AI Power of Attorney

Track: Agents · Lane: Build

Don't trust the agent. Trust the authority.

The AI Passport as a Power of Attorney — signed, scoped, and expiring authority for AI agents. Even a compromised agent can't exceed what its human authorized.

The Problem

Autonomous agents are increasingly capable of acting on money, data, and messages. But giving an agent long-lived API keys and broad permissions creates a fundamental problem:

How can a human prove exactly what an AI agent is authorized to do?

Today, agents are often given either too much access or too little. There is no simple, portable authorization layer that lets an agent carry exactly the authority it needs while remaining accountable to the human who granted it.

Who Is Affected?

Anyone delegating real-world actions to autonomous agents:

• Individual users
• Businesses and enterprises
• Developers building agentic systems
• The broader AI agent economy

These actions can include spending money, sending messages, accessing services, or modifying data.

How AI Passport Is Used

We use the AI Passport as a Power of Attorney (PoA).

A human issues the agent a signed, scoped, and expiring delegation containing exactly what the agent is allowed to do.

The PoA defines:

• Scope — what actions are allowed
• Budget — maximum spending limit
• Service whitelist — which services can be accessed
• Expiry — how long the authority remains valid
• Nonce — prevents replay
• Holder — which agent holds the authority

Before any action is executed, the receiving service verifies the Passport and checks the requested action against its constraints.

The LLM proposes. The signed Passport disposes.

Agents can also delegate a narrower sub-PoA to another agent, but a child can never exceed its parent's authority. One-click revocation cascades through the entire delegation tree.

Context, Permission, Proof, and Access

🔐 Proof

The PoA is cryptographically signed using Ed25519.

The signature covers the authorization payload:

signer
sponsor
holder
scope
budget
services
expiry
nonce

Built With

• ai-agents
• api
• css3
• digital-signatures
• ed25519
• groq
• html5
• javascript
• llm
• netlify
• node.js
• rest
• serverless