AgentTrust Live demo

Early-stage MVP · open for design partners

Let AI agents act for your customers, safely.

AgentTrust is the identity and authorization layer between AI agents and your business systems. It verifies which agent is calling, checks that the customer actually delegated the action, and returns a deterministic decision with a reason code before anything touches your systems.

Try the live demo Request early access

Built and tested today: signed agent requests, scoped customer delegations, a deterministic policy engine, human approvals, and an append-only audit log. Voice detection runs on a mock provider in the MVP.

Illustrative trace. The demo below produces real ones in your browser.

The problem

Agents are calling businesses. Businesses can’t tell who’s on the line.

Shopping assistants, browser agents and voice bots now contact companies for their users over APIs, chat and the phone. Every one of those requests raises the same questions, and most businesses can’t answer any of them today.

subscription cancellation

Which agent is this?

“Hi, I’m Alice’s shopping assistant” is a string anyone can send. Shared API keys and user-agent headers don’t prove which agent is making the request, or who runs it.

refund request

Did the customer authorize it?

An agent asks to cancel a plan and refund the last order. Did Alice ask for both? Up to what amount? Until when? Most systems can’t tell a scoped request from an improvised one.

revocation

How do you stop it?

When a customer changes their mind or a key leaks, the next request has to fail. Waiting for a cached token to expire is too late.

support call

And on the phone?

A synthetic voice asking for a refund can sound exactly like a person. “Sounds like a bot” is not an identity, and “sounds human” is not authorization.

How it works

Four checks on every request. No LLM in the loop.

AgentTrust sits between the agent and your systems. Nothing reaches a connector until every check passes, and every step is written to the audit log.

Request flow An AI agent sends a signed request to AgentTrust. AgentTrust verifies the agent, checks the customer's delegation, decides deterministically, then executes through a connector to your systems and writes an audit record. AI agent signs each request AgentTrust 1 Verify agent AgentSig, replay, key status 2 Delegation scoped, expiring, revocable 3 Decide pure function, reason codes 4 Execute idempotent, audited ALLOW DENY REQUIRE_APPROVAL Your systems via connector Request flow An AI agent sends a signed request to AgentTrust, which verifies the agent, checks the delegation, decides, then executes through a connector to your systems. AI agent signs each request AgentTrust 1 Verify agent AgentSig, replay, key status 2 Delegation scoped, expiring, revocable 3 Decide ALLOW DENY APPROVAL 4 Execute and audit idempotent, re-authorized Your systems via connector
Every request goes through the same four steps. Anything that can’t be established is denied.

  1. Verify the agent

    Each request carries an AgentSig: a JWS signed with the agent’s private key and bound to the method, URL and body hash. It lives 60 seconds, works once, and is checked against the key’s current status.

  2. Check the delegation

    The customer granted this agent specific actions on specific resources, such as sub_2001 cancel or ord_3001 refund up to $50.00 in total. Grants are scoped, expiring and revocable, and ownership is re-checked on every decision.

  3. Decide deterministically

    A pure function with a fixed order of checks returns ALLOW, DENY or REQUIRE_APPROVAL with a reason code like RESOURCE_OUT_OF_SCOPE. Same facts, same answer. No LLM decides.

  4. Execute and audit

    The Agent Desk runs typed actions through a connector with idempotency keys. Approved actions are re-authorized right before execution, write timeouts become OUTCOME_UNKNOWN instead of a guess, and every step is audited.

Voice channel: detection is evidence, not identity

Detection providers estimate whether a caller is a person or an automated agent. That can raise suspicion, but it never proves who is calling. An agent proves its identity by signing a voice attestation for the call with its registered key, and the requested action still goes through the same delegation and policy checks. If detection is unavailable, an unverified caller gets a fail-safe CHALLENGE, never ALLOW. The MVP uses a deterministic mock detection provider; real vendor integrations are on the roadmap.

Live demo

Sign real requests. Watch every decision.

Runs entirely in your browser. Mirrors the AgentTrust decision logic; no data leaves this page.

Your browser generates an agent key pair with WebCrypto and signs genuine AgentSig tokens. A JavaScript port of the server’s verification and decision code evaluates them against synthetic data. The server remains the authority.

The interactive demo needs JavaScript and WebCrypto (available on HTTPS pages and on localhost). Here is what each step shows.

