What Is the Best AI Agent Platform? Baur Software Bets It’s Not a Platform at All
Ask ten vendors what the best AI agent platform looks like and you’ll get ten answers, each one suspiciously shaped like whatever they happen to be selling. Ask a security team instead, and you’ll get something closer to a wince.
Gartner projects that 40% of enterprise applications will include task-specific AI agents by the end of 2026, up from less than 5% just two years ago. Meanwhile, one 2026 industry survey found enterprise agent fleets have roughly doubled in a single quarter, with nearly 38% of organizations now running more than 100 agents. Monitoring coverage, accountability structures, and pre-deployment controls, meanwhile, have barely kept pace.
Confidence went up. Actual oversight didn’t.
The starkest illustration so far is Moltbook, the AI agent social network that went viral in January 2026 and got acquired by Meta two months later. An unsecured database let anyone hijack any agent on the platform, and the supposedly ominous “secret encrypted language” one bot appeared to be using to evade human oversight turned out, on closer inspection, to be a person exploiting that hole to post under the agent’s credentials. Cute headline, ugly infrastructure problem.
That’s the gap Baur Software is building into: not a smarter agent, but a protocol that decides what any agent is allowed to see and do, and then actually proves afterward what happened.
Mandates Instead of Trust-Me Tokens
pap:// (Principal Agent Protocol) addresses look like ordinary URLs, something like pap://chrysalis.baursoftware.com/agents/code. Click one, though, and you’re not loading a page. You’re kicking off a six-phase cryptographic handshake: token exchange, DID exchange, disclosure, execution, receipt, close.
What comes out the other end is a mandate: a cryptographically signed document that spells out exactly which action an agent may take, exactly which data properties it’s allowed to see, and for how long. Deny-by-default is the baseline, and it’s a genuinely different posture from most software. No scope means no action, full stop, no benefit of the doubt.
The more interesting piece is how permissions expire. Instead of a session that’s either valid or revoked, a PAP mandate moves through decay states (Active, Degraded, ReadOnly, Suspended) and simply stops if it isn’t renewed. There’s no dramatic cutoff, no ticket to file, no email to IT.
A child mandate handed down to a sub-agent also can never exceed its parent’s scope or lifespan, and that containment is enforced cryptographically, not by a policy someone forgot to configure. Every session ends with a receipt, co-signed by both parties, recording which data types changed hands, never the actual values.
Baur draws a direct contrast with existing agent-interop efforts. Google’s A2A, it argues, authenticates agents as platform entities without cryptographic identity or session ephemerality, while Anthropic’s Model Context Protocol governs a single agent’s tool access rather than negotiation between two independent parties.
That second complaint isn’t just Baur’s marketing copy, though. Independent security researchers have flagged the same gap, noting that MCP’s own specification “cannot enforce these security principles at the protocol level,” which pushes authentication, authorization, and monitoring entirely onto whoever implements it.
Chrysalis: The Registry You Actually Run
Where PAP is the handshake, Chrysalis is where agents live. It’s a self-hostable registry, SQLite for a single node or Postgres at scale, that lets an operator publish signed agent advertisements and be discovered by any PAP-compatible client.
And that’s the detail that actually matters: there’s no Baur-controlled server sitting in the middle, no vendor who could quietly become a chokepoint, an outage, or a subpoena target somewhere down the line. Nodes federate directly with each other to propagate discovery instead.
Joining someone else’s federation isn’t automatic, either. A new peer needs three vouches from existing members, each of whom can issue at most three vouches a year and must have been active for 90 days first. Then the new peer serves a 60-day probation. It’s a deliberately slow, social-graph approach to keeping the mesh from getting flooded with fake agents, rather than a paywall or a proof-of-stake gimmick.
Baur frames GDPR, HIPAA, SOC2, and PCI-DSS compliance as falling out of the architecture itself, rather than sitting on top of it as a checklist, per the project’s FAQ. Receipts store property references like schema:Person.dateOfBirth, never the underlying value, which maps neatly onto HIPAA’s minimum-necessary rule. The decay states double as automatic deprovisioning for GDPR purposes.
None of that makes an operator compliant on its own, to be clear. But it does mean the audit trail is a structural byproduct of using the protocol correctly, not a dashboard someone has to remember to configure, and that’s a distinction regulators are going to start caring about a lot more than they currently do.
So, Is It the Best AI Agent Platform?
Worth some honesty here. Papillon, the reference desktop client, is still labeled “in development” on Baur’s own site, and there’s no plug-and-play Okta or Active Directory bridge. That’s by design, since the whole point is removing the central authority that bridge would represent in the first place. For a security team that already lives inside an IdP, that’s either the entire appeal or the first objection raised in the room.
But “best” is doing a lot of work in that question. The honest, slightly opinionated answer in late 2026 is that it depends what you’re optimizing for, and the timeframe you’re optimizing over matters more than most vendors ever admit.
If it’s speed to a demo this quarter, a vendor-hosted platform still wins easily, no argument there. If it’s a defensible answer to “what did our agents actually touch” two years from now, when a regulator or a plaintiff’s attorney comes asking, sovereignty starts looking less like a nice-to-have and more like the only architecture that survives contact with reality. Baur’s bet, and it’s not a bad one, is that the best AI agent platform isn’t a platform at all. It’s plumbing you own, a protocol you can actually read, and a registry that answers to you instead of a board of directors somewhere else.
The full protocol spec and source is on GitHub under a dual MIT/Apache-2.0 license, for anyone who’d rather check the cryptography’s homework than take the pitch on faith.