Agent Privacy-Preserving Protocol (AP3)
What is AP3?
Agent Privacy-Preserving Protocol (AP3) is an open protocol in research preview for privacy-preserving collaboration between autonomous agents, extending the Agent2Agent (A2A) protocol, designed to solve a critical challenge in the emerging agentic communication:
How can AI agents collaborate on sensitive computations while maintaining data confidentiality and competitive advantage?
Traditional agent communication requires data sharing, which creates risks:
- Competitive Intelligence Leakage: Proprietary algorithms, cost structures, and business strategies could be exposed
- Regulatory Compliance Issues: Data sharing may violate privacy regulations like GDPR and CCPA
- Trust Barriers: Parties are reluctant to collaborate without cryptographic privacy guarantees
AP3 addresses these challenges by providing a standardized framework for AI agents to perform privacy-preserving computation using advanced cryptographic techniques. The protocol is available as an extension for the open-source Agent2Agent (A2A) protocol, with more integrations in progress.
Build agents with
ADK
(or any framework), equip with
MCP
(or any tool), collaborate via
A2A, and use
AP3 for secure collaboration between AI agents.
About the acronym
AP3 (pronounced "A-P-three") stands for Agent Privacy-Preserving Protocol, where each letter represents the first capital letter of each word: Agent, Privacy, Preserving, Protocol. The protocol is commonly referred to as AP3 for brevity.
Try it now
Want to see AP3 in action without cloning anything? AP3 Playground runs a live PSI flow in the browser and renders an inspector view of agent cards, on-wire envelopes, signed directives, and the audit timeline.
How AP3 fits with neighboring standards
AP3 is intentionally narrow: it owns the privacy-preserving compute lane. Most real agentic workflows also need identity, credentials, payments and discovery — those are owned by other standards. AP3 is designed to compose with them, not replace them.
AP2 and AP3
- AP2 is the payment-focused protocol in the Agent2Agent ecosystem. It facilitates settlement, value transfer, and other financial primitives between agents.
- AP3 is a privacy-preserving collaboration protocol that lets agents jointly compute on sensitive data without revealing it.
- Use them together: AP2 handles payments, AP3 handles collaborative computation when parties need cryptographic privacy guarantees. A typical flow: AP3 produces a verifiable result (e.g. "candidate is not blacklisted"), AP2 settles the fee that the receiving agent charges for participating.
Build with AP3
AP3 is released in its research preview, and the shape of the protocol will continue to evolve as it meets real-world use cases. We have meaningful work ahead to make it easier to adopt. But we believe AP3 represents a fundamental step forward in how privacy between AI agents should be approached — and in the ergonomics of designing cross-organizational computation into agent communication, rather than retrofitting it later.
AP3 will be continuously evolving and we actively seek your feedback and contributions to help build the future of privacy-preserving agent collaboration.
The complete technical specification, documentation, and reference implementations are hosted in our public GitHub repository.
You can contribute to the project by opening an issue or submitting a pull request.