为什么值得关注

它提供了一个可移植的交易模型，将身份、权限、策略和证据绑定在一个系统中，旨在补充OAuth、OIDC和SPIFFE等现有标准而不取代它们，并包含针对商业和现实世界资产的领域配置文件。

适合谁使用

构建代理系统的企业开发者
集成多方信任的平台工程师
设计委托授权的安全架构师
需要可验证交易证据的合规团队

典型使用场景

在API访问前验证企业代理身份和委托权限
在买方签发的采购委托下购买API请求并遵循约束
根据资产状态声明控制代币铸造并满足批准阈值
生成签名的操作收据用于审计和争议解决

项目优势

开放标准，Apache 2.0许可，无需供应商锁定即可实现
确定性非放大不变性防止静默权限升级
领域配置文件在保留核心模型的同时增加严格语义
全面的CLI、SDK（TypeScript、Python、Go）和一致性测试套件用于验证

使用前须知

目前处于早期开发者预览阶段，需要独立的加密审查
生产查找服务和商业控制平面未开源
额外的SDK语言正在积极开发中，尚未完成

README 快速开始

OATI

Trusted transactions between enterprise agents.

Open Agent Trust Infrastructure (OATI) is an open standard by Intelliger for identifying enterprise agents, expressing short-lived delegated authority, enforcing transaction constraints, and producing verifiable action receipts across organisational boundaries.

An API credential can show that an agent may connect. OATI describes who owns the agent, on whose authority it acts, what it may do now, and what evidence proves the transaction.

Website: https://intelliger.ai/oati
Public lookup: https://intelliger.ai/oati/lookup
Machine API: https://api.intelliger.ai/oati/v1
Licence: Apache 2.0
Status: developer preview

Why OATI

Enterprise controls are split across identity providers, gateways, policy engines, data platforms, contracts, payments, and audit systems. A valid token alone does not reveal the responsible organisation, current delegated purpose, downstream data restrictions, commercial authority, or mutually verifiable evidence.

OATI binds those concerns into one portable transaction model:

Verified organisation + Agent Passport + short-lived Mandate
        + Transaction Envelope + deterministic decision
        + signed Action Receipt

OATI complements OAuth, OIDC, SPIFFE, AuthZEN, Cedar, OPA, MCP, and A2A. It does not replace them.

Core objects

Object	Answers
Agent Passport	Who is this agent, who operates it, and how is that claim verified now?
Agent Mandate	What exact authority was delegated, by whom, for what purpose, and until when?
Transaction Envelope	What action, resource, destination, context, and proof are being evaluated?
Authorisation Decision	Was the transaction allowed, denied, transformed, or sent for approval—and under which policy?
Action Receipt	What happened, under which authority and controls, and what signed evidence can be checked later?

The central invariant is non-amplification: a delegated Mandate may preserve or reduce authority, but it must never silently expand it.

Domain profiles

OATI profiles add strict domain semantics while preserving the same core identity, authority, policy, and evidence model.

Commerce 0.1 — paid APIs and digital services

The first Commerce workflow lets an enterprise agent p

项目描述

Open Agent Trust Infrastructure (OATI) — an open standard for verifiable AI agent identity, delegated authority, policy enforcement, and signed action receipts.

oati