the agent economy
Agent Passport System
Enforcement · Evidence · Attribution
Verifiable identity, scoped authority, and signed proof for every AI agent action.
Agent actions create enterprise liability.
When a person acts for a company, trust is built in: a title, a mandate, an approval chain, and someone who answers if it goes wrong. When software acts for a company, none of that is attached. The action happens. The proof does not.
“The agent did it” is not an answer.
Money
spend / approvals
Customer data
access / handling
Regulated workflows
records / audit
External APIs
real-world effects
Access is not authority.
A login authorizes a session. APS authorizes an action.
A token proves a system was allowed through the door. It does not prove the agent had the right to make a specific decision, at that time, under that policy, for that principal.
A passport for every agent.
APS proves who authorized an agent, what it was allowed to do, and what actually happened.
A cryptographic trail of authority, enforcement, and action.
Identity
Which agent acted, and the person or company it acted for.
Scoped authority
The limits, budget, and conditions it operates under, enforced at runtime. Authority can only narrow as it is delegated, never widen.
Evidence
A signed receipt for every action, allowed or denied, stating what it proves and what it does not.
APS does not replace identity providers, wallets, or orchestration. It sits beside the protocols you already run, as the governance layer.
Authority flows down.Evidence flows back.
A principal grants authority, each step narrows it, the gateway checks it before the action runs, and every action returns a signed receipt.
Each delegation can only shrink what the agent may do.
The world runs on receipts.
Bills, agreements, records: proof that travels with the transaction. APS applies the same idea to agents. Every meaningful action gets a signed, tamper-evident receipt of what the agent did, under what authority, and for whom.
Do not take our word for it: read one.
vendor.payment.approve 200 OK
Something happened. Written by the party being audited, after the fact.
{
"claim_type": "aps:action:v1",
"receipt_id": "b3f1c2..." // (sha256 over the canonical receipt),
"timestamp": "2026-06-19T17:20:31.412Z",
"signer_did": "did:aps:z6MkGateway...#key-1" // (gateway signing key as a DID URI; verifier resolves key rotation),
"agent_did": "did:key:z6MkAgent...",
"delegation_chain_root": "fdd7f810..." // (sha256 of the canonical delegation chain),
"action": {
"kind": "vendor.payment.approve",
"target": "vendor:acme-1042",
"parameters": { "amount": "200.00", "currency": "USD" }
},
"side_effect_classes": ["financial"],
"scope_of_claim": {
"asserts": "The gateway authorized this action under a delegation chain that narrows to the named principal.",
"does_not_assert": ["that the agent understood why it acted", "that the counterparty fulfilled the order"],
"capture_mode": "gateway_observed",
"completeness": "complete",
"self_attested": false
},
"signature": "ed25519:9a2f..."
}
A log says something happened. A receipt states who authorized it, what scope applied, what policy evaluated it, what action occurred, and what it does not prove.
The vendor can't grade its own homework.
Model companies build the agents. The people relying on them need neutral proof.
Independent of both the payment rails and the model vendors. Proof before the action, evidence after.
Attribution follows the agent.
Identity is where this starts. Beneficiary attribution is the bigger prize.
When an agent creates work, moves value, or produces an outcome, the person or company behind it stays the principal who participated.
Earned, traceable, and provable back down the delegation chain to the named principal.
Agents already run on rails.APS makes the action on them accountable.
Payment rails
Spend authority tied to a signed delegation, with a receipt for each charge.
Agent protocols
Identity and scoped authority travel with the call. An MCP server exposes the surface as tools; an adapter carries it across A2A.
Agent definitions
gitagent-protocol, a git-native format for defining agents, merged our RFC adding an optional cryptographic identity layer.
Frameworks
The passport rides into the agent runtime alongside the orchestration you already use.
Some of these are bindings the project ships, others are contributions merged upstream. None of these ecosystems depend on APS.
Trust cannot be proprietary.
Agents cross tools, clouds, wallets, payment rails, and jurisdictions. If the layer that records and verifies authority is owned by one company, the agent economy inherits that company's incentives and risk.
So the spec, the SDKs, the receipt format, and the conformance suite are open. Apache 2.0. Fork it, test it, challenge it.
$ npm install agent-passport-system
Cited independently in University of British Columbia research · Cross-engine receipt interop demonstrated with VeritasActa · Byte-parity between the TypeScript and Python implementations
Read the spec. Build an adapter.
Review the primitives, build integrations, test receipts, contribute to the vocabulary and conformance work.
The web needed TLS for trust in transit.
Card payments needed PCI for accountable handling.
Agent actions need their own accountability layer.
Autonomy is scaling faster than accountability. The agent economy needs passports.
Building it, in the open.