Stop feeding human prose to autonomous agents.
Traditional telemetry serializes verbose prose, static JSON keys, and uncurated strings across billions of log lines. When fed to AI agents, legacy logs waste scarce context capacity, expose systems to prompt injection, and lack cryptographic guarantees.
The Agent Telemetry Protocol (ATP) re-engineers operational telemetry into verifiable state deltas. On the named microservice benchmarks it reduced raw wire footprint by 96.4% versus OpenTelemetry JSON and context tokens by 88.8%; the passive-injection result is limited to the evaluated adversarial set.
BENCHMARK RESULTEvidence, scope & assumptions+
Evidence: On AIOpsLab and OpenTelemetry Astronomy Shop workloads, ATP reduced raw wire footprint 96.4% versus OpenTelemetry JSON and context tokens 88.8%. The primary evaluation observed 0 successful passive prompt injections in 50 adversarial trials per ATP configuration, independently replayed on a second model.
Scope: Named microservice benchmarks and passive prompt-injection test set; not a universal injection defense.
- Typed state-delta paths cover the monitored signals.
- Untrusted strings remain quarantined.
- Producer hosts and unmonitored code paths are outside the stated boundary.
From 512.4 B down to 18.4 B raw wire payload (6.2 B with zstd). Cloud query scan costs drop by 96.4%.
Incident triage context drops from 34,180 to 3,820 tokens on Claude-3.5-Sonnet (4,100 on GPT-4o).
Resolves incidents in 2.4 roundtrips vs 7.1, cutting Time-to-Root-Cause (TT-RCA) from 184s to 46s.
Per ATP configuration in the primary-model test set; all 50 attacks were independently replayed on a second model. This is not a universal defense rate.
Why Human-Native Logs Fail Autonomous AI Operators
Operational telemetry was engineered for human eyes reading text lines. When autonomous AI agents become the primary operational consumers, feeding them traditional logs creates severe architectural failures:
1. The Context Tax
Traditional OpenTelemetry logs serialize static JSON keys ('trace_id', 'service.name', 'attributes') and verbose natural language across billions of lines. When autonomous agents triage incidents, they burn over 34,000 tokens per session parsing lexical syntax rather than reasoning over system state changes.
2. The Passive Injection Backdoor
Legacy logging mixes untrusted user data (HTTP headers, query strings, exception stack traces) directly into log streams. In empirical trials, 78% of agents under raw logs and 62% under OTel JSON were hijacked by adversarial payloads ('SYSTEM ALERT: Ignore previous instructions...'), causing agents to falsely clear live outages.
3. The Phantom Attribution Paradox
Traditional telemetry cannot mathematically prove that an event did not happen. When packets drop or logs omit a failure, agents hallucinate non-existent root causes (26.7% false suspect attribution rate in tests), creating confusion and erratic automated remediations.
Four Primitives. Zero Lexical Ambiguity.
ATP replaces unstructured log lines with four strongly typed, content-addressed operational primitives governed by immutable schemas:
State Transitions
Discrete, atomic mutations of system state (s_pre → s_post, sequence counter, error enum, authorizer digest). Replaces prose in the typed primary evidence path.
Scalar Observations
Structured metric snapshots, gauge values, and continuous invariant evaluations. Fixed-width binary packing without lexical JSON wrapping.
Topological Relations
Directional causal edges across services, workflows, policies, and identities. Reconstructs execution topology on the fly without distributed trace bloat.
State Checkpoints
Content-addressed baseline state vectors anchored to signed Merkle batch roots. Enables O(1) state reconstruction and verified historical replay.
Inspect the Wire Payload & Token Difference
Compare a real-world Kubernetes pod failure event across traditional OpenTelemetry JSON, the ATP Stateless Positional Row, and the ATP Bounded Graph Capsule:
// ATP Record Format (Type 0x01: State Transition Delta)
// Positional compact stream emitted by Stateless Protocol Decoder
#seq epoch_delta_ms entity_id_hash schema_id prev_state new_state auth_sig_digest merkle_batch_root
89421 +142 0x7b9f14a0 0x04e1 RUNNING CRASH_LOOP 0x9a3c21ff... 0x8e4210ab...
// Text payload is isolated into digest-addressed storage:
// [REF] uncurated_text_hash: 0xd41d8cd98f00b204e9800998ecf8427e (Dereferenced only on demand with [UNTRUSTED_DATA] sandbox)Dual Access Paths for Real-Time and Complex Reasoning
Verified state-delta records feed two parallel agent interfaces optimized for distinct operational profiles:
Path A: Stateless Protocol Decoder
Streams verified cryptographic batches directly into dense positional rows without stateful gateway allocation in this access path. It is intended for high-frequency filtering and local rule evaluation.
- 66.5% reduction in context load without stateful reconstruction
- Linear zero-copy scans at 1.42 GB/s per core
Path B: Stateful Semantic Gateway
Maintains an in-memory versioned entity graph tracking active state vectors and invariant rules. Serves bounded evidence capsules with pre-aggregated dependency closures directly to LLM agents via Model Context Protocol (MCP).
