AdCP vs AAMP: The Retrofit and the Greenfield

In the last week of July 2026, agentic advertising’s two standards camps shipped almost simultaneously. The Ad Context Protocol tagged v3.1.8 on July 28. Two days later, IAB Tech Lab announced AAMP 2.3 — “enterprise-grade infrastructure and privacy diligence to agentic advertising.” The trade press has a frame ready for this: a standards war. Tech Lab CEO Anthony Katsur has supplied the ammunition on the record — AdCP is “deeply flawed” and “resource consuming”, “what we don’t need is another industry trade group” — while AdCP declines to return fire: its own FAQ names AAMP only to file it as an “emerging suite” that “appear[s] to operate at different layers of the stack and can coexist.”

Wars need a battlefield, and the one usually named — AAMP works the impression layer, AdCP works the campaign layer — turns out to be half wrong. I went into the repositories expecting to confirm it and came out having to correct it, along with two other claims I’d been carrying. This essay is what survived: what each standard actually is at the spec and code level, where they genuinely diverge, where the press releases outrun the repositories — on both sides — and what an operator should do about it.

Disclosure, before anything else: I co-lead AdCP’s Signals & Measurement working group, and my own signals agent is one of the entries in the AdCP registry count cited below. That’s a reason to read this essay’s method, not its conclusions: every load-bearing claim is linked to a repository, spec file, or named report, the skepticism is applied symmetrically, and where my own prior framing failed verification, the correction is printed here rather than papered over. Three did fail — flagged inline as we go.

What AAMP 2.3 actually is

Start with an anatomy the press release doesn’t give you. AAMP — Agentic Advertising Management Protocols — is not a single spec. The umbrella repo contains a README and a license, no releases, and points to six independently versioned repositories: agentic-direct (orchestration), buyer-agent, seller-agent, registry-agent-example, the Agentic Real Time Framework (ARTF), and agentic-audiences. “AAMP 2.3” resolves to the buyer and seller agents’ v2.3.x tags, cut July 22–29, 2026 — there is no umbrella changelog reconciling the marketing version to the repos.

The center of gravity is the two reference agents: Python, CrewAI multi-agent hierarchies, Apache-2.0, donated to Tech Lab — the source headers read “Author: Green Mountain Systems AI Inc. Donated to IAB Tech Lab”, with SafeGuard Privacy, HyperMindz, Mixpeek, and LiveRamp contributing their named pieces. The substrate is JSON over HTTP three ways: MCP as the primary structured interface (46 seller tools, 43 buyer tools, Streamable HTTP), a large REST surface (87 seller endpoints), and A2A for conversational traffic — though the seller’s own v2.3.1 changelog marks inbound A2A “designed-not-implemented” and amends the agent card to advertise only what the server actually serves. That correction is characteristic of the July release wave, which reads, in the repos’ own EP/FD-numbered work items, as an engineered remediation of the donated v2.0 code: float money end-to-end replaced by an integer-micros rule that bans IEEE 754 on the wire (“that defect is not fossilized into the spec”), self-assertable pricing tiers replaced by registry-verified ceilings, unstable tags replaced by an unusual public errata on v2.0 itself admitting the tag had pointed at an April commit and advising “for reproducible pilots, pin v2.2.0.”

The transaction model is the industry’s existing one, agentified. A buy runs media-kit discovery → OpenDirect 2.1 avails → quote → bounded multi-turn negotiation → booking that yields Deal IDs for activation in The Trade Desk, DV360, or Amazon DSP → an order state machine → distribution over the IAB Deals API, SSP connectors, or Google Ad Manager and FreeWheel. This is the deliberate design: as Adform CTO Jochen Schlosser put it in the release, agentic advertising should build “on, not around, the controls and infrastructure of programmatic advertising.”

