An open protocol for accountable AI agents

Open-source enforcement infrastructure for AI agents

● Protocol LiveApache-2.0— installs
AI agents are moving money, signing contracts, deploying code, and accessing sensitive data on behalf of companies and people. Today, most companies ship without cryptographic answers to who authorized them, what scope applies, or how to revoke them downstream.
Today
Agents act anonymously. No audit trail. No spending controls. Revocation means shutting everything down. You find out after the damage.
With Agent Passport System
Every agent carries a signed identity. Authority can only narrow, never expand. One call revokes downstream. Full cryptographic audit trail.
IdentityBring your own: did:key, SPIFFE, OAuth
DelegationScoped, revocable chains
CompositionCross-DID-method identity contract
Mutual AuthAgent ↔ service handshake
ReputationEarned trust, scoped to context
GovernanceValues floor enforcement
Commerce4-gate spending controls
PaymentsAgent-to-agent, delegation-scoped
AttributionMerkle-proven audit trail
Instruction ProvenanceDrift denial across turns
EnforcementGateway boundary, <2ms
RevocationCascade, one call kills all
<2msPolicy eval
20Essential tools
2,884Tests
Full surface area: 150 MCP tools, TypeScript + Python SDKs.
Independently cited — PDR in Production (University of British Columbia) validates APS Bayesian model. Zenodo
$ npm install agent-passport-system
$ clawhub install agent-passport-system
Quick Start — Core subpath, curated essentials
// import the curated essentials
import {
  createPassport, createDelegation,
  evaluateIntent, commercePreflight, generateKeyPair
} from 'agent-passport-system/core'

// full API surface still available at 'agent-passport-system'
Updates
May 11shipbudget_authority crosswalk v0.1 lands at vocab repo with cycles maintainer signoff — PR #91 opens with six canonical verbs (reserve, commit, release, refund, query_budget, query_reservation) and per-verb candidate/proposed status. amavashev (Cycles maintainer) reviews against runcycles/client.py + cycles-protocol-v0.yaml, confirms two corrections on query verbs and refund row, then approves. Track B review pass and maintainer signoff complete.
May 11convergenceA2A#1829 four-way alignment locks on v0.3.3 working-doc + canonicalization stance — jschoemaker independently byte-match verifies our envoys-rfc9421 fixture against §13 Vector 2. kenneives commits to hosting the v0.3.3 working doc at agentgraph-co. arian-gogani confirms canonicalization position: JCS + numeric profile, no floats, semantic equivalence at tool-version layer. Five-layer composition framing carries refinement: per-receipt-type layer attribution rather than per-protocol.
May 11researchSSRN approves five APS research papers for academic indexing — Five papers cleared review with DISTRIBUTED status: Paper 1 Agent Social Contract, Paper 2 Monotonic Narrowing, Paper 5 Physics-Enforced Delegation, Paper 7 Cognitive Attestation, Paper 8 Evidence-Safety Gap. Each routed to 5-6 CS networks where reviewer audiences read. Crossref auto-updates the ORCID record.
May 10convergenceA2A#1496 spec author commits APS sits cleanly above identity framework — Libria (lead author of A2A#1496 base identity framework, CEO OpenA2A) posted three coordinated confirmations on A2A#1575/#1786/#1829. Codified four-layer composition: wire signature / identity framework / identity claims / delegation+continuity. APS delegation_receipt references #1496 §5 chain entries as inner cryptographic hop. Three independent endorsements now on §7.1 v1.5 standalone-section promotion.
May 10shipenvoys-rfc9421 composition fixture lands in conformance suite — Three deterministic vectors over jschoemaker @envoys/sdk v1.4.0 §13 keypair: RFC 9421 wire signature alone, wrapped in bilateral_receipt, wrapped in 3-link delegation chain. 39 PASS / 0 FAIL, byte-identical across three runs. kenneives endorsed in A2A#1829 and committed cross-link from CTEF v0.3.2 §A Conformance Verification Appendix.
May 10convergenceAIVSS v0.1 review pass converges with VeloGerber — AiEGIS review covered Q1-Q4 open questions, five concrete section edits, four new TBD section proposals, four threat-model gaps. Accepted all decisions with two amendments: signed JSON published-scheme artifact for Q1, mandatory constraint_set_sha at v0.1 for Q4. v0.1 follow-up commit lands this week.
