AEOESS: Governance for the Agent Economy

AI agents represent companies and people. They spend real money, access sensitive data, negotiate contracts, and talk to other agents. The world runs on receipts; agents leave none. The Agent Passport System (APS) is the open protocol that fixes that: cryptographic identity, delegation that can only narrow, gateway enforcement, and a signed receipt for every action, permitted or denied.

flowchart LR
    P["Principalfull authority"] -->|"delegates: scope, spend, time"| A["Agentnarrowed authority"]
    A -->|signed intent| GW{"Gatewayscope / spend / revocation / values floor"}
    GW -->|permit| ACT["Action executes"]
    GW -->|deny| STOP["Blocked"]
    GW --> RC[("Signed receiptevery outcome")]

Two rules carry the whole protocol. Authority can only decrease at each transfer point, never expand. And the gateway is judge and executor, not just an approver: nothing runs without an evaluation, and every evaluation leaves a verifiable record.

Start here

• Building an agent or integration → agent-passport-system. npm install agent-passport-system, import the ~24 curated core functions, working in minutes. Adapters for CrewAI, LangChain, Google ADK, A2A.
• Using Claude, Cursor, or any MCP client → agent-passport-system-mcp. npx agent-passport-system-mcp exposes the protocol as tools, 150 by default, or 26 with APS_PROFILE=essential.
• Verifying someone else's implementation → aps-conformance-suite. Byte-identical vectors; bring your canonicalizer.
• Researching or writing standards → the nine papers with Zenodo DOIs, the IETF Internet-Draft draft-pidlisnyi-aps, and the agent-governance-vocabulary registry.

What we ship

The protocol in one pass

Identity: Ed25519 passports, did:aps, key rotation; bring-your-own-identity accepted (did:key, did:web, SPIFFE, OAuth). Delegation: chains with monotonic narrowing and cascade revocation. Enforcement: the gateway boundary checks scope, spend, revocation, and values floor at execution time. Receipts: signed records for every verdict, recomputable correlation via action_ref. Commerce: 5-gate checkout with human approval and cumulative spend tracking. Attribution: Merkle proofs from action back to a named principal. Governance: charters, offices, approval policies, federation. Data lifecycle: access receipts, derivation chains, consent revocation, purpose-drift detection.

Each receipt states what it proves and what it does not prove. The protocol describes admissibility, not truth.

Standards and research

• IETF Internet-Draft: draft-pidlisnyi-aps
• Papers (Zenodo DOIs): The Agent Social Contract · Monotonic Narrowing · Faceted Authority Attenuation · Behavioral Derivation Rights · Physics-Enforced Delegation · Governance in the Medium · Cognitive Attestation · The Evidence-Safety Gap · Plausibly Wrong
• Vocabulary registry: agent-governance-vocabulary, canonical names and per-system crosswalks, 32 contributed crosswalk files

Apache-2.0 across the protocol. Copyright 2026 Tymofii Pidlisnyi.