OATI is an open standard for identifying enterprise agents, delegating short-lived authority, enforcing transaction constraints, and producing verifiable receipts across organizational boundaries.

Stars

12

7-day growth

No data

Forks

0

Open issues

1

License

Apache-2.0

Last updated

2026-07-28

AI repository intelligence
FR-AI / ANALYSIS

Why it is worth attention

It provides a portable transaction model that binds identity, authority, policy, and evidence into one system, designed to complement existing standards like OAuth, OIDC, and SPIFFE without replacing them, with domain-specific profiles for commerce and real-world assets.

Who it is for

  • Enterprise developers building agent systems
  • Platform engineers integrating multi-party trust
  • Security architects designing delegated authorization
  • Compliance teams needing verifiable transaction evidence

Use cases

  • Verifying enterprise agent identity and delegated authority before API access
  • Purchasing API requests under buyer-issued purchase mandates with constraints
  • Controlling token minting against asset state claims with approval thresholds
  • Producing signed action receipts for audit and dispute resolution

Strengths

  • Open standard with Apache 2.0 license, implementable without vendor lock-in
  • Deterministic non-amplification invariant prevents silent privilege escalation
  • Domain profiles add strict semantics while preserving core model
  • Comprehensive CLI, SDKs (TypeScript, Python, Go), and conformance suite for validation

Considerations

  • Currently in early developer preview, requires independent cryptographic review
  • Production lookup service and commercial control plane are not open-sourced
  • Additional SDK languages are under active development, not yet complete

README quick start

OATI

Trusted transactions between enterprise agents.

Open Agent Trust Infrastructure (OATI) is an open standard by Intelliger for identifying enterprise agents, expressing short-lived delegated authority, enforcing transaction constraints, and producing verifiable action receipts across organisational boundaries.

An API credential can show that an agent may connect. OATI describes who owns the agent, on whose authority it acts, what it may do now, and what evidence proves the transaction.

  • Website: https://intelliger.ai/oati
  • Public lookup: https://intelliger.ai/oati/lookup
  • Machine API: https://api.intelliger.ai/oati/v1
  • Licence: Apache 2.0
  • Status: developer preview

Why OATI

Enterprise controls are split across identity providers, gateways, policy engines, data platforms, contracts, payments, and audit systems. A valid token alone does not reveal the responsible organisation, current delegated purpose, downstream data restrictions, commercial authority, or mutually verifiable evidence.

OATI binds those concerns into one portable transaction model:

Verified organisation + Agent Passport + short-lived Mandate
        + Transaction Envelope + deterministic decision
        + signed Action Receipt

OATI complements OAuth, OIDC, SPIFFE, AuthZEN, Cedar, OPA, MCP, and A2A. It does not replace them.

Core objects

ObjectAnswers
Agent PassportWho is this agent, who operates it, and how is that claim verified now?
Agent MandateWhat exact authority was delegated, by whom, for what purpose, and until when?
Transaction EnvelopeWhat action, resource, destination, context, and proof are being evaluated?
Authorisation DecisionWas the transaction allowed, denied, transformed, or sent for approval—and under which policy?
Action ReceiptWhat happened, under which authority and controls, and what signed evidence can be checked later?

The central invariant is non-amplification: a delegated Mandate may preserve or reduce authority, but it must never silently expand it.

Domain profiles

OATI profiles add strict domain semantics while preserving the same core identity, authority, policy, and evidence model.

Commerce 0.1 — paid APIs and digital services

The first Commerce workflow lets an enterprise agent p

Description

Open Agent Trust Infrastructure (OATI) — an open standard for verifiable AI agent identity, delegated authority, policy enforcement, and signed action receipts.

Related repositories

Similar projects matched by category, topics, and programming language.

mereyabdenbekuly-ctrl
Featured
mereyabdenbekuly-ctrl GitHub avatar

clodex-ide

Clodex is an open-source, local-first agentic IDE that combines persistent AI tasks, code, terminal, browser, Git, models, memory, and governed execution in one Electron workspace, currently in technical preview.

AI & Machine LearningAI Agents
859
0xwilliamortiz
Featured
0xwilliamortiz GitHub avatar

openclaude-improved

OpenClaude is an open-source CLI coding agent that runs on any platform and supports a wide range of LLM providers, offering the same tools and workflows as Claude Code.

AI & Machine LearningLarge Language Models
577
deerwork-ai
Featured
deerwork-ai GitHub avatar

deer-workflow

An open-source Dynamic Workflow runtime that combines deterministic TypeScript orchestration with replaceable Agent runtimes.

AI & Machine LearningLarge Language Models
312