EMILIA Protocol
Show HN: Approve an AI agent's wire with Face ID,then watch a forged one fail
Last verified:
What is EMILIA Protocol?
EMILIA Protocol (EP) is a protocol-grade trust substrate for high-risk action enforcement. It verifies whether a specific actor, under a specific policy, should be allowed to perform an exact high-risk action right now. Unlike traditional authentication systems that only verify who is acting, EP validates the action itself against policy before execution proceeds. This makes it essential for workflows where ordinary auth fails and fraud moves inside valid sessions.
Key features include self-verifying receipts (Ed25519-signed and Merkle-anchored), compliance mappings to NIST AI RMF and EU AI Act, federation-ready architecture with multiple independent operators, and a phased deployment approach starting with Eye (observe/shadow), then Handshake (pre-action enforcement), Signoff (named human ownership), and Commit (immutable audit chain). EP ships as an MCP server compatible with Claude, GPT, Gemini, Cursor, and Windsurf. It offers zero-dependency offline receipt verification, an interactive trust playground, a trust explorer like Etherscan, and an embeddable trust widget.
EMILIA Protocol is designed for government fraud prevention teams, financial infrastructure operators, enterprise security teams managing privileged actions, and AI/agent execution governance teams. It.binds identity, authority, and action context before benefit disbursement, wire transfers, infrastructure changes, or autonomous agent actions. The protocol is Apache 2.0 licensed with an open specification, making it suitable for both developers and procurement teams building for compliance.
The system provides 3,277 automated tests, 20 proven theorems with zero TLC errors, 116 red team cases with all findings remediated, and a 100/100 internal security audit score. It operates as a trust-control layer between enterprise authentication and privileged action execution without replacing IAM or RBAC systems.
EMILIA Protocol pricing
Pricing model: Freemium
The website does not explicitly document pricing tiers. EMILIA offers multiple deployment options: OPEN Open Protocol (Apache 2.0 licensed, free to read/implement/extend), OPEN Open Runtime (self-hosted reference implementation for on-premise, free), MANAGED EP Cloud (managed control plane with observability, analytics, policy management - paid), PRIVATE EP Enterprise (private deployment with dedicated infrastructure, SLAs, compliance controls - paid), and VERTICAL Vertical Packs (pre-built policy templates for government, financial services, agent governance - paid). The open protocol and runtime are free, while managed cloud, enterprise, and vertical packs are paid offerings.
EMILIA Protocol pros
- Verifies exact high-risk action should be allowed before execution
- Protocol-grade trust infrastructure, not just an API
- Self-verifying receipts with Ed25519 signing and Merkle anchoring
- No API call needed to verify receipts - just math
- Formal compliance mappings to NIST AI RMF 38/38 subcategories
- EU AI Act compliance mapping for Articles 9-15
- Federation-ready with multiple independent operators
- No single point of failure or central authority required
- Apache 2.0 licensed open specification
- Ships as MCP server compatible with Claude, GPT, Gemini, Cursor, Windsurf
- Zero-dependency offline receipt verification
- Interactive trust playground for walking through EP lifecycle
- Trust Explorer like Etherscan for verifying any receipt
- Embeddable trust widget with one script tag
- 100/100 internal security audit score
- 3,277 automated tests with 20 proven theorems
- Phased deployment: Eye, Handshake, Signoff, Commit
- Replay-resistant authorization with one-time consumable approvals
- Exact action binding prevents approval replay across environments
- Named human accountability for privileged actions
EMILIA Protocol cons
- No free tier explicitly documented on website
- SOC 2 Type II audit still in progress, not complete
- Registration rate-limited to max 5 entities per day per owner
- Closed-loop graph analysis may flag thin graphs thin-graph flagging
- No self-scoring protocol design limits user visibility
- Rolling window of only 200 for certain metrics
- New entity dampening requires 5+ receipts from 3+ submitters
- Append-only ledger means cannot clean up after Sybil attack
- Requires MCP-capable client for full integration
- Private deployment EP Enterprise may have higher cost
Frequently asked questions about EMILIA Protocol
What is EMILIA Protocol and what does it do?
EMILIA Protocol (EP) is a protocol-grade trust substrate for high-risk action enforcement. It verifies whether a specific actor, under a specific policy, should be allowed to perform an exact high-risk action right now. Most systems verify who is acting, but EP verifies whether this exact high-risk action should be allowed by this actor under this policy right now.
How is EP different from traditional authentication or IAM?
EP operates as a trust-control layer between enterprise authentication and privileged action execution. It does not replace IAM or RBAC. It adds action-level trust enforcement where existing access control stops. All systems verify who is acting, but EP verifies whether the action itself should be allowed under the policy.
What are the core verification axioms of EP?
The core verification axioms are: self-verifying receipts (Ed25519-signed and Merkle-anchored), compliance-mapped (NIST AI RMF 38/38 subcategories and EU AI Act Articles 9-15), and federation-ready (multiple independent operators can issue and cross-verify receipts via shared cryptographic proofs with no single point of failure).
What deployment options does EMILIA offer?
EMILIA offers five deployment options: OPEN Open Protocol (Apache 2.0 licensed specification), OPEN Open Runtime (self-hosted reference implementation for on-premise), MANAGED EP Cloud (managed control plane with observability and analytics), PRIVATE EP Enterprise (private deployment with dedicated infrastructure and SLAs), and VERTICAL Vertical Packs (pre-built policy templates for specific industries).
How does the phased rollout work with Eye, Handshake, Signoff, and Commit?
The progressive phased deployment starts with Eye (observe and shadow, logging first and flagging without blocking), then Enforce with Handshake (policy-bound pre-action trust enforcement with canonical binding and replay resistance), then Own with Signoff (named human ownership when policy requires it, not MFA but cryptographically bound accountability), and finally Seal with Commit (atomic write to immutable audit chain where execution is released and cannot be undone).
What use cases does EMILIA support?
EMILIA supports four main use cases: Government Fraud Prevention (bind identity, authority, and action context before benefit disbursement), Financial Infrastructure Controls (enforce ceremony-grade authorization on wire transfers and limit changes), Enterprise Privileged Actions (require bound authorization for infrastructure changes and data exports), and AI/Agent Execution Governance (gate autonomous agent actions behind protocol-enforced trust ceremonies).
Is EMILIA Protocol open source?
Yes, the OPEN Open Protocol is Apache 2.0 licensed with an open specification. You can read, implement, and extend it. The OPEN Open Runtime is also available as a self-hosted reference implementation for on-premise deployment.
How do I integrate EMILIA with my AI model or agent?
EMILIA ships as an MCP server, so any MCP-capable client including Claude, GPT, Gemini, Cursor, and Windsurf can experiment with it. You can also use the zero-dependency verification package, interactive trust playground, and embeddable trust widget to integrate EP in minutes.
What is the security audit status of EMILIA Protocol?
EMILIA has an internal security audit score of 100/100 from April 2, 2026. It has 3,277 automated tests, 20 theorems proven with TLC 2.19 and zero errors, 116 red team cases with 31 findings remediated. SOC 2 Type II audit is in progress.
Can I verify EMILIA receipts without calling their API?
Yes, every EP receipt is Ed25519-signed and Merkle-anchored. Anyone can verify it without calling the EP API - no account and no trust relationship required, just math. The zero-dependency verification package allows offline receipt verification with Ed25519 and Merkle proofs.