OATI - Open Agent Trust Infrustructure

Agents are powerful. Power is nothing without control. Join our mission to make trust, control and verification become part of every agentic action. #opensource #AgenticOps

We want OATI to be shaped by implementation, not assumptions. Our first technical deep dives could cover: A) Passport vs Agent Card 😎 mandate non-amplification C) MCP across company boundaries D) signed receipt verification Which should we publish first? #AIAgents

A valid agent identity should not create permanent access. OATI Mandates are short-lived and purpose-bound. They define the permitted action, resource, parameters, destination, financial limit and expiry. Authority should match the transaction, not outlive it. #AgenticAI

A log records what one system says happened. An OATI Receipt creates signed evidence that both sides can verify. It connects the agent, mandate, policy decision, action, released output and evidence references. For cross-company transactions, that difference matters.

The most important rule in delegated agent authority: A child mandate must never be broader than its parent. No larger budget. No wider data access. No longer expiry. No additional destination. Delegation may preserve or reduce authority. It must never amplify it.

MCP connects agents to tools. A2A connects agents to other agents. OATI verifies whether a specific transaction is authorized across an enterprise boundary. These are complementary layers, not competing protocols. What does your current agent stack use? #MCP #A2A

An Agent Card describes what an agent can do. An OATI Passport establishes who owns and operates it, which issuer verified it and whether the record is still valid. Discovery helps agents find each other. Discovery should never grant permission. #A2A #DigitalIdentity

An API key proves that an agent has access to a credential. It does not prove who delegated authority, why the agent is acting, what data may leave or how much it may spend. Access is not authority. An API key is not a mandate. #APISecurity #AIAgents

The OATI transaction model: OATI-ID identifies the agent. Passport establishes ownership. Mandate defines authority. Policy controls the action. Receipt provides signed evidence. Each object answers a different trust question. #AgenticAI #DigitalIdentity

When an AI agent acts for a company, access is not enough. We need to know: Who owns it? Who authorized this action? Which limits apply? What evidence remains? OATI is an open standard for trusted agent transactions. We are building it in public. #AIAgents #OpenSource