Skip to main content

Agent passports

An agent passport is a portable identity and trust document for an AI agent. It describes who the agent represents, which capabilities it may use, which claims are attached to it, and how other systems can verify or revoke those claims.

Problem​

AI agents increasingly act across websites, local machines, APIs, and messaging systems. Today, most integrations identify either the human user or the API key, but not the delegated agent as a distinct actor with a verifiable scope and history.

Working definition​

An agent passport binds together:

  1. an agent identity;
  2. an owner or principal;
  3. allowed capabilities;
  4. signed intents or action grants;
  5. public or private claims;
  6. revocation and expiry data;
  7. audit references.

Why it matters​

Without a portable identity layer, every service has to answer the same questions from scratch:

  • Is this request user-authorized?
  • Which agent produced it?
  • What is the allowed scope?
  • Can this authorization be revoked?
  • Which claims can be trusted, and who signed them?