AEOESS
ContactGet Started
Protocol Live·Apache-2.0·installs

Open-source enforcement
infrastructure for AI agents.

Identity, delegation, accountability for every AI agent, open spec, open SDKs, open MCP. The hosted enforcement gateway that runs production governance is a separate commercial product. Spec compatibility is permanent.

8
PAPERS
20
ESSENTIAL TOOLS
2,884
TESTS
Full surface area: 150 MCP tools, TypeScript + Python SDKs.
$ npm install agent-passport-system
$ clawhub install agent-passport-system
Independently cited, PDR in Production (University of British Columbia) validates APS Bayesian model. Zenodo
Quick start Core subpath, curated essentials
// import the curated essentials
import {
  createPassport, createDelegation,
  evaluateIntent, commercePreflight, generateKeyPair
} from 'agent-passport-system/core'

// full API surface still available at 'agent-passport-system'
Architecture

Identity. Delegation. Action. Receipt.

The protocol pairs identity with delegation. Each action signs against both. The receipt is verifiable by any auditor without going through aeoess. Six scenes, switch tabs to walk the surface.

Capabilities

Twelve primitives in one protocol.

Each primitive is a typed envelope with deterministic canonicalization (RFC 8785) and Ed25519 signatures. The SDK exports them; the MCP server exposes them; the gateway enforces them.

IDENTITY
Every agent gets a cryptographic identity. Ed25519 signatures, deterministic canonicalization, verifiable by any auditor.
DELEGATION
Authority can only narrow. A parent can never give a child more scope than it holds. Provable at every step.
REPUTATION
Trust is earned through performance. Each receipt updates a Bayesian score. Scores travel with the passport.
COORDINATION
Agents discover each other through signed capability ads. No central registry, no single point of trust.
COMMUNICATION
Every message is a signed envelope. Tamper-evident, replay-resistant, addressable by DID.
GOVERNANCE
Policies are first-class objects. Versioned, signed, and evaluated at the gateway.
COMMERCE
Spend caps, currency limits, recipient allowlists. Enforced before the call leaves the agent.
DATA
Per-resource scopes. Read vs. write. Time-bounded. Auto-expires.
NETWORK
Egress is gated. Allowlists by host and method. No silent exfiltration.
TEMPORAL
Every passport has a TTL. Every delegation has a TTL. No long-lived credentials by default.
ATTRIBUTION
Every action carries the chain that authorized it. Forensics by replay, not by guessing.
COMPOSITION
Sub-agents inherit a strict subset. Delegation chains form a tree the gateway can revoke at any node.
Quick start

Mint, delegate, verify.

Three calls cover the full audit loop. Authority can only narrow. Every action emits a verifiable receipt.

quickstart.tsTypeScript
import { createPassport, signDelegation, verifyReceipt } from 'agent-passport-system';

// 1. mint a passport for an agent
const passport = await createPassport({
  identity: 'did:web:agents.example.com:agent-1',
  scopes:   ['read:invoices', 'spend:usd<=200'],
  ttl:      '24h',
});

// 2. sign a delegation that can only narrow the scope
const delegation = await signDelegation(passport, {
  to:     'did:key:z6Mki...sub-agent',
  scopes: ['read:invoices'],
  ttl:    '1h',
});

// 3. every action emits a receipt your auditor can verify
const ok = await verifyReceipt(receipt, { rootPassport: passport });
Independently cited

Where the protocol shows up outside this repo.

University of British Columbia
Personal Data Repositories, validates APS Bayesian reputation model
Zenodo · doi:10.5281/zenodo.19323172
Microsoft Agent Toolkit
Reference integration of APS for delegation and audit
PR in review
NIST NCCoE
Concept paper on agent governance primitives
submitted

Read the spec, run the SDK, file an issue.

GitHub SpecDev log