Skip to main content

Agent Identity Workshop #3 and Interop Day. Computer History Museum, Mountain View. November 5 and 6, 2026.

Give agents permission, not your password

An AI agent that holds your password looks like you to every service it touches. We work on the other way: the agent shows its own signed ID, and the service checks each action against a permission you gave. This week we are asking anyone who builds a verifier to test it against ours, and to let us test ours against yours.

Test your verifierRead the specifications, opens in a new tabEmail info@opena2a.org

Test your verifier against ours

The ATX conformance suite has 41 test credentials. Each file holds the credential, the settings a verifier needs to judge it, and the published answer. Two reference verifiers, one in Go and one in Python, agree with the answer on all 41. The kit needs Go 1.22 or later, or Go 1.23 or later on macOS 26. It uploads nothing: the report stays on your machine.

  1. Install the kit at one commit. This needs the network once.

  2. See it score a stand-in that accepts everything.

    Expect 9 agree and 32 accepted that must fail. That is what a verifier that never says no looks like.

  3. Point it at your verifier.

    The kit runs your command once per fixture, with {file} replaced by the fixture's path. Exit 0 for ACCEPT and 1 for REJECT, or print one JSON object with a verdict field. A verifier that runs as a service can use --verifier-url instead. The kit exits 0 only when all 41 agree.

atx-conformance on GitHub, opens in a new tab The fixtures, both reference verifiers, and how to have your implementation listed.

Or hand us your credential

Bring a test credential, never a live one. Our two verifiers read ATX in the suite's fixture form. For any other format we say so, and write down its fields for the comparison.

The bank demo at our table

A mock bank runs one AI agent two ways: with the customer's password, and with a permission the bank checks on every payment. The scenarios are scripted and the bank is a mock. Ask for a run at the table.

  1. 1. A hidden line in a bill

    With your password
    The agent signs in as you and pays the fake invoice. The bank sees you, so it can't tell.
    With your permission
    The agent shows its own ID. The bank checks the payment against your permission and refuses it: the account isn't one of your payees.

  2. 2. Stop one agent

    With your password
    Changing the password signs out every agent, and you.
    With your permission
    Withdrawing one agent's permission stops that agent. The other agents and you keep working.

  3. 3. Who paid?

    With your password
    The bank's log shows a sign-in with your password, then the payment. No agent is named.
    With your permission
    The bank's record names the agent, the permission it used, and carries a signature.

  4. 4. Cut the network

    With your password
    The password path never needed an outside service.
    With your permission
    With every outside connection blocked, the bank makes the same four decisions. It checks keys and limits it holds itself.

What isn't done yet

  • Proof of possession: a copy of an agent's credential is accepted as that agent. AAP specifies the fix; the reference implementation doesn't have it yet.
  • Grant revocation: AAP's revocation list is specified but not implemented. Today a grant is dropped by restarting the broker.
  • The demo's credentials come from a test issuer whose signing key is published, so they prove nothing outside the demo.
  • The conformance kit has no tagged release yet, so the commands on this page pin a commit.
  • AIP and AAP are individual drafts at the IETF. No working group has adopted either.

The specifications

specs.opena2a.org, opens in a new tab Every OpenA2A specification in one place.

Friday at AIW #3

We plan to propose these sessions in the 9:00 opening circle. The agenda is set there, so check the wall for times and rooms.

  • Where should AAP and AIP align with WIMSE AIMS and the AUDIT drafts, and where should they not?
  • The AI agent channel: what a site needs to admit an agent on its own terms, with a live mock bank, and how it differs from Web Bot Auth.

Questions, or want to test together after this week: info@opena2a.org