Agentic Advertising Standards
AdCP, AAMP (with its ARTF real-time layer), Prebid, and OpenAds, tracked by what each has actually shipped in its repository rather than by press-release membership counts — where each protocol places trust, where their failure modes diverge, an open call on whether the Prebid Sales Agent stays orthogonal to the wrapper schism underneath it, and the September 2026 retraction of the claim that embeddings are privacy-safe.
Current position
Instead of the single shared brain the map said UCP would provide, six months produced two embedding vocabularies in rival camps, with different rules and neither referencing the other; the context layer arrived, but not where the map said it would.
“Six months produced two embedding vocabularies in rival camps, with different rules, neither referencing the other.” — Agentic Advertising Protocols: A Unified Map of What's Next, Sep 11, 2026
Verified tensions: none currently recorded between the positions on this page. That is a statement about what the ledger has verified — not the result of an exhaustive contradiction analysis.
Showing 24 of 24 positions
No positions match these filters.
The timeline — newest first
- Sep 11, 2026 Claim
Instead of the single shared brain the map said UCP would provide, six months produced two embedding vocabularies in rival camps, with different rules and neither referencing the other; the context layer arrived, but not where the map said it would.
“Six months produced two embedding vocabularies in rival camps, with different rules, neither referencing the other.”
Status: current — no change since Sep 11, 2026.
- Sep 11, 2026 Call Unresolved
If Agentic Audiences shows neither a tagged release nor a commit retiring the vnd.ucp.embedding+json media type by the end of 2026, and neither camp's serve-time spec has added a reference to the other's embedding fields by then, the context layer is settled as two vocabularies, permanently.
“If neither appears by the end of 2026, and neither camp's serve-time spec has added a reference to the other's embedding fields by then, the context layer is settled and the settlement is two vocabularies, permanently.”
Status: unresolved — a falsifiable call awaiting an event. When it resolves, it becomes a confirmation or a retraction here.
- Sep 11, 2026 Claim
A standards effort with no runtime attached amounts to a proposal for other people's engineering time and gets executed on the schedule of whoever has that time free, whereas one that ships inside a system with a performance budget gets maintained because its maintainers need it to work; the essay presents this as generalising beyond ad tech.
“A standards effort with no runtime attached is a proposal for other people's engineering time, and it will be executed on the schedule of whoever has that time free.”
Status: current — no change since Sep 11, 2026.
- Sep 11, 2026 Claim
AdCP, which the map had cast as strategy-only, holds both roles: briefs in and seller-authored proposals out, and the match decided at serve time on a 50ms clock through Trusted Match, a surface marked Experimental.
“So the protocol this map cast as strategy-only holds both roles: brief in, seller-authored proposals out, and the match decided at serve time on a 50ms clock.”
Status: current — no change since Sep 11, 2026.
- Sep 9, 2026 Claim
Both standards now have code in the serve path, so the campaign-layer-versus-impression-layer story is less than half right: as of AdCP v3.1.19 Trusted Match targets sub-50ms end-to-end latency and drops agents that miss the budget, the shape of ARTF's tmax, though the two are not interchangeable (TMP matches packages over HTTP through a router; ARTF mutates bids over gRPC inside the host's cluster).
“But the layer story above is now less than half right, because both standards have code in the serve path.”
Status: current — no change since Sep 9, 2026.
- Sep 7, 2026 Claim
Removing cookies and device IDs is abstraction, not anonymisation: embeddings are not anonymous by default, and the controller carries the evidential burden of showing otherwise (GDPR Recital 15). Fewer identifiers move; the data-protection obligations do not lift.
“embeddings are not anonymous by default, and the controller carries the evidential burden of showing otherwise”
Status: current — no change since Sep 7, 2026.
- Jul 31, 2026 Framework
AdCP and AAMP don't split by altitude (campaign layer vs. impression layer) the way trade press claims — they split by ancestry: AAMP retrofits agentic behavior onto advertising's existing transaction rails, while AdCP is a greenfield lifecycle protocol built for agent-to-agent conversation first.