  1. Check subscription ALLOW
    GRANTED

    Alice granted sub_2001 read, and she owns it. The sandbox returns the plan details.

  2. Cancel Alice’s subscription ALLOW
    GRANTED

    Executed once through the connector. A second cancel is allowed but fails in the business system: already cancelled.

  3. Cancel Bob’s subscription DENY
    RESOURCE_OUT_OF_SCOPE

    The delegation doesn’t cover sub_2002. Policies can’t add access.

  4. Refund $15 ALLOW
    GRANTED

    Within the $50.00 grant and under the $20.00 approval threshold.

  5. Refund $30 REQUIRE_APPROVAL
    APPROVAL_REQUIRED

    Refunds of $20.00 or more (running total) need a human. On approval the request is re-authorized against current facts, then executed.

  6. Refund $80 DENY
    CONSTRAINT_VIOLATED

    Above the $50.00 limit of the grant.

  7. Replay last request REJECTED
    REQUEST_REPLAYED

    The token’s jti was already used. Rejected before the policy engine runs.

  8. Tamper with body REJECTED
    REQUEST_BINDING_MISMATCH

    A $15 refund was signed; the body was changed to $49 in transit. The body hash no longer matches bdh.

  9. Impostor without the key REJECTED
    SIGNATURE_INVALID

    Copies the agent ID and key ID, signs with a different key. The registered public key doesn’t verify it.

  10. Revoke delegation DENY
    DELEGATION_REVOKED

    The next request is denied, and a pending approval is denied when it is re-authorized.

  11. Revoke key REJECTED
    KEY_REVOKED

    Even a valid signature from the revoked key is rejected on the next request.

  12. Call: AI voice, claims an identity, no proof CHALLENGE
    UNVERIFIED_AUTOMATED_CALLER · authorization IDENTITY_NOT_VERIFIED

    Detection says “automated” (simulated). The claimed identity is unverified, so the requested action isn’t authorized.

  13. Same call + signed voice attestation ALLOW
    VERIFIED_AGENT_AUTHORIZED

    The agent signs an attestation for the call; the delegation and policy checks pass.

  14. Detection provider down CHALLENGE
    DETECTION_UNAVAILABLE

    Missing detection is never treated as “human”. An unverified caller gets the fail-safe decision.

Design principles

Why deterministic, and what we never do

Agents are probabilistic. The component that says yes to a refund shouldn’t be.

The AgentTrust decision engine is a pure function over current facts: the agent’s key and status, the customer’s delegation and grants, resource ownership, and organization policies. Its checks run in a fixed order. You can test it with a table, read it line by line, and explain every DENY with a reason code.

  • Let an LLM make the final call

    A model can help an agent build a typed request. Whether it is allowed is decided by the engine, never by a model.

  • Let a policy grant access

    Permission comes only from a customer’s delegation. Organization policies can deny or require approval. They can’t add permissions.

  • Wait for a token to expire

    Key, agent and delegation state is checked on every request, so revocation applies to the very next one.

  • Hold your agents’ private keys

    Agents register public keys only. A key that includes private members is rejected, and the database refuses to store one.

  • Edit the audit log

    The log is append-only at the database level: the application role can only insert and read, and a trigger blocks updates and deletes for every role.

    Not cryptographically tamper-evident yet: a database superuser could still alter history. Hash-chaining is on the roadmap.

  • Treat missing data as a yes

    Anything that can’t be established is DENY. Missing voice detection is never treated as “human”.

For developers

One signed call per decision

The agent keeps its private key and signs every request. AgentTrust answers with a decision and a reason code your code can branch on.

agent.pyPython SDK · in development
from agenttrust import AgentClient, AgentKey

key = AgentKey.load("shopping-assistant.key.json")  # stays with the agent
client = AgentClient("https://api.example.com", agent_id=AGENT_ID, key=key)

decision = client.authorize(
    delegation_id=DELEGATION_ID,
    resource_type="order",
    resource_id="ord_3001",
    action="refund",
    amount_minor=3000,   # $30.00 in minor units
    currency="USD",
)

if decision.allowed:
    issue_refund()
elif decision.requires_approval:
    wait_for_human()          # reason_code == "APPROVAL_REQUIRED"
else:
    explain(decision.reason_code)  # e.g. "CONSTRAINT_VIOLATED"
the wire formatAgentSig
BODY='{"delegation_id":"…","resource_type":"order","resource_id":"ord_3001","action":"refund","amount_minor":3000,"currency":"USD"}'

curl -sS -X POST https://api.example.com/api/v1/agent/authorize \
  -H "Content-Type: application/json" \
  -H "Authorization: AgentSig $JWS" \
  --data-binary "$BODY"   # exact bytes: bdh binds them