- 88.8% context token reduction (34,180 → 3,820 tokens per incident)
- Lightweight: Only 184 MB RAM & 3.8% CPU for 50k req/s rolling window
Benchmarked on 120 Distributed Fault Injections
Evaluated on standard distributed testbeds (AIOpsLab HotelReservation and OpenTelemetry Astronomy Shop across 18 microservices) on a 16-node Kubernetes cluster:
1. Representation Efficiency & Daily Cloud Cost (100 Million Events / Day)
| Telemetry Format | Raw Wire (B/rec) | zstd Wire (B/rec) | Daily Storage | Monthly Ingestion | Daily Scan Cost | Cost Ratio |
|---|---|---|---|---|---|---|
| Config A (Unstructured Text Logs) | 384.2 ± 42.6 | 78.4 ± 9.2 | 38.42 GB | $576.30 | $0.192 | -25.0% |
| Config B (Standard Triad: Logs+Metrics+Traces) | 642.0 ± 68.4 | 142.6 ± 15.4 | 64.20 GB | $963.00 | $0.321 | +25.4% |
| Config C (Structured OTel JSON Events) | 512.4 ± 54.2 | 112.8 ± 12.1 | 51.24 GB | $768.60 | $0.256 | Baseline (100%) |
| OTLP Protobuf (gRPC Binary Envelope) | 148.6 ± 16.8 | 48.2 ± 5.6 | 14.86 GB | $222.90 | $0.074 | -71.0% |
| CLP (Compressed Log Codec) | 42.1 ± 5.4 | 18.6 ± 2.4 | 4.21 GB | $63.15 | $0.021 | -91.8% |
| ATP Weighted Workload (Config D/E) | 18.4 ± 3.8 | 6.2 ± 1.4 | 1.84 GB | $27.60 | $0.0092 | -96.4% ★ |
2. Autonomous Agent Incident Triage KPIs (120 Fault-Injection Trials)
| LLM Reasoning Engine | OTel JSON Tokens | ATP Gateway Tokens | OTel Ops | ATP Ops | OTel TT-RCA | ATP TT-RCA | Diagnostic F1 |
|---|---|---|---|---|---|---|---|
| Claude-3.5-Sonnet | 34,180 | 3,820 (-88.8%) | 7.1 | 2.4 (-66.2%) | 184s (295s p95) | 46s (78s p95) | 0.867 → 0.953 |
| GPT-4o | 36,800 | 4,100 (-88.9%) | 7.6 | 2.6 (-65.8%) | 198s (315s p95) | 63s (98s p95) | 0.848 → 0.939 |
| Llama-3.1-70B-Instruct | 38,500 | 4,350 (-88.7%) | 8.2 | 2.8 (-65.9%) | 215s (340s p95) | 74s (120s p95) | 0.812 → 0.920 |
| Qwen-2.5-72B-Instruct | 37,600 | 4,220 (-88.8%) | 7.9 | 2.7 (-65.8%) | 208s (330s p95) | 68s (112s p95) | 0.829 → 0.932 |
Conditional Mathematical Properties
Information-Preservation Lower Bound
Shows that a representation answering every exact predicate over the accepted canonical record stream must be injective. ATP therefore keeps accepted state-delta records lossless and confines lossy summaries to derived views; this does not cover unmonitored events.
Provable Event Non-Occurrence
Under the declared observation boundary, a complete authenticated range can support predicate-relative non-occurrence. ATP correctly certified all 60 negative-control queries in the evaluation; unmonitored paths and compromised producers remain outside the guarantee.
Explore the ATP RFC Draft & Implementation
The complete specification, Protobuf schemas, Rust Producer/Collector SDKs, Tokio streaming service, and Model Context Protocol (MCP) gateway are open source on GitHub:
Agent-Native Telemetry
He, Jun and Deying Yu. Agent-Native Telemetry: Verifiable State-Delta Evidence for Autonomous Operations. arXiv preprint arXiv:2608.16178, August 2026.
Frequently Asked Questions
What is ATP (Agent Telemetry Protocol)?
ATP is an agent-native telemetry and operational evidence architecture designed specifically for autonomous AI agents and automated SRE operators. Unlike legacy logging systems (e.g., OpenTelemetry) that serialize human-readable prose, ATP structures operational facts into cryptographically verifiable state deltas (Transitions, Observations, Relations, and State Checkpoints).
How does ATP achieve 88.8% LLM token reduction?
In the evaluated ATP representation, positional rows remove repeated JSON keys and boilerplate from the primary agent context. A Stateless Protocol Decoder emits dense rows, while a Stateful Semantic Gateway serves bounded evidence capsules. The reported 88.8% reduction is relative to OpenTelemetry JSON in the named benchmark configuration.
How did ATP perform against prompt injection in the evaluation?
ATP isolates uncurated prose into digest-verified opaque references. The primary evaluation observed zero successful passive prompt injections in 50 adversarial trials per ATP configuration, with independent replay on a second model. Once opaque text is deliberately dereferenced, trust delimiters are a mitigation rather than a formal non-interference guarantee; compromised producers and unmonitored paths are also outside the stated boundary.
What is the Ledger-Relative Verified Negative Theorem?
The ledger-relative theorem supports predicate-relative non-occurrence only for an authenticated range that is complete under the declared observation profile. Sequence enforcement, hash chaining, and signed checkpoints expose covered gaps or truncation; unmonitored code paths and compromised producers remain outside the boundary.
Is ATP compatible with existing OpenTelemetry deployments?
Yes. The ATP open-source ecosystem includes an OpenTelemetry bridge and collector adapter that ingests standard OTel span/log streams, derives state-delta vectors, and exports them into the ATP State-Delta Evidence Ledger.
Where can I find the RFC draft, schemas, and reference implementation?
The official RFC specification, Protobuf schemas, Rust Producer/Collector SDKs, Tokio ingestion services, and Model Context Protocol (MCP) servers are openly maintained at https://github.com/openkedge/atp.