“The distinction that survives contact with the code is ancestry, not altitude.”
Status: current — no change since Jul 31, 2026.
- Jul 31, 2026 Claim
Katsur's build-on-existing-foundations argument for AAMP is a real engineering position, not just turf defense: retrofitting inherits working integrations, existing conformance programs, and two decades of operational knowledge that a greenfield protocol has to earn from scratch.
“retrofits inherit working integrations, existing conformance programs, and twenty years of operational knowledge.”
Status: current — no change since Jul 31, 2026.
- Jul 31, 2026 Framework
AdCP and AAMP put trust in different places with different failure modes: AdCP's wire-native trust (signed claims, governance tokens, idempotency) survives any deployment but only binds implementers of the cryptography, while AAMP's runtime trust binds whoever operates the reference stack but evaporates the moment that stack is swapped.
“Wire-native trust survives any deployment but only binds parties who implement the cryptography; runtime trust binds whoever operates the reference stack but evaporates if you swap the stack.”
Status: current — no change since Jul 31, 2026.
- Jul 31, 2026 Claim
AdCP's headline membership claim (118+) vastly outruns its verified live registry, where at the July 31, 2026 snapshot sixteen of twenty-one agents were sell-side and exactly one was a buying agent — a self-critical finding about the protocol Ev co-leads a working group for.
“The demand side of this protocol is thinner than its press.”
Status: current — no change since Jul 31, 2026.
- Jul 31, 2026 Claim
The AdCP-vs-AAMP standards fight is a conflict between the governing bodies, not the vendors underneath them — PubMatic, Yahoo, Optable, and Equativ all sit inside both camps at once.
“The war is between the bodies. The companies are hedging.”
Status: current — no change since Jul 31, 2026.
- Jul 31, 2026 Claim
Every standards body's press release outruns what its repository actually ships, and the only honest way to evaluate a standards claim is to measure that gap the same way for every competing body, not just the one you're skeptical of.
“Every standards body's press outruns its repos; the professional courtesy is measuring the gap the same way on both sides.”
Status: current — no change since Jul 31, 2026.
- Jul 31, 2026 Claim
The right way to judge which agentic-advertising standard is actually winning is by what has landed in the repository, not by what lands in the press feed.
“Judge both, then, the way this essay has tried to: by what lands in the repository, not what lands in the feed.”
Status: current — no change since Jul 31, 2026.
- Jul 31, 2026 Claim
Neither AdCP nor AAMP's trust model actually stands alone — both lean on an external verifier of last resort (AdCP on its registry and governance agents, AAMP on its registry and SafeGuard's platform), and that verifier layer is itself young and unproven at scale.
“Neither subsumes the other — and both, examined closely, lean on an external verifier of last resort (AdCP on its registry and governance agents, AAMP on its registry and SafeGuard's platform) that is itself young.”
Status: current — no change since Jul 31, 2026.
- Jul 31, 2026 Framework
AdCP and AAMP place judgment at opposite ends of the automation spectrum: AdCP gates every commit with a machine check and no value floor, while AAMP gates only above-threshold commits, and with a human -- two untested theories of where judgment belongs.
“Note the philosophical inversion against AAMP: AdCP gates every commit with a machine check and no value floor; AAMP gates above-threshold commits with a human. Those are different theories of where judgment belongs, and neither has been stress-tested at scale.”
Status: current — no change since Jul 31, 2026.
- Jul 31, 2026 Claim Retracted
AdCP's serve-time story (Trusted Match) is a different, thinner surface than AAMP's in-bidstream ARTF, and AdCP does not attempt in-auction machinery.
“does not attempt in-auction machinery”
Correction
This call was retracted — the corrected position is Both standards now have code in the serve path, so the campaign-layer-versus-impression-layer story is less than half right: as of AdCP v3.1.19 Trusted Match targets sub-50ms end-to-end latency and drops agents that miss the budget, the shape of ARTF's tmax, though the two are not interchangeable (TMP matches packages over HTTP through a router; ARTF mutates bids over gRPC inside the host's cluster). (Sep 9, 2026).