May 09convergencevocab #36: PDR signing key approved, Week 1 two-signal compose locked — nanookclaw confirmed a dedicated PDR attestation key. Week 1 interop plan locks to two signals: AgentID chain root paired with PDR continuity closing, recompute via evidence_inputs[]. Nobulex byte-match verifier from arian-gogani slots in Week 2.
May 09shipOWASP AIVSS v0.1.1 patch lands with 8 findings — Co-author cycle landed within 12 hours of VeloGerber's review pass: bound-language framing, sanity-check vs tier-eligibility shape split, substrate-count discriminator. Eight findings applied direct-to-main.
May 09convergenceargentum RFC 001 Active with APS receipt fields — giskard09 published genesis records: human Lightning 2100 sats and autonomous agent Arbitrum 210 wei stake on the same date. SPORE stake computation reads APS receipts.
May 08shipFirst external PR on aivss-enforcement-effectiveness merged — VeloGerber published the canonical race-test fixture for the time-to-enforce dimension. SHA-256 byte-match verified against WORKING-TEXT.md citation; pure-stdlib portable runner exits 0 on fresh checkout with P99 4.57ms under the 50ms spec bound. PR-MERGE-PROTOCOL Track A discipline applied.
May 08convergenceFour-signal interop compose locked with three production implementers — nanookclaw committed to authoring fixtures/interop-week-1/composition-behavioral-trust.json by May 22 with PDR entity_continuity as closing attestation. AgentID trust_verification chain root, PDR continuity closing, Nobulex byte-match verifier. Three production implementers, three independent verification paths.
May 08standardOWASP AIVSS enforcement_effectiveness v0.1 body shipped — 3,800-word working text covering structural enforcement, empirical block-rate, time-to-enforce, and enforcement_locus dimensions. Co-authored with @VeloGerber. Customer-locus precondition set with verification paths landed in §5.3.
May 08standardAPS listed in awesome-x402 ecosystem directory — xpaysh/awesome-x402 PR #328 merged. The canonical curated list for protocols building on Coinbase\'s x402 payment standard now includes APS under Related Protocols. Ecosystem map updated.
May 07convergenceOWASP AIVSS enforcement_effectiveness working text co-authored — VeloGerber concurred on the four-axis dimension structure: structural enforcement, empirical block-rate, time-to-enforce, enforcement_locus. Working text scoped to the dimension family, separable from the broader v1.0 rubric.
May 07shipMycelium dual-chain anchoring confirmed live — argentum verify endpoint returns Arbitrum One (chain 42161) plus Base mainnet (8453) anchors per receipt-id. Three-surface alignment operational: APS receipts, Mycelium dual-chain TrailRecord, Asqav RFC 3161 + OpenTimestamps.
May 07standardCoinbase agentkit + crewAI Guardrails ecosystem engagements — On Coinbase agentkit#1091, two-layer reading with Aigen-Protocol\'s SafeRouter (above-chain authorization plus on-chain target-safety). On crewAI #4877, common GuardrailDecision shape proposed; two providers convergent so far (APS + AgentID).
May 07shipVocab system_attributes wave — #78 (SAR) and #79 (continuity-analyzer) merged with conformant values. #86 validator enum enforcement merged. #87 (temporal-correctness gap) and #88 (soft-fail warnings) opened for follow-up. AgentID maintainer endorsed Option C.
May 06standardOWASP AISVS revocation-to-enforce dimension — VeloGerber\'s race-test methodology engaged on owasp-aisvs#31. Time-to-enforce proposed as a third axis alongside structural enforcement and empirical block-rate. Reciprocal APS-side race-test fixture committed for v1.0 panel review.
May 06standardVocab validator blocks phantom-issuer drift — PR #86 adds CI rejection of signals that name an issuer not present at maturity:in_production in the registry. Structural fix for the failure class behind the Day 76 audit.
May 06convergenceCross-rail PaymentReceipt locked with Mycelium + Asqav — Three independent persistence surfaces (APS, Base, RFC 3161+OTS) aligned on the existing PaymentReceipt shape with zero new types. Permit/revocation/re-issue lifecycle fixture landed in stripe-issuing.
