Trust scoring
AIM computes two trust scores that answer different questions. The local score grades how the agent is set up. The server score grades whether the agent should still be trusted right now, recomputed on every authorization.
Local: 8 factor posture
Is the agent set up correctly? Read from the agent files on disk by the opena2a CLI and aim-core. Static until the setup changes.
aim-core posture scoreServer: 9 factor behavior
Should the agent still be trusted right now? Recomputed on every authorization from observed behavior. This page documents the server score.
apps/backend/internal/domain/trust_score.go
How the server score works
The server evaluates nine factors and combines them into a score from 0 to 100. The score gates per-capability access and feeds alerts on anomalous behavior. It is recomputed on every authorization, so it reflects current behavior rather than setup alone.
Event-driven analysis
Every agent action is evaluated, and the factors update from the observed outcome.
Configurable thresholds
Per-capability trust thresholds and response policies are set to match your security requirements.
Trust score ranges
Full access to permitted resources, minimal monitoring
Standard access with periodic verification
Limited access, increased monitoring, approval for sensitive operations
Restricted access, all actions logged, manual approval required
Monitoring in the dashboard
The dashboard surfaces the trust score with:
- • Live trust score updates
- • Anomaly detection alerts
- • Factor breakdown visualization
- • Historical trend analysis
- • Policy violation tracking
- • Per-capability threshold gating
- • Drift and isolation signals
- • Operator feedback