The security layer for AI agent infrastructure

Cryptographic trust for autonomous AI agents.

Every agent gets a verifiable passport. Every action gets a signature. Authority is earned through five graduated trust levels — and proven with tamper-evident receipts.

Get AgentPass Explore the platform

Built in the UK
Deployed anywhere

Open standards
IETF internet-drafts

ECDSA P-256
SPIFFE-native identity

SOC 2 & PCI DSS v4
control mappings

( Manifesto )

Agents don't need another login. They need a passport.

API keys were built for code that waits to be called. Autonomous agents act — they spend, deploy, delete and negotiate on your behalf. AgentPass gives every agent a verifiable passport, signs every action it takes, and meters its authority through five graduated trust levels. Not a dashboard after the fact. A control plane in the request path.

Identify. Sign. Govern.

Every agent action signed, scored and accountable

( The platform )

Four layers between your agents and disaster.

01
AGENT PASSPORTVALID

spiffe://acme.internal/payments-agent

KeyES256 · P-256
Validity24h · JIT
TrustL3 · Trusted

SHA-256  a9 1f 33 c2 e7 48 0b d4 … 6f 9d

Agent passports

Verifiable certificates for every agent in your fleet. Workload identity that survives restarts, redeploys and scale-out — with instant revocation when an agent goes rogue. One call, revoked everywhere.

Certificates • SPIFFE-native • Instant revocation

02
MCPS RECEIPTSIGNATURE VERIFIED
{
  "type":   "mcps.call.v1",
  "agent":  "payments-agent",
  "action": "POST /v1/payments",
  "amount": 420, "nonce": "8f31…",
  "sig":    "c6e72fcc43e012e4…"
}

Signed actions

MCPS signs every call an agent makes — payments included — with per-call replay protection and tool-hash pinning. If the request wasn't signed by the passport, it doesn't happen. No vibes, just verification.

MCPS • Replay protection • Tool-hash pinning

03
TRUST LEVELSCORE 72 / 100
L0$0
L1$10
L2$100
L3$1,000
L4$50,000

Graduated trust

Authority is earned, not assumed. Five trust levels gate what an agent can touch and what it can spend — from L0 sandbox to L4 autonomy. Trust builds slowly and burns fast, exactly like it should.

L0–L4 • Trust-gated scopes • Spend limits

04
AEBA · BEHAVIOURAL WATCHLIVE

baseline ok · 142 actions · 0 anomalies

anomaly · spend velocity +312%

trust burned L3 → L1 · scopes narrowed

kill switch armed · denial receipt signed

Detection & response

Continuous behavioural monitoring watches how every agent actually behaves. Anomalies burn trust scores in real time, the kill switch ends a bad day instantly, and a hash-chained audit trail makes the whole story tamper-evident.

AEBA • Kill switch • Hash-chained audit

( Trust levels )

From sandbox to autonomy, one earned level at a time.

Every agent starts at zero. Behaviour, age and track record move its score — and its score sets hard limits on every transaction. No exceptions, no overrides without a human.

Level Trust score Per transaction Daily limit
L0 Untrusted 0–19 $0 $0
L1 Limited 20–39 $10 $50
L2 Standard 40–59 $100 $500
L3 Trusted 60–79 $1,000 $5,000
L4 Full 80–100 $50,000 $200,000
0 Graduated trust levels,
L0 sandbox to L4 autonomy
0K OFAC + HMT sanctions
entries screened
0 SOC 2 trust service criteria
mapped to agent operations
0 IETF internet-drafts:
MCPS · ATTP · AEBA

( How it works )

Trust is a loop, not a checkbox.

AgentPass sits in the request path, not in a quarterly review. Four moves, running continuously, for every agent you operate.

  1. / 01

    Register

    An agent enrols and receives its passport — a verifiable certificate bound to its workload identity. It starts at L0 with zero authority and nothing to lose.

  2. / 02

    Sign

    Every call the agent makes carries a cryptographic signature with replay protection and pinned tool hashes. Servers verify before they execute — unsigned means undone.

  3. / 03

    Score

    Behavioural monitoring turns conduct into a live trust score. Clean history earns authority slowly; anomalies burn it instantly. The score is the policy.

  4. / 04

    Enforce

    Scopes, spend limits and daily caps follow the trust level automatically. When something is wrong, revocation is one call and the kill switch is instant — with a tamper-evident audit trail of everything that happened.

( Why trust us )

Built on open standards. Mapped to law.

Open by design

MCPS, ATTP and AEBA are public IETF internet-drafts. The x-agent-trust extension lives in the OpenAPI Extensions Registry. No proprietary lock-in at the trust layer.

Regulator-ready

SOC 2 and PCI DSS v4 control mappings out of the box, sanctions screening built in, FCA regulatory sandbox applicant. Compliance evidence, not compliance theatre.

Kill switch included

Trust is graduated, never assumed. One call revokes a passport everywhere, instantly — and the hash-chained audit trail proves exactly what happened, in order, untampered.

( Integrate )

AgentPass drops into any tech stack.

AgentPass is not just for AI chatbots. Any system that acts autonomously needs cryptographic identity, trust gating and an audit trail. Three lines of code. Any language. Any device.

QUICKSTART · PYTHON3 LINES
pip install agentpass-sdk

from agentpass import AgentPass
ap = AgentPass(endpoint, api_key)

That is all it takes to add cryptographic identity and trust enforcement to any autonomous system.

Robotics

Warehouse robots, humanoid agents, factory automation. Every motor command is trust-gated. Forklift operation requires L4 human approval. Every movement signed and logged.

IoT & smart home

Smart locks, thermostats, cameras, appliances. Adjusting temperature is L1. Unlocking the front door is L4 with hardware human approval. No autonomous device should act without verifiable identity.

Payment systems

POS terminals, mobile wallets, agent commerce. Every transaction is MCPS-signed with sanctions screening. Large payments require human approval. Full audit trail for PCI and regulatory compliance.

Autonomous vehicles

Lane changes at L2. Emergency braking at L2. Autopilot override at L4 with human approval. Every driving decision is cryptographically signed and forensically auditable.

Industrial automation

SCADA systems, PLCs, factory controllers. Production line shutdown requires L4. Maintenance scheduling at L2. Every action signed into a tamper-evident ledger.

Medical devices

Drug dispensers, surgical robots, patient monitoring. Dosage changes require L3. Surgical actions require L4 with human approval. The audit trail meets regulatory evidence requirements.

Enterprise software

Any application with embedded AI agents. Database access, code deployment, data export, API integrations. Same trust model, same audit trail, same kill switches.

Pythonpip install agentpass-sdk
Node.jsnpm install @proofxhq/agentpass
REST APIany language, over HTTPS
Embedded / roboticsC SDK on request

Every agent gets a certificate. Every action gets a signature. Every decision is trust-gated from L0 to L4. Every critical action requires human approval. Every event lands on a tamper-evident audit trail.
If it acts autonomously, it needs AgentPass.