the capacity of autonomous agents, tools, humans, and institutions to reason jointly and accumulate shared context across organizational, jurisdictional, and vendor boundaries.

💡 Documentation: https://ap3-protocol.org

Individually capable agents are already here; what the ecosystem lacks is a substrate on which they can think and act together in a privacy preserving way. AP3 provides that layer to the existing stack. It is delivered as an extension to the open Agent2Agent (A2A) protocol in communication, integrates with Google Agent Development Kit (ADK) at the build stage and will expand support to other agentic frameworks.

AP3 is being designed to support most common inter-agent communication protocols including the Agent Communication Protocol (ACP, originated by IBM, hosted at the Linux Foundation under the Agentic AI Foundation), the Agent Gateway Protocol (AGP / SLIM, originated by Cisco, hosted at the Linux Foundation under AGNTCY), and emerging decentralized protocols such as the Agent Network Protocol (ANP, originated by the open-source ANP community).

Its cryptographic core - Secure Multi-Party Computation (SMPC) for privacy preserving compute, supplemented by Trusted Execution Environment (TEE) attestation for execution integrity, would turn cross-boundary collaboration into a verifiable, policy-bound computation rather than an implicit trust assumption. Collective agentic and human context thereby becomes a cryptographically guaranteed intelligence layer.

AP3 aims to address a core question in multi-agent systems (MAS):

Once multi-agent workflows span more than one trust domain, the engineering problem is no longer interoperability but governed execution: how do agents jointly compute, reason and collectively innovate over sensitive inputs, context graphs, and memory. In doing so each participant's data remains confidential, every contribution to the output is cryptographically attributable, and the computation is verifiable without a single trusted intermediary.