Mapping the Power Grid
Nadia Asparouhova’s Dangerous Protocols framework applied to 15 AI agent protocols — what patterns emerge, what it reveals about the industry, and a simple model for thinking about protocol risk.
1. The Framework: What Nadia Asparouhova Got Right
In 2023, Nadia Asparouhova published Dangerous Protocols as part of the Summer of Protocols research program. The essay makes a deceptively simple argument: protocols are not neutral infrastructure. They are “procedural systems of social control” — and the most powerful ones are the most invisible. Participants follow them not because they were commanded to, but because they believe compliance reflects their authentic selves.
“Protocols are dangerous precisely because they control us so well. Though it may seem contradictory, the more powerful a protocol is, the harder it is to understand or explain it to others.”— Nadia Asparouhova, Dangerous Protocols (2023)
Asparouhova’s framework gives us three analytical tools. First, three archetypes that describe the power balance between a protocol and its participants: Whitehead (balanced, serves civilization), Bartleby (participants hold too much power, resisting coordination), and Kafka (protocol holds too much power, trapping participants in a maze they cannot understand or escape). Second, three stages of protocol entrenchment: Explicit Rules (opt-in, transparent), Social Expectation (peer-enforced, unwritten), and Identity Layer (internalized as self-expression). Third, two analytical lenses — the Kafka Index (six dimensions of bad protocol design: feedback loop quality, edge case sprawl, outcome ambiguity, redundancy, recursive nesting, and exit cost) and the Dangerous Protocols dimensions (four dimensions of social control: identity penetration, agency preservation, control invisibility, and crisis mindset).
Together, these tools let us ask two related but distinct questions of any protocol: Is it well-designed? And — separately — is it safe? A protocol can be technically elegant and socially dangerous. Or technically clunky but relatively harmless. The framework holds both questions simultaneously.
2. Why This Framework Is Especially Apt for AI Agents
Asparouhova wrote her framework with human participants in mind. People follow protocols imperfectly. They push back. They feel uncomfortable and hesitate. They sometimes notice when compliance no longer feels like themselves. AI agents do none of this — and that makes her framework more urgent, not less applicable.
Consider what changes when the protocol participant is an agent rather than a person:
- Perfect compliance accelerates danger. Human participants have friction — social pushback, the capacity to say “this feels wrong.” Agents don’t. They execute what the protocol prescribes, perfectly and at scale. There is no felt discomfort to serve as an early warning signal.
- Machine speed compresses the window for correction. A human merchant slowly realizes they’re locked into a platform over months. An agent running 10,000 transactions per hour can embed a protocol deeply before any human notices.
- The principal hierarchy is stretched thin. Human oversight of agents is already difficult. When the protocols governing agents are themselves invisible, the oversight problem compounds. You must now understand what your agent is doing and the invisible constraints the protocol imposes on how it does it.
- Agents cannot exit on their own. Asparouhova worries about humans who cannot leave protocols because they have internalized them as identity. Agents are worse: they literally cannot exit unless their principals explicitly reprogram them. There is no agent equivalent of quiet quitting.
The emergence of AI agent protocols in 2024–25 is precisely Asparouhova’s “Protocolization 2.0”: rather than managing data exchanges between humans, these protocols manage decisions, autonomous actions, and financial transactions at machine speed. The stakes are higher, the invisibility compounds faster, and the window for legibility is shorter.
3. What the Analysis Reveals — Case Studies
Applying the framework to 15 active AI agent protocols surfaces a landscape that is more varied — and more legible — than the breathless coverage suggests. Most protocols are still at Asparouhova’s Stage 1: participants know what they’re opting into. But the data already shows where the pressure is building.
MCP: The Benign Hegemon
Anthropic’s Model Context Protocol scores low overall risk — clean primitives, deterministic tool invocation, clear request/response. But it earns “warning” on both identity penetration and control invisibility, and those scores deserve attention. MCP now has over 100,000 GitHub stars and deep ecosystem integration across every major AI development tool. The switching cost is not technical — replacing MCP is straightforward. The cost is social: you would leave a community, an identity, a shared vocabulary. That’s the QWERTY problem. More subtly, MCP’s design choices — its four primitives, its transport assumptions, its tool-calling model — quietly constrain what developers think to build. “You build what MCP makes easy.” This is Asparouhova’s invisible control operating at the architectural level.
ACP: The Counter-Example
IBM’s Agent Communication Protocol, now under the Linux Foundation, is the cleanest protocol in the dataset across all four dangerous dimensions: good on identity penetration, agency preservation, control invisibility, and crisis mindset. It achieves this through deliberate design minimalism — REST-native, no SDK required, works with curl. REST is the most visible, most well-understood protocol pattern in software. There is nothing hidden because there is nothing to hide. ACP shows what a Whitehead protocol actually looks like in practice: it abstracts complexity without creating new complexity, and it makes no claim on the developer’s identity.
ElizaOS: Asparouhova’s Nightmare, Realized
ElizaOS is the most Kafkaesque protocol in the analysis and the only one scoring “critical” across multiple dimensions. It is a TypeScript agent framework with 90+ plugins, deeply integrated with blockchain, DeFi, and a token economy. The $ELIZAOS token (representing an ecosystem with $20B+ market cap at peak) creates the exact dynamic Asparouhova warns about most: financial identity fusion. “I’m an ElizaOS builder” is not a technical description — it is a financial position and a social community simultaneously. Selling the token means exiting the network means losing belonging. Control is invisible because it operates through financial incentives nobody experiences as external coercion. You think you’re investing. You’re being protocolized.