May 05shipTier-2 binding-adapter conformance harness — 55 new tests landed, 2,911 total. Validates payment-rails adapter behavior across the bilateral attestation surface.
May 05convergencebilateral_receipt schema convergence — kenneives (AgentGraph) concurred on three positions: name, hybrid-registry pattern, normative issued_at. Awaiting Nobulex on purpose-discriminator.
May 05standardVocab issuers_in_production audit closed — Day 76 audit both subtracks closed. Three phantom issuers downgraded to proposed (ThoughtProof, Revettr, Maiat). All 8 maintainer.confirmed_at dates backfilled. Issue #82 opened for AgentID, AgentGraph, PDR crosswalks.
May 05shippropagate.mjs Bug 3 fix — Verify-pass scanner now excludes historical content (UPDATES arrays, BUILD:ROADMAP regions, APS_PROFILE subset references). False-positive count dropped from 30 to 2.
May 04shipFull website redesign — 33 pages restrained design, agent-discovery alternates in head, /sitemap.html overview, every link wired, dark/light toggle.
Apr 03shipBring Your Own Identity — did:key, did:web, SPIFFE SVID, OAuth interop. Python SDK proves cross-language: signatures round-trip TS ↔ Python.
May 03shipPhase 4.1 alpha across four registries — SDK 2.6.0-alpha.2, MCP 3.2.0, Python 2.4.0a2, Skill 5.9.0. Rail receipts as accountability evidence (claim_type + scope_of_claim), DID URI signer with rotation-aware verifier, cross-receipt link fields. 2,884 tests. npm
May 03convergenceBilateral receipt cross-impl byte-match — APS canonical-bytes path verifies 5/5 against desiorac's qntm v0.3.1 fixture, independent of the Wave 1 cross-language scenarios. Mirror offered into aeoess/aps-conformance-suite for v0.3.2 mid-May publish. qntm #15
May 02shipSDK 2.6.0-alpha.0 on npm — v2 evidentiary type safety landed: claim-evidence-types registry with BATCH_ATTESTED and EVIDENCE_CUSTODY_HELD extensions, claim-verifier module, contestation cascade with verifier hook, path-scoped cycle detection in mergeTaints. 2,884 tests passing. npm
May 02shipPython SDK 2.4.0a1 on PyPI — Full Wave 1 surface ported from TS: v2/accountability/* (action, authority-boundary, bundle, custody, contestability), v2/cognitive_attestation/*, v2/instruction_provenance/*. Cross-language byte-parity verified across 27 fixtures (15 evidentiary + 12 Wave 1). 518 tests. PyPI
May 02standardVocab phantom-issuer audit — PR #74 removed RNWY from behavioral_trust and wallet_intelligence (couldn't verify those signals are issued in production); PR #75 marked passport_grade as status: proposed (single-issuer rule). Single-source-of-truth discipline. PRs #74 + #75
May 01standardVocab PR #72 openedcompletion_ratio as canonical signal type with three production issuers (AgentID, APS, RNWY). Descriptor enforcement_class advisory, completion_ratio_method constraint with strict and quality-weighted modes. PR #72
May 01shipVocab validator hardened — nested descriptor_dimensions walk under signal_types + legacy whitelist for #57 stale values. Three pre-resolution descriptor uses preserved without warning maintainers. validator
May 01shipDrift prevention infrastructure live — pre-commit hook + CI scan + standardized .gitignore + final-scan propagation across eight public repos. Four layers, one structural backstop against private-context drift.
Apr 30shipWave 1 accountability shipped — Five signed receipt primitives (action, authority-boundary, custody, contestability, bundle). RFC 8785 + Ed25519, deterministic byte-match fixtures, 57 new tests. SDK v2.6.0-alpha.1. module README
Apr 30tractionVocab PR #66 merged — Edison Munoz Duran's Agent-DID crosswalk lands as the second co-drafted-with-aeoess crosswalk. A2A composition contract co-drafting in flight on a shared spec branch. PR #66
Apr 30convergenceVeritasActa cross-layer integrity 10/10 — Knowledge Unit bundle with sidecar-anchored APS DecisionLineageReceipt verifies end-to-end. All ten access receipts cross-layer hash-matched, APS signature valid against sidecar JWKS. Tamper-detection holds across both layers. verify PR #7
Apr 29paperPaper 8: The Evidence-Safety Gap — Cryptographic agent governance proves procedural validity, not effect safety. Compliance-complete failure named, five omitted-variable classes catalogued, defeat traces in reference implementation. Zenodo.
