Agent Visa

• 

  Main registry

• 

  Evidence Auditor

• 

  Github Repo

Inspiration

Egoist's passport carries verified context between tools. But the moment a person's agent acts on their behalf (at a client that has never met them), a question appears that context can't answer: is this agent allowed to do this, right now, and who says so? Today that's shared passwords, blanket API keys, account-wide OAuth: bearer instruments with no scope, no expiry, no enforceable revocation, and no evidence afterward. A passport gets you recognized. What was missing is the visa.

Agent Track project

What it does

The passport proves who you are. The Agent Visa proves what your agent may do.

A holder signs a visa for their agent: these actions, at this verifier, on this resource, within these limits, until this time. The agent's own key is embedded, so a stolen visa is useless. A verifier who has never met the holder runs a seven-rule deterministic gate — authority chain, proof-of-possession, freshness, revocation, validity, scope, and limits replayed from a hash-chained receipt ledger. Denials state their arithmetic: R7_LIMITS: 220 + 400 > 500. Revoking once locks the agent out at every verifier — revocation isn't a policy, it's a signature that stops verifying. The whole history exports as an evidence bundle anyone can verify offline.

Live agent mode: a real language model is given a task and nothing about its authority — it learns its limits by being refused. In the recorded run it asked for the full $700 fee, was denied with the arithmetic, adapted to $500 — and when it kept probing, three consecutive denials auto-suspended it, pending holder review. No model output anywhere in the trust path.

How we built it

Zero-dependency JavaScript (ECDSA P-256 via WebCrypto) running identically in browser and Node; a four-pane live demo with two client verifiers; a deployed registry holding only key bindings and revocations — its deployment configuration is empty because it has nothing to hide; an offline browser auditor; and avp_audit.py, an independent Python implementation sharing zero code with the JavaScript. The one model call sits in one file, behind a whitelist, outside the trust path.

Challenges we ran into

Byte-identical canonicalization across languages (UTF-16 code-unit key ordering, so Python and JavaScript hash the same bytes); containment that changes state the gate reads rather than deciding itself; and keeping the live model provably blind, verified by wire capture, including against a deliberately over-sharing caller whose leaked visa fields were stripped before the model saw them.

Accomplishments that we're proud of

41 protocol tests including an adversarial suite (forged and stolen visas, replays, sub-delegation escalation, ledger tampering), plus 19 planner tests. Three implementations agree — identical verdicts, identical error strings; a bundle exported from Chrome verifies under Python, and a tampered copy fails at the exact receipt edited. Sub-delegation with strict attenuation, cascade revocation, and shared budgets across the chain. And a real AI contained live: overreach refused, adaptation, automatic suspension — all on the receipt chain.

What we learned

Revocation is the passport's most distinctive promise, and for context it's structurally weak — copied data can't be un-known. For authority, the same primitive is airtight: a revoked visa simply fails verification at next use, everywhere. The agent economy also adds a third party the two-party passport design lacks — a verifier checking authority it didn't issue, for a person it's never met — and it needs to see only a claim and a validity status, never the passport's contents. THREATS.md documents 16 mitigated attacks each cited to a passing test, 3 named untested surfaces, and 11 residual risks with exhibits — including the ones that hurt.

What's next for Agent Visa

Close the residuals that matter for money: a signed chain head, authenticated registration with write-once key bindings, receipts that carry the signed request. Pilot with one verifier-side deployer in the freelance-delegation wedge. Then bring the evidence-bundle format to the mandate-object conversations (Visa CE 3.0, Mastercard, Google AP2) as the enforcement layer they currently assume but don't specify — ADOPTION.md in the repo maps that path.

This entry is for a freelance contractor(for demo purposes), who needs to prove "my agent holds valid, scoped, unexpired authority from me" to a client's intake system, so the agent can deliver and invoice the work without shared credentials, without giving away more context than necessary.

Built With

• ecdsa
• github
• html
• javascript
• node.js
• openai-api
• python
• render
• sha-256
• webcrypto