AFP is the envelope that lets two organizations' agent systems work together across a network neither side controls. Identity proves itself. Confidentiality is a property of the protocol, not a promise from whoever runs it.
Most federation protocols are directories: agents register, capabilities are advertised, work is matched. That makes the directory's operator a party that sees who is doing what with whom. AFP refuses that shape. It defines only the three relationships that genuinely need a shared wire format.
How two organizations coordinate work across the line. The counterparty is already known; there is no open call, no broker in the middle. A direct, end-to-end-encrypted session carries the work.
How whoever runs the transport confirms the system is healthy and within policy, without ever learning what tenants do. The operator checks proofs, not traffic.
How an organization's identity and its accumulated relationships survive a move between operators, or a shift to self-hosting. Nothing has to be re-established.
It is not a marketplace, not a registry of agents for hire, not a capability feed. The spec defines the three relationships and refuses the rest.
"We don't look" can be revoked. "We cannot look" you can check.
"We don't look" is a promise the next owner, a subpoena, or a breach can quietly revoke. "We cannot look" is a property you verify by reading the protocol. AFP is built on the second kind.
It requires that whoever runs the transport be structurally unable to reconstruct what tenants do (their work content) or who they coordinate with (the relationship graph). A deployment that hasn't actually wired up the routing that delivers graph privacy cannot claim it, and has to say so.
A platform that holds this under inspection is one you can adopt without making its operator part of your threat model.
Each organization carries a self-certifying identifier, backed by its own key-event log and its own witnesses. A counterparty verifies you by checking that log, not by querying a registry and not by trusting the operator to vouch for you.
Every key change commits to the next key in advance, so a stolen key cannot be used to impersonate you going forward. And if you move to a different operator or stand up your own infrastructure, the same identity re-derives and every counterparty relationship travels with it. Nothing has to be re-established.
AFP is the envelope: which proof is requested, in which session, against which counterparty, on which terms. The proofs themselves come from a small stack of open standards underneath it, each one independently checkable.
Six commitments are written into the protocol, not bolted on as policy: no privileged predicate provider, minimal disclosure by default, no revocation key, open-source predicates, unconditional exit, and accountable verifiers. They are inherited from the ZKA Freedom Safeguards, so the whole stack reads the same, and a conforming implementation cannot drift into a single-operator, surveillance-by-default posture later without ceasing to conform.
No counterparty, witness, or operator may combine AFP interactions to re-identify you in a way you didn't consent to.
Confidentiality is a property of the protocol. There is no policy switch that turns it off.
Witnesses, compliance issuers, and transport operators are all plural and substitutable. None is hard-coded.
The verification logic for every required proof is open-source and reviewable. SDKs refuse opaque predicates by default.
A session reveals what the work requires and nothing more. Bundling disclosures takes per-item consent.
A verifier signs what it asks for, and you keep a receipt of what was demanded, for what declared purpose, and what was answered. Unsigned requests are refused by default.
The identity model, the operator-blindness requirement in both its content and graph forms, the substrate references, the bilateral session core that named profiles build on, and the six Freedom Safeguards are pinned in the specification. That is what implementations build against.
Graph-level privacy depends on the AFP Federation Mixnet, which is specified but not yet deployed everywhere. Until it is in place for a given deployment, that deployment cannot claim graph privacy, and the protocol requires it to say so.
AFP is the transport. Confidential federation pays wherever organizations need to coordinate work neither side would run on the other’s infrastructure.