Apr 29tractionSSRN + ORCID research surface — Three papers entering SSRN (Agent Social Contract, Physics-Enforced Delegation, Cognitive Attestation). ORCID 0009-0002-4700-3594 live with all 8 papers indexed via DOI.
Apr 29tractionVocab PR #52 mergedentity_continuity PDR validator with @nanookclaw, 309 LOC pure-Node + 32-test suite + four reference fixture vectors. Behavioral-fingerprint-drift validator complementary to continuity-analyzer's structural fixture. PR #52
Apr 29standardVocab PR #61 mergedepoch added to validity_temporal enum, observer-relative ticks on substantive state transitions distinct from sequence's event-relative counts. Issue #58 settled with @lawcontinue's endorsement. PR #61
Apr 29standardVocab PR #62 mergedgovernance_attestation.refusal_authority brought into formal enum compliance (structurally_impossible_to_violateissuer). One-line correction, @lowkey-divine concurred on issue #57. PR #62
Apr 29tractionVocab PR #56 merged — AuthorPrime's Sovereign Atom crosswalk, third independent entity_continuity implementation alongside SBR-002 and continuity-analyzer. PR #56
Apr 28tractionIPR module on npmagent-passport-system@2.4.0-alpha ships canonicalize/envelope/verify for binding agent authority to instruction-file digest at delegation. npm
Apr 28tractionVocab PR #63 merged — piiiico added trust_verify endpoint to AgentLair behavioral_trust, AAT-based lookup without agentId resolution. PR #63
Apr 27standardagent-governance-spec org created — cross-vendor spec home, co-edited with Lars Kroehl (MolTrust). spec repo
Apr 27tractionVocab PR #59 merged — DCP-AI crosswalk, composite Ed25519 + ML-DSA-65 in production. PR #59
Apr 27tractionVocab PR #53 merged — AgentNexus three-issuer fixture, Step 2 of the Interop Week 1 compose chain. PR #53
Apr 27convergenceVocab #58 epoch enum: three-way endorsement — lawcontinue, kenneives, srotzin. #58
Apr 26shipcontributor-check installed — MS AGT v3.3.0 composite action live on agent-passport-system, agent-passport-mcp, agent-governance-vocabulary. Pinned to commit 15e001f9b53f, threshold HIGH for calibration window. action source
Apr 26shipVocab PR #55 opened — APS ↔ ACTA receipt crosswalk, 14 mappings (1 exact, 7 partial, 3 divergent, 2 no_mapping, 1 non_equivalent). Calibrated against @veritasacta/* and protect-mcp. PR #55
Apr 26shipaeoess/governance-attestation-predicate live — in-toto sibling to nobulex's Decision Receipt PR #549. JWS+Ed25519, 5 fixture vectors, composition test passes. repo
Apr 26shipaeoess/aps-conformance-suite live — 37 fixture vectors across 4 categories (bilateral-delegation, inference-session, instruction-provenance, AIVSS scenarios). All byte-identical reproducible. repo
Apr 25shipVocab PR #51 openedinvariant-survival.md descriptor doc co-authored with QueBallSharken (BBIS). PR #51
Apr 25shipVocab PR #52 openedentity_continuity PDR validator with 32 tests, co-authored with nanookclaw. PR #52
Apr 25tractionVocab PR #49 merged — PIC Standard becomes the 23rd crosswalk, modeled as parallel verification surface to visa-layer issuance. PR #49
Apr 25tractionVocab PR #46 merged — AgentLair becomes the third production issuer of behavioral_trust, alongside RNWY and Logpose. PR #46
Apr 25shipaps-system PR #19 merged — lawcontinue's seven-vector CTEF inference-session fixture pack, all RFC 8785 JCS-canonicalized and Ed25519-signed. PR #19
Apr 25convergenceharness PR #1 — MoltyCel published moltrust v0.2.0 to PyPI and opened a draft adapter PR. Mark-ready expected Monday. PR #1
Apr 24standardA2A extension proposal openedclaim_type discriminator over {identity, transport, authority, continuity}. Aligns to CTEF v0.3.1, no proto changes. issue
