Open Agent Passport (OAP) v1.0 (draft)

The runtime trust rail for AI agents

---

The Agentic Era Demands New Standards

As AI agents become the primary interface for digital commerce, a fundamental question emerges: How do we trust what we cannot see?

Traditional identity verification answers who built an agent. But in a world where agents complete transactions in milliseconds, we need something more: real-time enforcement of what agents are allowed to do at the point of action.

The Open Agent Passport (OAP) v1.0 is the first specification designed for this new reality—a lightweight, cryptographically verifiable credential that enables Pre-action authorization for AI agents across any platform.

---

Why OAP Matters

The Problem

• Agentic commerce is accelerating, but trust infrastructure hasn't kept pace
• Merchants need instant verification before money or data moves
• Platforms require sub-100ms decisions at the point of action
• Current solutions focus on who built the agent, not what it can do

The Solution

OAP provides the runtime trust layer that makes agentic commerce safe and scalable:

• Pre-action authorization before sensitive operations
• Cryptographically signed decisions for audit trails
• Global suspend capabilities for instant risk mitigation
• Standardized policy packs for consistent enforcement

---

Core Specification

📋 The Foundation

• OAP v1.0 Specification — Complete normative specification
• Passport Schema — Agent identity and capabilities
• Decision Schema — Authorization decisions
• Security Model — Cryptographic verification
• Service Discovery — .well-known/oap/ endpoint specification

🎯 Policy Framework

• Capability Registry — Standardized capabilities and limits
• Conformance Requirements — Implementation standards

📝 Implementation Examples

• Template Passport — Agent template
• Instance Passport — Deployed agent
• Allow Decision — Authorization granted
• Deny Decision — Authorization denied

---

Verifiable Credentials Integration

OAP objects integrate seamlessly with W3C Verifiable Credentials for maximum interoperability.

🔐 VC Specifications

• JSON-LD Context — OAP VC context definition
• VC Mapping Guide — OAP ↔ VC conversion rules
• VC Examples — Passport and Decision as VCs

🛠️ Developer Tools

• CLI Tools — Command-line conversion utilities
• SDK Integration — Integration guide
• JavaScript Examples — Usage examples

---

Conformance Testing

Verify your implementation meets OAP standards with our comprehensive testing suite.

🧪 Test Runner

• Conformance Runner — CLI tool for validation
• Test Cases — Standard test scenarios
• Documentation — Usage and certification

📊 Coverage

• Schema Validation — JSON Schema compliance
• Policy Evaluation — Decision logic verification
• Signature Verification — Ed25519 cryptographic validation
• Performance Testing — Response time validation

---

Quick Start

For Platform Builders

1. Understand the Problem — Read OAP v1.0 Specification
2. See It in Action — Review examples for implementation patterns
3. Validate Your Implementation — Use conformance runner for testing
4. Integrate with VCs — Follow VC mapping guide

For Developers

1. API Integration — Use OpenAPI spec for client generation
2. SDK Implementation — Follow integration guides
3. Policy Development — Review capability registry

---

The OAP Ecosystem

How It Works

1. Agent Registration — Developers register agents with verified capabilities
2. Policy Evaluation — Real-time authorization at the point of action
3. Decision Recording — Cryptographically signed receipts for audit
4. Continuous Monitoring — Ongoing verification and risk assessment

Key Benefits

• Instant Trust — Sub-100ms authorization decisions
• Audit Trail — Cryptographically signed decision receipts
• Global Control — Instant suspend capabilities across platforms
• Standards Compliance — Built for regulatory requirements

---

Industry Adoption

OAP is designed to work with existing identity frameworks:

• KYA (Know Your Agent) — OAP implements KYA at runtime via policy packs
• W3C Verifiable Credentials — Full VC interoperability
• Existing KYC/KYB — Complements rather than replaces traditional verification

---

Versioning & Updates

• Version History — OAP specification versioning
• Changelog — Detailed change history

---

Contributing

We welcome contributions to the OAP specification and tooling.

• Contributing Guide — Development guidelines
• Main Documentation — Detailed feature documentation
• Examples — Code examples and tutorials
• Policy Packs — Available policy implementations

---

License

All specifications are released under the MIT License. See LICENSE for details.

---

---

Last Updated: 2026-02-15 18:32:09 UTC