Algorand Foundation has introduced AC2, an open protocol designed to give AI agents cryptographically verifiable approval for sensitive actions without handing them the credentials needed to execute those actions independently. In its official AC2 announcement, Algorand describes potential uses ranging from payments and code deployments to API authorization. The core design separates an agent’s ability to request an action from the user’s authority to approve it.
When an agent needs authorization, AC2 sends the request to the user’s wallet or application, where the specific action can be reviewed and signed. The resulting authorization is returned to the agent, while the underlying private credential remains under the user’s control. That architecture is intended to limit the damage possible if an AI agent’s runtime, session tokens or software dependencies are compromised.
AC2 Uses Passkeys to Create Verifiable Approvals
AC2 relies on three existing technologies: DIDComm v2 for message formatting, WebAuthn/FIDO2 for authentication and WebRTC DataChannel for encrypted peer-to-peer communication. Algorand says approvals use hardware-bound passkey signatures, creating a cryptographic record that can establish what action was authorized rather than depending on a message or confirmation button inside a chat session. The result is an approval trail tied to a specific signing request rather than a broadly reusable credential.
The security model draws on authentication technology used well beyond crypto. The U.S. National Institute of Standards and Technology has described properly implemented passkeys using WebAuthn and related standards as phishing-resistant authenticators. Separately, the World Wide Web Consortium’s WebAuthn specification defines public-key credentials that are scoped to specific relying parties and protected by authenticators. Those established standards provide the authentication foundation on which AC2 builds its agent-specific approval layer.
Algorand says the protocol establishes a direct encrypted connection between an agent and the user’s wallet after the initial handshake. Credentials such as API keys do not need to be injected into the agent runtime; instead, the agent receives authorization for the requested operation. This shifts the security model from protecting secrets inside autonomous software toward keeping those secrets outside the agent altogether.
Delegated Authority Is the Next Step
The initial AC2 implementation uses individual approval prompts, meaning users remain involved whenever a signature is required. Algorand plans to extend the model with delegated permissions that would let users define limits in advance, allowing agents to operate autonomously within those boundaries while requesting fresh approval when they move outside them. That progression targets one of the central challenges of agentic software: increasing autonomy without granting unrestricted authority.
AC2 is blockchain-agnostic and has been released with an open specification, reference implementation, wallet proof of concept and agent plugin. Algorand also credits Pera Wallet alongside the Foundation in developing the protocol. The release should therefore be viewed as an early security framework for agent authorization rather than evidence that delegated AI workflows have already achieved broad adoption. Its relevance will depend on whether wallets, agent platforms and developers adopt the standard across real production environments.