Apr 24convergenceFive-way claim_type convergence — AgentGraph, AgentID, APS, Nobulex, and HiveTrust aligned on the wire-format key after a mid-thread rename. #1672
Apr 24standardOpenClaw #49971 closed — steipete's ruling: trust providers build on five existing public hooks rather than a new core API. #49971
Apr 24convergenceCanonicalization loop closed with AgentGraph — three harnesses now lock through RFC 8785 JCS bytes. Five fixtures byte-identical. thread
Apr 24shipRotation-attestation fixtures v1 live at fixtures/rotation-attestation/. RFC 8785 JCS, deterministic generator. test-vectors
Apr 24shipautogen-governance-adapter PR #1 — first external security contribution. pshkv fixed a silent JWKS kid fallback in _lookup_issuer_key. PR #1
Apr 24shipHousekeeping batch shipped — seven AUDIT-2026-04-24 fixes across six packages. Audit spec bumped to v2.3. completion
Apr 23convergenceMicrosoft AGT #1354 — interop proposal posted, mapping #1386's three questions to named APS primitives. Pending response. reply
Apr 23convergenceCTEF v0.3.1 adopts APS composition-rule table verbatim — four-row per-layer grammar pulled into §6.3 as normative. thread
Apr 23shipFull Code Audit v2.1 — pre-publish spec rewritten to forty-two steps across fourteen repos. Three tiers: code integrity, supply chain, runtime. prompt
Apr 23shipPR Merge Protocol v0.2 — added Seven Deep-Review Dimensions for substance issues that pass surface checks. CONTRIBUTING.md expanded. CONTRIBUTING
Apr 23standardBBIS classification grammar adopted — Hensley's five-bucket model replaces the prior taxonomy. M4 EffectReceipt renamed to FRCBE per qntm#7. qntm#7
Apr 23shipAgent Ecosystem Directory shipped — three sortable tables: 18 projects, 115 contributors, 93 governance threads. Live GitHub data. directory
Apr 22shipautogen-governance-adapter v0.1 shipped — glue for autogen's before_tool_call hook. governedToolCall() with provider-agnostic TrustProvider, 12 tests green. repo
Apr 22tractionThird aeoess PR merged in microsoft/agent-governance-toolkitexamples/cognitive-attestation-governed/ landed via PR #1328. PR #1328
Apr 22tractioncomposed/v1 extends from three to four signals in seven hours — schchit added JEP as decision_event fourth signal. PR #8
Apr 22shipMutual Authentication v1 shipped (SDK v2.6.0-alpha.1) — downgrade-proof four-step handshake, A2A and MCP adapters, 29 new tests. module README
Apr 21shipcomposed/v1 three-signal worked examples — first AgentID + APS + AgentGraph envelope under one shared subject DID. Kenne LGTM'd. PR #7
Apr 21tractionMicrosoft AGT merged ADR 0006 on constitutional constraints, after our five posts on fanout-as-risk-signal. PR #1199
Apr 21shipa2a-compliance-harness v0.1 shipped — five-step Python check for A2A Agent Cards. repo
Apr 21shipA2A trust-header Week 3 — dual-provider verifier, 9/9 fixtures pass. MolTrust ready for drop-in. PR #6
Apr 21standardOpenLineage upstream PR opened — AgentAttributionRunFacet spec, four DCO-signed commits, CI green. First Agent Passport System contribution to LF-hosted. PR #4480
Apr 21standardcontext_dimensions added to vocabulary — third top-level section, four day-1 entries. PR #34
Apr 21tractionInterop Week 1 Step 1 fixture merged — AgentID trust_verification fixture. PR #38
Apr 20shipCognitive Attestation envelope (SDK v2.1.0)Paper 7 primitive ported to SDK. JCS canonicalization, three-stage verification, typed dispute primitives.
Apr 20shipverifyBoundWallet object-form overload — Asymmetry with bindWallet gone. MoltyCel's ask in SDK#16.
Apr 20standardAPS filed with AAIF — Project proposal #14. Path toward Linux Foundation stewardship for the protocol layer. Commercial stack kept independent.
