Introduction

APS gives an AI agent a key-based identity, records the authority a principal grants it as a signed delegation, and signs records of what an enforcement boundary decided and did. A verifier can check those records later without trusting the agent that produced them.

A delegation narrows at each step: a sub-delegation can hold less authority than its parent, never more. Whether an action is actually stopped depends on where the check runs. Only calls that pass through an enforcement boundary are gated, and the boundary must hold the credentials the resource needs, so that a call it refuses cannot reach the resource another way.

What these docs cover

The Quickstart and the reference pages teach the current wire format, AuthorityDelegationV1 (record_type aps:authority-delegation:v1) with signed ReceiptV1 records, as published in agent-passport-system 8.0.1. The older social contract API and its Delegation format still work and are kept, tested, on Compatibility: social contract API.

Everything here is open source under Apache 2.0. The protocol is submitted as an individual Internet-Draft, draft-pidlisnyi-aps-04.

• Install and Quickstart
• Core concepts and Receipts: what they prove and what they do not
• Protocol reference: Identity, Authority and revocation, Signed bytes, Receipt verification and Status and conformance
• The gateway and the MCP server
• CLI reference and API reference
• Compliance evidence and status labels
• Specifications and Related work

Two import paths

The npm package has two entry points. The root import, agent-passport-system, carries the full surface, including every current authority, revocation and receipt function. agent-passport-system/core is a curated set of 25 older functions built around the compatibility Delegation format. Three of them, commercePreflight, revokeDelegation and cascadeRevoke, throw a migration error in 8.0.1. New integrations import from the root.

Packages

• SDK on npm: npm install agent-passport-system
• Python SDK on PyPI: pip install agent-passport-system
• Rust SDK on crates.io: cargo add agent-passport-system
• Go SDK on pkg.go.dev: go get github.com/aeoess/[email protected]
• MCP server on npm: npx agent-passport-system-mcp setup

The four SDKs do not expose the same features. See Install for what each one can do.