- Jul 13, 2026 Claim
The OpenAds/Prebid wrapper schism isn't a fight over auction mechanics — both wrappers share the same lineage — it's a fight over one OpenRTB field, who governs it, and whether a single company can credibly own the transparency layer it also bids through.
“The fork is not about auction mechanics — both wrappers run the same lineage. It is about one OpenRTB field, who governs it, and whether a single company can credibly own the transparency layer it also bids through.”
Status: current — no change since Jul 13, 2026.
- Jul 13, 2026 Call Unresolved
The Prebid Sales Agent (built on AdCP) is orthogonal and low-risk relative to the OpenAds/Prebid wrapper fight — evaluating the agentic standards layer does not commit a publisher to a side in the wrapper schism.
“Prebid Sales Agent is orthogonal and low-risk: open source, Apache-licensed, additive to an existing stack. Evaluating the agentic layer does not commit you in the wrapper fight.”
Status: unresolved — a falsifiable call awaiting an event. When it resolves, it becomes a confirmation or a retraction here.
- Jun 7, 2026 Claim
AdCP is a protocol layer that makes advertising work discoverable, executable, governable, and auditable by agents — it is explicitly not a replacement for OpenRTB, clean rooms, or human judgment.
“AdCP is not a replacement for OpenRTB, clean rooms, or human judgment. It is a protocol layer for making advertising work discoverable, executable, governable, and auditable by agents.”
Status: current — no change since Jun 7, 2026.
- Jun 7, 2026 Claim
The industry should not treat AdCP as a magic layer that makes agents safe by default — the protocol can define the task, but it cannot replace commercial judgment, governance design, data rights, measurement discipline, or operating ownership.
“The industry should avoid treating AdCP as a magic layer that makes agents safe by default. The protocol can define the task. It cannot replace commercial judgment, governance design, data rights, measurement discipline, or operating ownership.”
Status: current — no change since Jun 7, 2026.
- Mar 23, 2026 Claim Retracted
UCP embeddings are small, privacy-safe signals that carry meaning.
“embeddings — small, privacy-safe signals that carry meaning”
Correction
This call was retracted — the corrected position is Removing cookies and device IDs is abstraction, not anonymisation: embeddings are not anonymous by default, and the controller carries the evidential burden of showing otherwise (GDPR Recital 15). Fewer identifiers move; the data-protection obligations do not lift. (Sep 7, 2026).
- Mar 23, 2026 Claim Retracted
AdCP and UCP pair as Architect and Engineer, strategy and execution: AdCP sets the goal and UCP executes it with precision.
“AdCP sets the goal. UCP executes it with precision.”
Correction
This call was retracted — the corrected position is AdCP, which the map had cast as strategy-only, holds both roles: briefs in and seller-authored proposals out, and the match decided at serve time on a 50ms clock through Trusted Match, a surface marked Experimental. (Sep 11, 2026).
- Sep 1, 2025 Claim Retracted
Embeddings are privacy-safe because they carry no cookies or device IDs; abstraction into vectors was treated as settling the privacy question.
“Privacy safe: No cookies or device IDs. Embeddings abstract behavior into vectors.”
Correction
This call was retracted — the corrected position is Removing cookies and device IDs is abstraction, not anonymisation: embeddings are not anonymous by default, and the controller carries the evidential burden of showing otherwise (GDPR Recital 15). Fewer identifiers move; the data-protection obligations do not lift. (Sep 7, 2026).
24 of 122 total verified ledger rows shown here, filtered to
Agentic advertising standards. Built against corpus revision db654c2 —
every row on this page passed verification.state === 'verified' before it was allowed
to render. Receipts are verbatim; superseded and retracted rows are marked, never presented as current.
Methodology: Evolution of Thinking.