TL;DR
- AC2 gives AI agent approvals cryptographic proof through FIDO2 passkey signatures while keeping private keys and API credentials outside compromised runtimes.
- The protocol combines DIDComm v2.0, WebAuthn/FIDO2 and WebRTC DataChannel, with potential uses spanning payments, code deployments, APIs and client communications.
- Algorand plans bounded delegation so agents can act autonomously within signed limits, while the open AC2 specification, wallet implementation and plugin are already available for developers today.
Algorand Foundation and Pera Wallet have introduced AC2, an open protocol designed to secure AI agents when they request sensitive actions such as payments, code deployments or API authorization. The system addresses two weaknesses Algorand says remain common in agent setups: approvals that cannot be cryptographically proven and credentials exposed inside compromised runtimes. The central idea is to separate human intent from agent access, giving every critical approval a verifiable signature without handing over private keys. AC2 uses device-based authorization so users can confirm exactly what an agent is permitted to execute.
AC2 replaces chat approvals with cryptographic proof
When an agent needs a signature, AC2 creates a direct, end-to-end encrypted WebRTC connection with the user’s wallet or application. The user reviews the request on their own device and approves it using a FIDO2 passkey signature tied to hardware such as a Secure Enclave or TPM. That turns approval from a message or button press into an auditable cryptographic record of who authorized what and when. The agent receives delegated authorization, but the private key and API credentials never leave the user’s control, reducing exposure if the agent runtime is compromised.
The protocol combines three open standards: DIDComm v2.0 for message formatting, WebAuthn/FIDO2 for authentication and WebRTC DataChannel for peer-to-peer transport after the initial handshake. Algorand says a basic AC2 flow can be implemented in roughly 50 lines and does not require containers, messaging SDKs or credential proxies. Its design aims to strengthen existing agent workflows rather than replace them with a proprietary stack. Potential uses include signing code deployments, approving client communications, authorizing API access, confirming x402 payments and defining AP2 IntentMandates that set cryptographically enforced limits for autonomous actions.
AC2 currently asks users to approve every signature, but its next iteration is expected to introduce bounded delegation. Users would define limits once, allowing agents to act independently within those constraints while requiring fresh approval outside them. The next phase shifts AC2 from repeated confirmation toward controlled autonomy without giving agents possession of user keys. The specification is already live and open, with a reference AC2 Wallet implementation available alongside a plugin. Algorand says any agent platform or identity wallet should ultimately be able to communicate through AC2 without custom approval systems or exposed credentials across financial, technical and other high-risk agent workflows today.