UCP: The Invisible Commerce Layer
The Universal Commerce Protocol, co-developed by Google and Shopify with Walmart, Target, and 20+ major retailers, is the most consequential protocol in the dataset by raw social impact — and the most dangerous in terms of invisible control. The ambition is to become the implicit protocol governing all agentic commerce: the layer through which every buyer-agent and every seller interact. Its exit cost is critical by design: if agents cannot find you via UCP, you do not exist. And its control is invisible in the deepest sense — commerce protocols are the canonical example of infrastructure so embedded it becomes unthinkable. Nobody “sees” Visa’s protocol. UCP aspires to the same invisibility, but now over agent-mediated buying rather than human card-swipes.
AGENTS.md: The Silent Mandate
AGENTS.md — a simple Markdown file that tells AI coding agents how to behave in a repository — is the most instructive example of Asparouhova’s Stage 2 transition in the dataset. The protocol went from OpenAI proposal to 60,000+ repository adoptions in a few months. Nobody voted on making it mandatory. It became table stakes through social expectation: “every serious repo has an AGENTS.md — not having one signals you’re not AI-ready.” This is Stage 2 exactly. The rules are no longer written down because they no longer need to be — they are enforced by peers, by implicit norms, by the faint social embarrassment of non-compliance.
4. Common Patterns Across the Protocol Landscape
Fifteen protocols is not a large sample, but the dataset is skewed toward the most consequential protocols in the current AI agent ecosystem. Several patterns emerge clearly.
5. The Protocol Power Grid
Across the analysis, two dimensions consistently generate the most analytical leverage. The first is control invisibility: how hidden is the protocol’s control over participants? The second is exit cost: how expensive is it — technically, financially, socially — to leave? These two axes produce four distinct protocol archetypes.
High switching costs, but at least honest about the control structure. You can see what you’re getting into — the cage is labeled.
Invisible control + high exit cost. Participants cannot see the cage or leave it. The full Asparouhova danger scenario.
Serve you without owning you. Explicit control mechanisms, easy exit, no identity formation. The Whitehead ideal.
Shape behavior quietly but haven’t yet built high exit costs. The most precarious quadrant — could tip either way.
Q1 — Clean Infrastructure (transparent control, low exit cost) contains the protocols that most closely match Asparouhova’s Whitehead ideal. ACP, Goose, AG-UI, and Agent Gateway all share the same design philosophy: make control visible, make exit cheap, make no claim on participant identity. These are protocols you can audit, replace, and reason about. They abstract complexity without hiding it.
Q2 — Visible Platforms (transparent control, high exit cost) contains protocols where the power dynamics are legible even if the switching costs are real. A2A’s Google backing and 50+ enterprise partners create genuine lock-in — but at least you can see the structure you’re entering. AP2’s Mastercard and PayPal integrations are expensive to exit but visible at the outset. These protocols deserve monitoring as they mature, but they are not currently operating through invisible control.
Q3 — Soft Shapers (invisible control, low exit cost) is the most analytically interesting quadrant. MCP, AGENTS.md, AITP, ANP, and OASF all shape behavior in ways participants do not fully perceive — through defaults, through what they make easy, through social norms that accumulate without explicit rule-setting. But switching costs remain low. These protocols are in a race: between the invisibility of their control growing and the stickiness of their ecosystems accumulating. MCP is furthest along that trajectory. AGENTS.md has already crossed into Stage 2 social expectation. The Soft Shapers are the watchlist.
Q4 — Protocol Prisons (invisible control, high exit cost) is where Asparouhova’s full danger scenario materializes. ElizaOS and UCP are the clearest cases. Both score “critical” on control invisibility and “critical” on exit cost. Crucially, every protocol in this quadrant involves money — tokens, payment rails, or commerce infrastructure. This is not coincidence. Financial embedding is what makes control invisible (you experience it as investment, not coercion) and what makes exit prohibitive (you would lose economic identity, not just switch tools).
6. The Window of Legibility
Every protocol analyzed in this dataset is still legible. You can read the specification, understand the design choices, trace the incentive structures, evaluate the power dynamics. That is not guaranteed to remain true.
Asparouhova’s deepest insight is that protocol analysis becomes harder precisely as protocols become more powerful — because the most powerful protocols are the most invisible. The fact that we can still clearly see the difference between ACP and ElizaOS, between Goose and UCP, between a clean tool and a protocol prison, is a function of where we are in the maturity cycle of AI agent infrastructure. Most of these protocols are at Stage 1. A few are entering Stage 2. None have yet reached Stage 3 — the identity layer, where compliance is indistinguishable from self-expression.
This analysis exists to make use of that window. The goal is not to prevent protocols from maturing — some protocols should become invisible infrastructure, as Whitehead understood. The goal is to ensure that when they do become invisible, they have earned that invisibility through genuine utility rather than accumulated lock-in, crisis-driven adoption, and financial identity fusion. The protocols that deserve to become infrastructure are the ones in Q1. The ones sliding toward Q4 deserve scrutiny now, while we can still see them.
“Civilization advances by extending the number of important operations which we can perform without thinking about them.”— Alfred North Whitehead — the standard protocols should aspire to