Apr 20shipv2.0.0 promoted to npm @latest — SDK + MCP + Python flipped from @next. v1.46.0 / MCP v2.27.0 parked on legacy-v1 for six months. Four partner integrations landed clean during the stability window. Release notes
Apr 19tractionInterop Week 1 opened — Five-signal compose test proposal. Two fixtures confirmed within 45 minutes of open (Nobulex step 2, continuity-analyzer step 3). vocab#36
Apr 19tractioncontinuity-analyzer crosswalk merged — nutstrut's PR #33 after a five-check protocol review.
Apr 18shipAgentNexus Track A round-trip — Fixtures verify end-to-end under APS. JCS + Ed25519 + delegation walk + monotonic narrowing. PR #17
Apr 18shipVeritasActa KU receipt signer — APS receipt slots into external_receipts.aps. Cross-verified. PR #7
Apr 18paperPaper 7: Cognitive Attestation — A cryptographic commitment attached to an agent's action record, to which sparse-autoencoder features were active during the decision. Envelope spec, three-stage verification, four dispute primitives. Experimental results against Llama-3.1-8B via Neuronpedia. Zenodo.
Apr 18tractionVocab registry at 14 external crosswalks — SINT refresh (PR #30) and RNWY A2A Agent Card mapping (PR #32) both merged same day.
Apr 18tractionMnemoPay composition hook — Three-point read on x402#1904. Composition via delegation-reference in X-Agent-Identity.
Apr 18tractionArkForge three-plane decomposition — +1 on desiorac's delegation/decision/execution model. Notes-column cross-reference pinned in ECOSYSTEM table. ATF#8
Apr 17tractionaeoess-aps crosswalk published — First time we published our own crosswalk alongside the twelve external partner crosswalks in the registry.
Apr 17tractionAPS added to governance_attestation.issuers_in_production — 4th production issuer via Build D2 JWS trust profiles.
Apr 16shipBuild C — Settlement Pipeline — Per-period signed settlement records aggregating Attribution Primitives across D/P/G/C axes. 3 new MCP tools, 123 modules. Blog
Apr 16shipBuild A — unified four-axis attribution primitive — One signed Merkle receipt across D (data), P (protocol), G (governance), C (compute). Four independently-verifiable projections, one envelope. SDK v2.0.0, MCP v3.1.1, Python v0.13.0. Blog.
Apr 15shipSDK v2.0.0 — Solana wallet_ref — Added to the chain enum with base58 validation. End-to-end wallet binding now spans Ethereum, Bitcoin, Solana.
Apr 15tractionVocabulary registry — four PRs merged — asqav (ML-DSA-65), JEP, insumerapi license fix, validator cleanup. 14+ contributors since Apr 11. Repo.
Apr 14paperGovernance in the Medium — paper published — Unit of agent governance is the population-with-medium, not the agent. Six rounds of adversarial review. Zenodo.
Apr 14shipThree boundary primitivesAttributionConsent, ProvisionalStatement, HumanEscalationFlag. Representation, commitment, escalation. SDK v2.0.0. Blog.
Apr 14tractionWG scope ratified — Authority Constraints + Vocabulary — 72-hour window closed on qntm#7. Six co-authors accepted with shipped-code evidence. qntm#7.
Apr 10shipPDR v2.19 adapter batch — six primitives — Six new exports close the gap between paper citations and shipped code. SDK v2.0.0. Blog.
Apr 10paperPDR in Production v2.19 cites Agent Passport System — Three-axis framework; Agent Passport System is the within-session fidelity axis. §8.10 substrate-swap is the test that would settle the orthogonality claim.
Apr 10shipAgent Governance Vocabulary repo — Neutral canonical-naming layer. Four teams converging in the first hour. Blog.
Apr 10tractionCross-vendor convergence — APS + MolTrust + AgentNexus on a shared governance_attestation envelope. APS ↔ SINT handshake v1.0-draft landed with 11 conformance tests.
Apr 9shipRepositioning — SDK leads with /core (25 curated functions), MCP defaults to APS_PROFILE=essential (20 tools). Full surface still available. Blog.
Apr 8shipQuantum governance on real hardware — 7 experiments on IBM Quantum. Bell 5.2pp, GHZ 7.7pp fidelity gaps. Blog.
