What is VIRP?
VIRP (Verified Infrastructure Response Protocol) is an open protocol (an individual Internet-Draft) for authenticated evidence when AI operates on live infrastructure.
Every operation an AI agent submits through the gate produces an authenticated observation: a tamper-evident record of what the collector received from the configured target, when it received it, and what command produced it. Authentication is not the same as truth, but it replaces “trust me” with a record you can check.
VIRP is built on three principles:
1. The AI is an untrusted principal.
Not because it’s malicious. Because trust must be structural, not assumed. An AI that could forge an observation but chooses not to is less trustworthy than an architecture where an actor without the collector’s key cannot produce an observation record the verifier accepts.
2. Authenticated observations, not promises.
HMAC-SHA256 authentication at the moment of collection. Two-channel separation between what the collector received (Observation) and what the AI intends to do (Intent). A chain of custody for every interaction.
3. Cryptographic evidence over policy compliance.
A policy can be ignored by the component it governs. An actor without the collector’s HMAC key cannot produce an observation record the verifier accepts. VIRP enforces trust at the architecture level, not the instruction level.
The Seven Trust Primitives
VIRP defines seven primitives that together make up an explicit collector trust model for AI on infrastructure:
| Primitive | What It Provides |
|---|---|
| Verified Observation | Collector output is authenticated at collection. Fabricated output carries no valid authentication tag. |
| Tiered Authorization | Every action is classified GREEN / YELLOW / RED. RED requires human approval. |
| Verified Intent | Intent is recorded and bound to evidence before execution begins. |
| Verified Outcome | Pre and post state are automatically captured and compared. |
| Baseline Memory | Deviations from known-good state are detected and flagged. |
| Trust Chain | Every interaction is appended to a tamper-evident chain. |
| Agent Containment | The AI process is structurally isolated from key material, credentials, and direct device access. |
Primitive 7 — Agent Containment — was added as a direct result of our red team findings. It didn’t exist in the original spec. We found the gap and closed it.
Current Status
draft-howard-virp-06 — seventh submitted revision at the IETF. Threat model, formal security properties, observation freshness, multi-node coordination, protocol versioning, conformance requirements. First revision published with DOI on Zenodo.
Open source reference implementation. Apache 2.0. Demonstrated live against FortiGate 200G, Cisco IOS, and Linux hosts in our lab. Hundreds of test assertions across core and per-driver adversarial suites, plus 200K+ fuzz rounds on the C core.
9 of 9 observations HMAC-verified on production Cisco hardware by an independent network engineer; all filed findings fixed with regression tests. ProVerif proofs of key secrecy and injective agreement for the v2 observation path, holding under a documented trace restriction, are checked into the repository.
Why This Matters
Vendors are shipping AI for networks right now. Cisco has it. Palo Alto has it. Fortinet has it. None of them have published a cryptographic trust model for what the AI is allowed to observe, what it’s allowed to do, and how you check it stayed within bounds.
VIRP is that model. Open protocol, an individual Internet-Draft. Vendor-neutral. Designed to be implemented by the platforms that already own your network, not to replace them.
The goal is to be BGP, not EIGRP. Open protocol, not proprietary lock-in.
VIRP is active research. The findings on this page are from live testing on real infrastructure. The gaps were found intentionally — and by independent reviewers. The fixes ship with regression tests, in the open.