The 2.3 headlines, checked against code:

• The privacy “approval gate” is real, narrow, and off by default. It is a SafeGuard-Privacy-donated HTTP client inside the buyer agent that asks one SafeGuard endpoint for a per-vendor boolean — iabBuyerAgentApproval — from the buyer’s own IAB Diligence Platform tenant, and filters non-approved sellers out at discovery, before any quote. Enforcement is env-gated (SGP_ENFORCE, default off, zero calls unless enabled) and fail-closed when on. The diligence itself — the vendor privacy assessments — happens off-agent in SafeGuard’s platform; the agent consumes a flag the buyer’s compliance team set. That’s a sane integration, and also a much smaller thing than the release’s “integrated privacy diligence” suggests.
• “Deterministic negotiation guardrails” is three layers of unequal hardness. Layer one is genuinely deterministic code: a pricing-provenance enum so a missing price becomes unavailable rather than invented, seller-side 422s on unpriceable products, floor-anchored counters with bounded rounds, deal-value ceilings. Layer two is a time budget: the LLM proposal-evaluation crew gets 20 seconds, then a deterministic fallback takes over. Layer three, in the repo’s own words, is prompt text — “pricing discipline language” asserted present in every agent backstory by unit test. Real engineering, honestly layered; not quite the press release’s “any path that commits spend is deterministic and provable with human approvals outside of value-based thresholds,” since CrewAI LLM crews still drive selection and negotiation reasoning between the guardrails, and the approval gates are per-campaign configuration.
• Trust verification is the best code in the release. The seller verifies a buyer’s claimed identity tier — public, seat, agency, advertiser, driving roughly 0/5/10/15% discounts — against the agent registry and caps the effective tier at the registry-verified ceiling on every price-moving path, fail-closed: self-asserted claims never raise a tier, unverifiable buyers floor to public pricing, blocked agents get a 403 before any pricing data leaks. Before this fix, a buyer could self-assert advertiser pricing by populating a request field.
• Human approval is threshold-shaped. The seller’s approval_required_above_value forces human review on any deal whose gross value crosses a configured line — even when approval gates are globally off — with the approver stamped from the authenticated credential so the trail can’t be forged via the request body. The buyer defaults to human approval at plan review and booking, and documents “set all to false for fully automated execution.”
• “Enterprise deployment through Amazon Bedrock and Databricks” is half verified. Bedrock AgentCore is substantively in both repos — entrypoints, CloudFormation, runtime patches, a workshop dataset. Databricks appears in zero AAMP repository artifacts; a code search across both agents finds nothing. Whatever the Databricks integration is, it isn’t in the open source.

One more structural fact: the canonical shared contracts — JSON Schemas with golden conformance vectors, in iab-agentic-primitives — carry an explicit “WORK IN PROGRESS — NOT YET RELEASED… not yet an official IAB Tech Lab release” warning as of July 31. AAMP today is running code ahead of released spec. That’s a legitimate way to build standards — it’s the Prebid way, roughly — but it should be named for what it is.

What AdCP 3.1 actually is

AdCP inverts almost every one of those choices. It is spec-first: a task vocabulary across seven domains — Media Buy, Creative, Signals, Accounts, Governance, Brand, Sponsored Intelligence — defined transport-agnostically over MCP and A2A (a get_products request has the same fields on either), with a separate serve-time HTTP profile (Trusted Match) where the latency budget is impression-time. The buy lifecycle is conversational: brief-driven product discovery that folds targeting, pricing, and curation into one round-trip; seller-authored proposals with committed pricing and expiry; create_media_buy; delivery reporting with row-level finality. Sellers are never required to disclose rate cards — by design they can return brief-specific proposals, decline via omission, and keep planning decisions internal, which reads as the spec’s de facto answer to Ari Paparo’s published objection that “buyers don’t want to be price takers, and sellers don’t want to reveal their rate cards.” (His companion verdict — the creative protocol is “brilliant” — is worth carrying too.)

