AIC binds every AI agent to the principal who authorizes it — identity, delegation, and capabilities in one cryptographically verifiable certificate. Open standard. Open source. Enterprise-ready.
Autonomous agents act, sign, and transact on behalf of people and organizations. Today's IAM answers "who is the client" — not "who authorized this action, why, and under what limits." That missing layer is what AIC provides.
A standard X.509 certificate or JWT anchors the agent's cryptographic identity in a verifiable chain.
principalUid binds the agent to the authorizing person via a key hash, so actions trace back to a human.
A principal-signed DelegationAuthorization records why, what capabilities, and under what constraints.
Gateways evaluate the effective authorization — principal grant ∩ agent capabilities ∩ runtime policy — at every request.
Agent identity is a certificate problem. AIC builds on the trust infrastructure you already run.
X.509 ships in every OS, TLS stack, and enterprise PKI — there is no new trust infrastructure to build.
Signatures and chains verify without network round-trips — authorization evidence travels with the agent.
Validity, renewal, revocation, and status are long-solved problems governed by standards and audits.
TLS/mTLS already carries certificates; AIC rides the handshake your infrastructure performs every day.
AIC ships as an X.509 v3 extension for PKI-native deployments and as a JWT profile for the web — both backed by the same delegation model and a fully open-source reference stack.
Certificate extension with agent identity, principal binding, capability container, delegation evidence, and offline-verifiable constraints. Ideal for regulated, PKI-native environments.
Financial · Government · HealthcareJSON Web Token profile with double signing (principal + issuer), RFC 7638 thumbprint binding, and a browser WebCrypto pipeline. Works everywhere JWTs do.
Web · SaaS · BrowserOpen, machine-readable capability schemes with PKCS#7-signed rule files — a global vocabulary so different organizations can interoperate.
Open EcosystemTCP/HTTP/UDP unified gateway that enforces AIC verification, revocation, capability plugins, and per-route policy in pure Go.
TCP · HTTP · UDPIn-memory certificate status engine with async persistence — measured at 16,000+ certificates/second for regular issuance and 8,000+ AIC certificates/second on a single x86 machine.
16k+ cert/s regular · 8k+ AIC/sReference implementation in Go plus ports to TypeScript, C/OpenSSL, Java, and .NET — verify AIC anywhere in your stack.
Go · TS · C · Java · .NETIdentity tells you who is calling. AIC tells you what that identity is allowed to do — and who is accountable when it acts.
The CA certifies identity; only the principal's signature creates authority. Even a compromised CA cannot mint new principal grants.
Capabilities, constraints, and delegation are signed into the artifact and verifiable offline; enforcement stays at the gateway.
X.509 rides your existing PKI and TLS; JWT serves web and OAuth — the same authorization semantics in your current stack.
IETF drafts under Royalty-Free IPR, 13/13 independent conformance, and public benchmarks on documented hardware.
A DelegationAuthorization pins the agent, capabilities, constraints, and lifetime.
The authority evidence becomes an AIC extension in X.509, or an AIC-JWT.
TLS/mTLS delivers the credential to the gateway.
P_principal ∩ C_agent ∩ P_gateway, then runtime constraints.
Every decision is preserved and attributable to the principal.
The certificate carries the evidence. The gateway — your gateway — is where authorization becomes an execution decision.
TLS/mTLS establishes who is calling.
Issuer, chain, validity, and revocation status.
Principal-signed DelegationAuthorization and binding.
P_principal ∩ C_agent ∩ P_gateway.
Time, network, concurrency, and runtime policy.
Immutable record: identity, principal, capability, decision.
Two IETF Experimental drafts, a Royalty-Free IPR commitment, and an independent implementation already reproducing 13/13 conformance cases.
Three Go repositories carry one credential end to end: the agent mints and presents it, the verifier decides on it, and the executor gates what actually runs.
Consumer side. Obtains a fresh, short-lived AIC end to end (human approval → CA mint), carries it over mTLS or as a Bearer AIC-JWT, pre-checks capabilities locally, and drives MCP servers with the issued identity.
GitHub → Docs →Service side. Per-request pipeline: certificate validity → CRL/OCSP → role → AIC decision → capability ∩ principal grant → parameter bounds → allow / allow_unresolved / deny. mTLS and Bearer transports, middleware and reverse-proxy integrations, every decision preserved as DSSE-signed evidence.
GitHub → Docs →Five languages, one model, zero lock-in — verify AIC anywhere in your stack.
AIC is an individual IETF submission. Implementers, reviewers, and interop partners are invited to test the public stack and join the conversation.