# $JWS: a compact JWS signed with the agent's private key
#   header {"alg":"EdDSA","typ":"agent-request+jwt","kid":"<RFC 7638 thumbprint>"}
#   claims iss = sub = <agent id>   aud = https://api.example.com
#          iat, exp (at most 60 s)  jti (random, single use)
#          htm = POST  htu = <full request URL>
#          bdh = base64url(SHA-256($BODY))

# 200 OK
{"decision":"REQUIRE_APPROVAL","reason_code":"APPROVAL_REQUIRED",…}

AgentSig is an AgentTrust profile built on JWS, JWT, EdDSA and JWK thumbprints (RFC 7515, 7519, 8037, 7638). It is not an IETF standard.

MVP status

  • Agent registry with Ed25519 and P-256 public keys; key ID is the RFC 7638 thumbprint
  • AgentSig signed requests: method, URL and body binding, 60-second lifetime, replay protection
  • Immediate revocation of keys, agents and delegations
  • Customers with verified resource ownership
  • Scoped, expiring, revocable delegations with amount limits
  • Deterministic policy engine with reason codes; organization policies that only restrict
  • Agent Desk: typed actions, idempotency keys, human approval with re-authorization, OUTCOME_UNKNOWN on write timeouts, reconciliation (sandbox connector)
  • Voice decisions with separate detection, identity, authorization and risk; fail-safe defaults; mock detection provider
  • Append-only audit log
  • 290+ automated backend tests, including security regression tests from four adversarial review rounds
  • Relying-party verification API: a business checks an agent's signed request and its authority with a scoped API key
  • Operator dashboard (Next.js) and Python SDK with runnable examples

Roadmap

  • HTTP Message Signatures (RFC 9421) for interoperability
  • End-user consent screen (consent is operator-attested today)
  • REST, MCP and A2A connectors
  • Real voice-detection vendor integration
  • Service accounts and more API key scopes (e.g. contact-center integrations)
  • Tamper-evident (hash-chained) audit log
  • Cross-organization agent identity

FAQ

Straight answers

Is this an OAuth server?

No. AgentTrust doesn’t issue bearer tokens today. Every agent request is signed with the agent’s own key and checked against the current state of the key, the agent and the delegation, which is what makes revocation immediate. It sits next to your existing customer login and identity provider rather than replacing them. If relying parties later need offline verification, the plan is short-lived, sender-constrained tokens.

Is AgentSig a standard?

No. AgentSig is an AgentTrust profile built from standard parts: JWS, JWT, EdDSA and JWK thumbprints. It is not an IETF standard. Support for HTTP Message Signatures (RFC 9421) is on the roadmap so agents can interoperate with other ecosystems.

Do you detect AI voices yourself?

No. AgentTrust integrates detection providers behind an adapter and treats their output as untrusted evidence. The MVP ships with a deterministic mock provider, so no real audio analysis happens yet. On a call, identity comes from the agent’s signed attestation, not from how it sounds.

Does an LLM decide whether an action is allowed?

No. Decisions come from a deterministic engine with a fixed evaluation order and machine-readable reason codes. An LLM can help an agent turn a customer’s words into a typed request; it has no say in whether that request is allowed.

How does a customer grant an agent permission?

In the MVP, an operator at the business records the customer’s consent, obtained out of band (for example through a support ticket), as a delegation with explicit grants and an expiry. A customer-facing consent screen is on the roadmap.

What is real in the demo?

The cryptography: your browser generates the agent’s key pair with WebCrypto and signs genuine AgentSig tokens. The decision logic is a JavaScript port of the server’s engine, run against synthetic data. Nothing is sent anywhere, and the page’s Content Security Policy blocks network requests. The server remains the authority.

Can we use it today?

AgentTrust is an early-stage MVP. We’re looking for design partners: businesses that already see, or expect, AI agents acting for their customers on subscriptions, refunds, orders or support. Request early access.

Expecting agents on your support line or API?

We’re working with a small number of design partners. Tell us which actions agents ask for, and we’ll show you how AgentTrust handles them.

Request early access