Where AAMP bolts trust onto the deployment, AdCP wires it into the format. From 3.1: an idempotency_key is required on every task request, with typed conflict/in-flight/expired semantics and conformance probes; version negotiation is dual-track — major-precision stays a valid baseline through all of 3.x, while 3.1 adds bidirectional release-precision negotiation (supported_versions on capabilities, adcp_version on every request) that becomes mandatory only at 4.0, and either way a bad pin gets a typed error rather than a silent downshift; webhooks are at-least-once, unordered, snapshot-authoritative, with buyer-visible delivery logs; brand identity rides self-published brand.json files whose trust model is mutual assertion, deliberately patterned on ads.txt/sellers.json; and verify_brand_claim answers must arrive as signed JWS responses, with the load-bearing rule that a single signed “owned” is not trust-extending — both sides must reciprocate — while rejections are unilaterally authoritative. adagents.json does for sales-agent authorization what ads.txt did for reseller authorization, with delegation types, scoping, and time-bound revocation. The same hardening runs through authentication: RFC 9421 request signing is recommended in 3.0 but required for mutating and financial operations from 3.1, with bearer tokens prohibited there — though the spec’s own warning box concedes that until 3.1 lands for an implementer, bearer-over-TLS remains the effective floor for spend operations.

Now the honesty pass, same standard as above:

• The governance gate is the spec’s boldest idea and it is experimental. Once a governance agent is configured on a plan, check_governance becomes a universal validation gate — buyers MUST invoke it before every spend-commit, “no dollar floor, no anomaly threshold, and no cold-start exemption,” backed by a signed governance-context token chain sellers can enforce with a hard rejection; unreachable governance agent means halt. (No governance agent configured, no gate — the spec’s own trust page concedes as much.) It is also formally experimental in 3.x — sellers must flag governance.campaign in experimental_features, shapes may change on six weeks’ notice, and graduation to stable is criteria-gated, not date-gated: at least 45 days running in production plus cross-party validation (a second implementation, or a real buyer integrated in production — solo-implementer graduation is disallowed). Note the philosophical inversion against AAMP: AdCP gates every commit with a machine check and no value floor; AAMP gates above-threshold commits with a human. Those are different theories of where judgment belongs, and neither has been stress-tested at scale.
• The spec’s own trust page undercuts any halo. trust.mdx states that schema-level enforcement of restricted attributes exists for exactly three regulated categories (fair housing, lending, employment) — everything else rides on governance-agent implementation — and calls its own gate “a seam, not an enforcer.” It also concedes AdCP carries no normative consent signal (no TCF, no GPP): outside the serve-time profile, privacy is contractual, not structural. AAMP’s SafeGuard integration, boolean as it is, connects to an actual diligence platform; AdCP’s equivalent surface is younger than its reputation.
• Version discipline stumbled in public. The 3.1 line ran to eight patch tags in six weeks; v3.1.3 was withdrawn days after shipping for adding a stable schema field in a patch release — a violation of the spec’s own versioning contract — and as of this writing the official docs still direct implementers to v3.1.2 while the repo tags read v3.1.8 — the GitHub releases for v3.1.6 through v3.1.8 carry nothing beyond the version number, and the docs’ release-notes page stops before them (per-patch detail lives only in the repo’s CHANGELOG.md). The contract (wire pin “3.1”, typed version negotiation) is well-designed; July’s execution wasn’t clean.
• Adoption numbers deserve the same discount as AAMP’s. The homepage claims 118+ members. The live registry API returns 21 agents (July 31 snapshot preserved here, since this number will drift) — including a test agent, a non-prod endpoint, duplicate entries, two hobbyist agents, and my own — from 18 distinct organizations. Sixteen of the 21 agents are sell-side; exactly one is a buying agent. The demand side of this protocol is thinner than its press.
• Governance is a promise with an interim structure. AgenticAdvertising.org’s charter describes a pending 501(c)(6) with four equally weighted voting classes; its interim board is four people from three member vendors (two from Scope3), with elections pending and Randall Rothenberg — the IAB’s own former CEO, a detail with its own charge — listed as an interim advisor. Meanwhile the docs simultaneously credit the Prebid Sales Agent handoff and downgrade it to “a community example, not a maintained reference implementation” — spec-first has its own version of the running-code gap, which is running-spec.