Apr 8paperPaper 5: Physics-Enforced Delegation — Governing quantum hardware quality. Zenodo · Code.
Apr 8tractionExternal verification — tomjwxf verified 3/3 APS composition receipts via protect-mcp (first cross-engine). OWASP BBIS scored APS 10/12.
Apr 8paperPaper 4: Behavioral Derivation Rights — Telemetry scopes, BMOs, BYOM. Zenodo.
Apr 7shipNew protocol primitives — Bilateral completion receipts, scope_version_hash, measurementType discriminator, per-task-class trust profiles.
Apr 5ship6-session build day — Key rotation, auto-mint receipts, audit packets, 9-section governance export, trust bootstrap adapters. Blog.
Apr 4shipMicrosoft AGT approved + SINT v0.2 shipped — AGT PR#598 approved (fail-closed signature verification). SINT v0.2 shipped with our delegation_depth_floor. Blog.
Apr 4standardW3C behavioral attestation spec normative — Timing asymmetry became normative. Evidence-based passport grading + freshness semantics across 11 threads.
Apr 3shipBring Your Own Identity — did:key, did:web, SPIFFE SVID, OAuth interop. Python SDK v0.8.0 proves cross-language: signatures round-trip TS ↔ Python. Blog.
Apr 3tractionMicrosoft AGT PR fixes + production audit PASS — Fail-closed verification, dependency pinning, input validation pushed. Audit clean.
Apr 2shipSDK v2.0.0 — governance hardening — 34 new tests. 3-layer architecture convergence across OpenShell, OWASP, W3C. Blog.
Apr 1shipFirst Code Integration + 5 Security Fixes — PR merged (Solana Agent Kit). 12 features, 5 security gaps closed, compaction-drift probe, tool integrity. 29 threads, 99 modules, 2,085 tests. Blog
Mar 29shipAgent Wallets — Nano payment rail + wallet system. Feeless, delegation-scoped. Wallet · Blog
Mar 29shipPixel attribution live — Data source tracking, access receipts, derivation chains, settlement. Dashboard
Mar 29tractionCited in production paper — PDR in Production (University of British Columbia) validates APS Bayesian model. Zenodo
Mar 28rebrandAn open protocol for accountable AI agents — Academic redesign. Enterprise positioning. 10-question FAQ. Blog
Mar 27paperFaceted Authority Attenuation — Product lattice model. Seven dimensions. Zenodo
Mar 27standardIETF Internet-Draft submitted — draft-pidlisnyi-aps-00. Zero idnits errors.
Mar 26shipInstitutional governance layer — Charter, offices, approval, federation, reserves. Blog
Mar 25deployFirst publication deploys APS — Every article cryptographically governed.
Mar 25shipGovernance distribution — aps.txt, 360 consumer loop, 150 MCP tools. Blog
Mar 25shipInteractive protocol map — 57-module molecular layout. Blog
Mar 24standard3 WG specs ratified — QSP-1, DID Resolution, Entity Verification. Blog
Mar 23shipOATR founding member + data governance — Ledger, settlement, attribution. Blog
Mar 22shipConstitutional v2 complete — 32 modules. 2,085 tests. Blog
Mar 22shipFirst encrypted relay envelope — E2E through qntm bridge. Blog
Mar 21shipDecision semantics — Content-addressable decisions. Blog
Mar 20standardAMCS v0.1.0 — AI-native media credentialing spec. Spec
Mar 20shipData attribution layer — Contribution receipts, Merkle proofs. Blog
Mar 19ship8 modules in one session — Oracle witness, audit bridge, policy conflict, key rotation. Blog
Mar 17standardWG spec demand — Three groups asked for the same thing. Blog
Mar 16tractionYC CEO endorsed — Garry Tan repost. Microsoft merged APS code. Federal agency reviewing. Blog
Mar 15shipMingle v2.0 — Semantic matching, persistent identity, ghost mode. More
Mar 14shipSubstack launch — Cross-protocol bridge article. Blog
Mar 12shipMingle v1 ships — Your AI finds people for you. Blog
Mar 11shipIntent Network — Publish-discover-match for agents. Blog
Mar 10shipReputation-gated authority — Agents earn trust, not just receive it. Blog
Mar 9paperPaper 2: Monotonic Narrowing — Authority attenuation formalized. Zenodo
Mar 7shipAutoresearch — AI finds bugs AI wrote. Blog
Mar 6shipPrincipal identity + Python SDK — Three new protocol extensions. Blog
Mar 5standardOWASP AI Security mapping — Community health baseline. Blog
Mar 4shipSDK v1.21.2 + MCP v2.12.0 — Two agents get their next mission. Blog
Mar 3shipFirst real audit — Agents review the code. Blog
Mar 2shipGraduated enforcement + threat model — Agent District RPG. Blog
Mar 1shipAgentic commerce — Layer 8. 4-gate checkout. MCP v2.1.0. Blog
Feb 28shipDocumentation sprint — llms.txt, passport spec. Blog
Feb 27shipCoordination primitives — Task lifecycle, evidence, review. Blog
Feb 25shipIntent architecture — Layer 5 foundations. Blog
Feb 21paperPaper 1: The Agent Social Contract — First formalization. Zenodo
Feb 18startProject begins — Ed25519 identity, delegation chains, first tests.
