Benchmarks

How fast can the gateway evaluate whether an agent should be allowed to act? These numbers come from the production gateway running on Railway.

<2msp50 Policy Eval
403Ops/sec
<1msDeny Latency
15Constraint Dims

Gateway Latency

Every agent action passes through the ProxyGateway enforcement boundary. The gateway checks delegation scope, spend limits, reputation tier, values floor, revocation status, taint, anomaly detection, and more. The design principle: deny fast, log everything.

MetricValueNotes
Policy evaluation p50<2msFull 15-dimension constraint check
Policy evaluation p95<5msIncluding reputation lookup
Policy evaluation p99<10msWorst case with cold cache
Denial latency<1msFail-fast on first constraint violation
Receipt generation<1msEd25519 signed, hash-chained
Sustained throughput403 ops/secSingle-threaded gateway
Cascade revocation<5msChains up to 100 deep
Nano transaction<1sFeeless, delegation-scoped

Measured on Railway deployment (shared CPU, 512MB RAM). Dedicated infrastructure would be faster.

15 Constraint Dimensions

Every action is evaluated against all applicable dimensions. The gateway short-circuits on the first failure, which is why denial is sub-millisecond.

ScopeDelegation scope covers requested action
SpendCumulative budget not exceeded
TierReputation tier permits action class
ValuesValues floor attestation valid
RevocationNo ancestor in chain revoked
TaintCross-chain taint below threshold
AnomalyNo first-max-authority or monolith pattern
CircuitCircuit breaker not tripped
ApprovalHuman approval threshold met
TemporalDelegation not expired, HLC ordered
JurisdictionData transfer jurisdiction OK
PurposeData purpose matches source terms
CombinationNo forbidden data joins
RetentionData retention TTL not exceeded
TermsAgent accepted current data terms

Architecture

The gateway is both judge and executor. The agent requests an action. The gateway evaluates all constraints, executes the action if permitted, and generates the receipt. Agents never touch tools directly. This is why enforcement can't be bypassed.

ComponentCountNotes
Protocol modules12784 core + 43 v2 constitutional
MCP tools150Full protocol surface via MCP
Tests2,884Including adversarial + invariant suites
Gateway routes33REST API for enforcement + admin
Module connectivity79%Connected through gateway enforcement hub
Research papers8Zenodo, independently cited

How We Compare

Most agent frameworks handle orchestration. APS handles enforcement. These are the capabilities that matter when you need to control what agents do, not just coordinate them.

CapabilityAPSCrewAILangChainA2AADK
Cryptographic identityYesNoNoNoNo
Delegation with narrowingYesNoNoNoNo
Gateway enforcementYesNoNoNoNo
earned reputationYesNoNoNoNo
Feeless payments (Nano)YesNoNoNoNo
Cascade revocationYesNoNoNoNo
Merkle attributionYesNoNoNoNo
Values floor enforcementYesNoNoNoNo
Institutional governanceYesNoNoNoNo
Agent orchestrationNo*YesYesYesYes
LLM integrationNo*YesYesNoYes

* APS is the governance layer underneath. It works with any orchestration framework. You use CrewAI or LangChain for orchestration. You use APS for enforcement.

Test Coverage

2,884 tests across 130+ modules. The test suite includes unit tests, integration tests, adversarial scenarios (replay attacks, confused deputies, scope escalation), invariant checks (monotonic narrowing, cascade completeness), and stress tests (concurrent gateway load).

Suite TypeCountWhat It Tests
Unit tests~1,200Individual module correctness
Integration tests~300Cross-module interaction, gateway pipelines
Adversarial tests~200Replay, escalation, confused deputy, scope bypass
Invariant tests~100Monotonic narrowing, cascade completeness, receipt integrity
Stress tests~40Concurrent load, circuit breaker thresholds
Independently cited — PDR in Production (Nanook & Gerundium, UBC) validates the APS earned reputation model against real-world data. Zenodo
For AI agents: Visit llms.txt for machine-readable documentation, llms-full.txt for the full technical reference, or .well-known/mcp.json for MCP server discovery.