The layer story is half right

Here is the claim I brought into the research: AAMP extends the impression layer (it’s Tech Lab, home of OpenRTB, VAST, ads.txt), AdCP defines the campaign layer, and they compose the way a campaign decomposes into impressions. The repositories support about half of that.

What’s true: ARTF is genuinely in-bidstream — OCI containers deployed inside a host platform’s own cluster, no external network access, gRPC over vendored OpenRTB 2.6 protobuf, returning atomic patch mutations (activate segments, adjust floors, shade bids, add metrics) the host accepts or rejects per-mutation against a tmax budget. Nothing in AdCP lives there; its serve-time story (Trusted Match) is a different, thinner surface. And AdCP’s planning surfaces — brief interpretation, proposals, mid-flight refinement, on-protocol outcome reporting — have no AAMP counterpart at all.

What’s false: AAMP’s core is not impression-plumbing. The buyer agent runs campaign briefs through a portfolio-manager-and-channel-specialists hierarchy, plans audiences, negotiates price over multiple turns, books OpenDirect orders with state machines and change requests, paces budgets, and manages creative — its own README’s output is “Deal IDs for DSP activation.” That is campaign-layer work by any definition. Both standards negotiate deals; both produce orders; the overlap at the deal plane is real, which is precisely why the two bodies collide there and nowhere else.

The distinction that survives contact with the code is ancestry, not altitude. AAMP is a retrofit: it agentifies advertising’s existing transaction rails — OpenDirect 2.1 objects on the wire, OpenRTB underneath, Deals API and GAM and the DSPs at the edges — so an agent becomes a new operator of machinery the industry already runs. AdCP is a greenfield: a new lifecycle protocol whose objects (briefs, proposals, media buys, signals, governance contexts, brand claims) were designed for agent-to-agent conversation first, with adapters to the old world at the boundary. Katsur’s argument — “the fastest and smartest way forward is to build on an existing shared foundation” — is a real engineering position, not just turf defense: retrofits inherit working integrations, existing conformance programs, and twenty years of operational knowledge. Greenfields get to design for the new failure modes — which is why AdCP has idempotency keys and signed governance tokens in the wire format, and AAMP has them in the deployment. Chalice’s Adam Heimlich put the retrofit case sharpest: Tech Lab builds on the “proven,” while AdCP “went far in trying to standardize something that’s unproven.”

Five seams where the design centers diverge

1. Discovery and pricing power. AdCP’s discovery is a brief in, curated products and committed proposals out — sellers control what surfaces and never have to publish a rate card. AAMP’s discovery is a media kit and an avails call against declared catalog capacity, with pricing shaped by identity tiers: present a verified seat, agency, or advertiser identity and unlock progressively better pricing, now capped by registry verification. One model treats price as the output of a negotiation the seller curates; the other treats it as tiered list pricing with verified discounts. Note the AAMP repos’ own honesty here: avails are “honest but stateless — no inventory ledger or holds yet,” so “real, not derived, numbers” means truthful-about-declared-catalog, not ad-server-verified availability.

2. Broadcast and audio. This is where I have to correct my own prior claim in public: AAMP is not missing linear. Both agents ship scatter-market linear TV — dayparts, DMA codes, network call signs, CPP and GRP pricing, TIP data-model alignment — modeled as “a special case of the standard deal flow”. What AAMP genuinely lacks: radio and print have no buying support at all, and audio and DOOH exist only as media-type enums and demo catalog entries — nothing like the dedicated transaction path linear TV gets. AdCP’s broadcast modeling goes deeper — shipped in the 3.0 line: guaranteed delivery types whose enum text explicitly covers scheduled broadcast, CPP with Nielsen-default demo notation, C3/C7 measurement windows on a guarantee basis, make-good remedy menus, Ad-ID/ISCI/Clearcast traffic identifiers, agency estimate numbers — but its gaps are open in public too: no spot-level as-run grain, no network/station targeting field, no interactive preemption workflow. Those are four open RFCs in the spec backlog, not shipped spec — and a fifth linear RFC was closed because GRP support already existed and the filer hadn’t seen it, which says something encouraging about the review process and something cautionary about reading RFC lists as gap lists.

