Uchi Uchibeke

Open Agent Passport: where it came from

I wrote the Open Agent Passport specification. This is the origin record: the dates, the version I got wrong first, and what the acronym does not mean.

The Open Agent Passport is a signed credential that states what an autonomous agent is allowed to do, checked before the agent acts. The normative text lives at aport.io/spec and the reference implementation is at github.com/aporthq. Read those if you want to implement it.

This page is for the other question. I wrote the specification, and the record of when and why is not in the spec, because a spec that talks about its author is a bad spec.

Dates

August 2025First public argument for agent passports, in a post about accountability. The mechanism is there. The phrase "pre-action authorization" is not.
September 2025Registries and kill switches, on the revocation half of the problem.
Through 2025A working version at Chimoney that checked the wrong thing. Write-up.
21 March 2026Before the Tool Call on arXiv, arXiv:2603.20953. The paper that names pre-action authorization and formalizes the check.
2026Specification released under the MIT licence with DOI 10.5281/zenodo.18901596. 21 policy packs, integrations for 7 agent frameworks.

What I got wrong first

The Chimoney version authenticated agents properly and stopped there. An agent proved it was itself, and then did whatever the calling code asked for. That is identity, and identity answers the wrong question: a correctly authenticated agent with an injected instruction is still a correctly authenticated agent.

What was missing is the capability half. The passport had to carry limits, not just a name, and something had to read those limits at the moment of the call rather than at login. Getting that wrong for most of a year is the reason the specification separates the two so insistently.

What the acronym does not mean

OAP here is Open Agent Passport. There is an unrelated project, oap.foundation, that expands OAP as Open Agent Protocol. Different thing, different problem, no relationship between them. If you arrived looking for a message-passing protocol between agents, that is the one you want.

The discovery endpoint for this specification is /.well-known/oap, which I wrote about separately.

Citing it

For the paper:

@misc{uchibeke2026beforethetoolcall,
  title  = {Before the Tool Call: Deterministic Pre-Action Authorization
            for Autonomous AI Agents},
  author = {Uchibeke, Uchi},
  year   = {2026},
  eprint = {2603.20953},
  archivePrefix = {arXiv},
  doi    = {10.48550/arXiv.2603.20953}
}

For the specification itself, cite DOI 10.5281/zenodo.18901596.

My ORCID is 0000-0003-2238-9267.

Where to go next