Runtime performance
APS is measured at four layers, from the raw verifier core to a full gateway authorization round-trip, on three environments. Bare-metal Linux (AMD EPYC 7313P) is the canonical reference; Apple M3 and AWS c7i (Intel Xeon 8488C) are shown for range. Core layers run single-threaded over 1,000,000 iterations, the gateway round-trip over 1,000. Both p50 (median) and p99 (tail) are reported.
| Layer | What it measures | Mac M3 | AWS c7i | EPYC (canonical) | p99 (EPYC) |
|---|---|---|---|---|---|
| L0 · verifier core | signature and delegation-chain check, hot cache | 292ns | 347ns | 420ns | 470ns |
| L2 · SDK call | the same check as your code calls it, through N-API | 3.9µs | 5.7µs | 6.5µs | 8.1µs |
| L3 · durable | the call plus a persisted audit record (queued commit) | 4.0µs | 6.7µs | 7.6µs | 13.2µs |
| L4 · gateway round-trip | full authorization across the enforcement boundary | 305µs | 1.07ms | 822µs | 6.0ms |
The fast-reject deny path matches L0 within noise. A synchronous fsync per action, instead of queued commit, is disk-bound: about 1.3ms on server SSD. Durability and round-trip tails are environment-dependent.
Reproduce it: per-environment results and env_capture.json live in benchmarks/prototype-1/results/ in the SDK repo. The TS SDK via napi-rs adds approximately 13-16x latency over pure Rust on all three platforms tested. Receipt minting happens inside the measured L4 round-trip.
Full enforcement stack
The L4 figure above is the lean round-trip. The product gateway does more on every call: cascade revocation, escalation checks, charter governance, settlement, drift detection. Measured against that full stack:
| Operation | Latency | Notes |
|---|---|---|
| Policy evaluation p50 | <2ms | full constraint check across all applicable facets |
| Policy evaluation p99 | <10ms | cold cache, worst case |
| Denial | <1ms | fail-fast on the first failing facet |
Full-stack figures from the gateway benchmark suite, 500 iterations per scenario.
Constraint dimensions
Every action is evaluated against all applicable dimensions. The gateway short-circuits on the first failure, which is why denial is sub-millisecond.
Time
Approval TTL and delegation expiry
Spend
Per-action and cumulative limits, delegation budget
Scope
Tool name, parameter patterns, target restrictions
Reputation
Tier threshold, minimum evidence count
Values
Values floor F-001 through F-008, graduated enforcement
Revocation
Delegation revoked, cascade revocation
Reversibility
Tentative, compensable, or irreversible classification
Governance
Governance artifact version, stale attestation
Identity
Passport verification, signature validity
Replay
Request ID reuse detection
Cross-chain
Taint tracking, confused-deputy prevention
Audience
Proof bound to a named recipient
Escalation
Bounded escalation grant validity
Fidelity
Substrate behavioral fidelity
Data
Data source access terms, contribution tracking
Architecture
The gateway is both judge and executor. The agent requests an action. The gateway evaluates all constraints, executes the action if permitted, and generates the receipt. Agents never touch tools directly. Enforcement is applied at the gateway rather than left to the agent.
| Component | Count | Notes |
|---|---|---|
| Protocol modules | 107 | 84 core + 23 v2 constitutional |
| MCP tools | 150 | Full protocol surface via MCP |
| Tests | 4,326 | Including adversarial + invariant suites |
| Research papers | 8 | Published on Zenodo |
How it compares
APS is the governance layer under orchestration frameworks, not a replacement for them. The dedicated comparison lives on the compare page.
Test Coverage
4,326 tests across 107 modules. The test suite includes unit tests, integration tests, adversarial scenarios (replay attacks, confused deputies, scope escalation), invariant checks (monotonic narrowing, cascade completeness), and stress tests (concurrent gateway load).
Among the suite are the cross-implementation conformance fixtures: canonical-JSON vectors that any verifier, in any language, can run to confirm byte-parity against the spec. Those are the tests that make receipts portable.
Independently cited by PDR in Production (University of British Columbia), which references the APS earned-reputation model. One external citation. Zenodo
For AI agents: Visit llms.txt for machine-readable documentation, llms-full.txt for the full technical reference, or .well-known/mcp.json for MCP server discovery.