What is Agent Passport System
What does the protocol do?
Agent Passport System makes every AI agent accountable. Every agent gets a cryptographic identity (Ed25519). Authority can only narrow, never expand. Trust is earned through performance, not granted. One API call revokes all downstream access. Cryptographic proof of every action, every dollar, every decision.
How is it different from other agent frameworks?
Most frameworks handle orchestration. Agent Passport System handles enforcement: what can this agent do, and what happens when it violates a constraint? Bring your own identity (did:key, did:web, SPIFFE, OAuth, did:aps). The gateway is both judge and executor. Monotonic narrowing, cascade revocation, earned reputation, values floor enforcement, 4-gate commerce, agent-to-agent payments, Merkle-proven attribution, cross-DID-method composition, mutual authentication, instruction-provenance receipts. Policy eval under 2ms. 2,884 tests. Works with any framework.
Is this production-ready?
Policy evaluation in under 2ms. 403 ops/sec sustained throughput. Sub-millisecond denial. 14 constraint dimensions checked per action. 2,884 tests. Eight published papers. An IETF Internet-Draft (draft-pidlisnyi-aps-00). 20 essential MCP tools (150 total). SDK on npm and PyPI. tens of thousands of installs. Independently cited by PDR in Production (University of British Columbia). Apache-2.0 licensed.
Who is this for?
Anyone deploying AI agents that act on behalf of people or companies. Enterprises that need audit trails and spending controls. Developers building multi-agent systems. Platforms that need to verify which agents can do what.
How does delegation work?
A human delegates authority to an agent with explicit scope: what tools, how much money, which services. The agent can sub-delegate, but authority can only narrow, never expand. Revoke the root and everything downstream dies instantly.
How do I integrate with my existing framework?
Agent Passport System works alongside any agent framework — CrewAI, LangChain, A2A, ADK, or custom. The SDK provides the identity and governance layer; your framework handles orchestration. The MCP server exposes every protocol operation — 20 essential tools by default, full surface under APS_PROFILE=full. Install the SDK, issue a passport, attach it to your agent. The framework doesn't need to change.
How does revocation work at scale?
Cascade revocation. Delegation chains form a tree. Revoke any node and every downstream delegation dies instantly — all sub-agents, all sub-sub-agents. One API call. The gateway enforces this at the boundary, so revoked agents can't sneak through on cached credentials. Circuit breakers auto-trip on error rate spikes.
Is there a standard?
Yes. draft-pidlisnyi-aps-00 is submitted to the IETF. Eight papers on Zenodo formalize the theory: monotonic narrowing, product lattice authority model, institutional governance composition. Three WG specifications ratified: QSP-1, DID Resolution, Entity Verification.
What about compliance?
The SDK includes EU AI Act Article 10 mapping and AIVSS risk assessment (5 strong, 3 partial, 2 weak — honestly rated). Every action produces a signed receipt. The audit trail is cryptographic, not log-based. Compliance reports can be generated from the receipt chain.
For AI agents: Visit AGENTS.md for agent-friendly project instructions, llms.txt for machine-readable documentation, llms-full.txt for the full technical reference, or .well-known/mcp.json for MCP server discovery. This page is designed for humans.