3. Walled gardens and intelligent platforms. AdCP’s answer is architectural: account-namespace models with operator auth for platforms that own the namespace, seller-curated discovery that never exposes internals, and a documented closed-loop topology where the seller is also the measurement vendor — Walmart Connect, Kroger, Amazon, Criteo, and ChatGPT’s merchant integration are named in the docs, with the AI-assistant surface itself (Sponsored Intelligence) formally experimental. AAMP’s answer is operational: buy Meta through the agent, pull Google Ad Manager reports through the agent — platform passthrough rather than platform protocol. The pragmatist’s case for passthrough is that it works today against real budgets; the architect’s case against it is that it standardizes the doorway and not the room.

4. The measurement close. My second public correction: I had described AAMP’s attribution as “limited to matching IDs.” The repositories show something starker — neither agent implements attribution or conversion tracking at all; what exists is delivery, pacing, and spend telemetry plus platform report passthrough, with attribution surfacing only as ambition in agent prompt text and MMP name-drops in the docs. The only attribution language under the AAMP umbrella lives in Agentic Audiences, LiveRamp’s donated proposal (formerly the User Context Protocol — the wire format still says vnd.ucp.embedding+json), which sketches identity, contextual, and reinforcement embeddings with multi-touch attribution among its model categories. Its spec documents are v0.1 drafts, several spec files are literally zero bytes, and the repo has no tagged release — against a press release announcing “Agentic Audiences v1.0 ready for transactions.” AdCP, by contrast, carries the measurement close on-protocol — row-level finality flags, measurement windows with supersession semantics designed around broadcast maturation, committed metrics backed by a missing_metrics accountability structure (a seller that fails to deliver a promised metric must say so, on the same key, in the same row-level reconciliation join), and outcome metrics through incrementality; delivery reporting itself is a required task for every media-buy seller, with polling always available as the baseline — and the task reference is explicit that sellers “MUST NOT refuse delivery reporting — or narrow its coverage — on the basis that the buy originated outside AdCP.” That depth matters most exactly where closed loops live. But symmetric honesty: an on-protocol measurement surface is only as real as the sellers implementing it, and with one buying agent in the registry, the demand side that would force implementation barely exists yet.

5. Trust architecture. The cleanest philosophical split in the pair. AdCP puts trust in the wire: signed brand claims with a reciprocity rule, signed governance context tokens gating every spend commit (a mechanism that sits, remember, on the still-experimental campaign-governance surface), required idempotency, mutual-assertion files at well-known URLs. AAMP puts trust around the runtime: a diligence-platform boolean gating discovery, registry-verified pricing tiers, value-threshold human approval, fail-closed transport behavior. Wire-native trust survives any deployment but only binds parties who implement the cryptography; runtime trust binds whoever operates the reference stack but evaporates if you swap the stack. Neither subsumes the other — and both, examined closely, lean on an external verifier of last resort (AdCP on its registry and governance agents, AAMP on its registry and SafeGuard’s platform) that is itself young.

The press release and the repository

Every standards body’s press outruns its repos; the professional courtesy is measuring the gap the same way on both sides. As of July 31, 2026:

None of this is scandal; all of it is standards-body physics. The reason to print it is that both bodies are asking operators to commit integration budgets now, and the honest gap between announcement and artifact is exactly the information an operator needs.

Do they compose — and what should you do?

In principle, cleanly: an AdCP-negotiated campaign could settle into the same Deal IDs, DSP seats, and OpenRTB auctions that AAMP’s agents operate; a buyer could run AdCP’s brief-and-proposal conversation upstream and AAMP-style execution downstream; HyperMindz’s own framing — the deal plane is “fragmented across platforms” — describes the seam both stacks touch. In practice, nobody has built the bridge, and no joint statement exists — the public record is asymmetric: sustained criticism from one side, and from the other a single FAQ entry filing its rival as a coexisting, different-layer effort. The market’s actual verdict is quieter and more interesting: PubMatic, Yahoo, and Optable sit among AdCP’s founding six and in Tech Lab’s agentic working groups, while Equativ runs a live AdCP sales agent and stood up as an early supporter of Tech Lab’s Agent Registry. The war is between the bodies. The companies are hedging.

If you’d rather run your own numbers than take mine, there’s a companion decision tool — a weighted, hard-gated evaluation scorecard (framework v0 by Lukasz Szczesiak of pubX, open-sourced as a shared community artefact and populated with live pilot evidence here): download the scorecard (.xlsx). It hard-gates on transaction safety, trust, privacy, approval, and reconciliation — any unverified gate holds the decision regardless of the weighted total — and ships with a 12-test pilot plan. Two of those gates already carry live evidence: I ran the runnable subset against my own AdCP signals agent as the seller-under-test, and the verbatim request/response transcript is the audit trail. Worth stating plainly, because it’s the whole point of scoring evidence over claims: the conflicting-idempotency-key test failed on first contact — my adaptor silently replayed instead of returning a typed conflict — and I fixed it the same day. A scorecard that catches a real spec-conformance bug in the author’s own agent is a scorecard doing its job.

Seat-by-seat, as of today:

• Publishers and SSPs: the sell side is where AdCP’s implementation gravity already is (16 of 21 registered agents) and where AAMP’s seller agent plus SSP connectors are most concrete. These aren’t exclusive — the adapter surface area is annoying but bounded. If your revenue skews to direct/guaranteed and broadcast-adjacent inventory, AdCP models more of your business today; if it skews programmatic-operational, AAMP meets your existing plumbing sooner.
• Buyers and agencies: be honest that both demand sides are immature — AAMP’s buyer agent is the most complete open buying implementation but is reference code under active remediation; AdCP’s registry holds exactly one buying agent. Pilot cheap, hold approval gates on, and treat “deterministic” and “governed” claims from either camp as configurations you must verify, not properties you inherit.
• Platforms and walled gardens: AAMP asks little of you (it consumes your existing APIs); AdCP asks you to expose a protocol surface but lets you keep pricing, packaging, and the measurement loop. The question is whether standardized access grows your demand enough to pay for the surface.
• Data and measurement vendors: watch the two audience efforts converge on the same unsolved problem from opposite ends — embeddings on existing identity rails (LiveRamp’s proposal) vs typed signals with governance semantics (AdCP’s shipped surface) — and note that neither has a production attribution story that doesn’t ultimately resolve to the platforms’ own.

What would actually settle the contest isn’t rhetoric from either body — it’s which stack clears real budgets first, and this week both camps gave you their tell about what they think is missing: AAMP 2.3 hardened deployment (the bet: adoption fails on operational trust), while AdCP’s 3.1 line hardened the wire contract (the bet: adoption fails on counterparty trust). The next checkpoints: Tech Lab’s own blog says only that “AAMP 3.0 is coming soon,” while Katsur’s LinkedIn announcement of 2.3 put the next release “arriving this September” — a date that appears in no press release, and which summit coverage in the spring had pegged to July before 2.3 shipped instead. On the AdCP side, the merchant-measurement RFCs sit on a 3.2 milestone due August 31, while the linear-TV set waits in the uncommitted spec backlog. Judge both, then, the way this essay has tried to: by what lands in the repository, not what lands in the feed.

Let’s see how this plays out. My 2c, as always — and given the disclosure up top, weigh it accordingly.