AIC binds every AI agent to the principal who authorizes it — identity, delegation, and capabilities in one cryptographically verifiable certificate. Open standard. Open source. Built on existing PKI.
Autonomous agents act, sign, and transact on behalf of people and organizations. Today's IAM answers "who is the client" — not "who authorized this action, why, and under what limits." That missing layer is what AIC provides.
A standard X.509 certificate or JWT anchors the agent's cryptographic identity in a verifiable chain.
principalUid binds the agent to the authorizing person via a key hash, so actions trace back to a human.
A principal-signed DelegationAuthorization records why, what capabilities, and under what constraints.
Gateways evaluate the effective authorization — principal grant ∩ agent capabilities ∩ runtime policy — at every request.
Agent identity is a certificate problem. AIC builds on the trust infrastructure you already run.
X.509 ships in every OS, TLS stack, and enterprise PKI — there is no new trust infrastructure to build.
Signatures and chains verify without network round-trips — authorization evidence travels with the agent.
Validity, renewal, revocation, and status are long-solved problems governed by standards and audits.
TLS/mTLS already carries certificates; AIC rides the handshake your infrastructure performs every day.
AIC ships as an X.509 v3 extension for PKI-native deployments and as a JWT profile for the web — both backed by the same delegation model and a fully open-source reference stack.
Certificate extension with agent identity, principal binding, capability container, delegation evidence, and offline-verifiable constraints. Ideal for regulated, PKI-native environments.
Financial · Government · HealthcareJSON Web Token profile with double signing (principal + issuer), RFC 7638 thumbprint binding, and a browser WebCrypto pipeline. Works everywhere JWTs do.
Web · SaaS · BrowserOpen, machine-readable capability schemes with PKCS#7-signed rule files — a global vocabulary so different organizations can interoperate.
Open EcosystemTCP/HTTP/UDP unified gateway that enforces AIC verification, revocation, capability plugins, and per-route policy in pure Go.
TCP · HTTP · UDPIn-memory certificate status engine with async persistence — 833 AIC/s sustained, with an ~11k/s regular signing-path ceiling and an ~6.1k/s AIC burst ceiling on documented x86 hardware.
833/s sustained · 6.1k/s AIC burstReference implementation in Go plus ports to TypeScript, C/OpenSSL, Java, and .NET — verify AIC anywhere in your stack.
Go · TS · C · Java · .NETIdentity tells you who is calling. AIC tells you what that identity is allowed to do — and who is accountable when it acts.
The CA certifies identity; only the principal's signature creates authority. Even a compromised CA cannot mint new principal grants.
Capabilities, constraints, and delegation are signed into the artifact and verifiable offline; enforcement stays at the gateway.
X.509 rides your existing PKI and TLS; JWT serves web and OAuth — the same authorization semantics in your current stack.
IETF drafts under Royalty-Free IPR, 13/13 independent conformance, and public benchmarks on documented hardware.
A DelegationAuthorization pins the agent, capabilities, constraints, and lifetime.
The authority evidence becomes an AIC extension in X.509, or an AIC-JWT.
TLS/mTLS delivers the credential to the gateway.
P_principal ∩ C_agent ∩ P_gateway, then runtime constraints.
Every decision is preserved and attributable to the principal.
The certificate carries the evidence. The gateway — your gateway — is where authorization becomes an execution decision.
TLS/mTLS establishes who is calling.
Issuer, chain, validity, and revocation status.
Principal-signed DelegationAuthorization and binding.
P_principal ∩ C_agent ∩ P_gateway.
Time, network, concurrency, and runtime policy.
Immutable record: identity, principal, capability, decision.
Two IETF Experimental drafts, a Royalty-Free IPR commitment, and an independent implementation already reproducing 13/13 conformance cases.
Three Go repositories carry one credential end to end: the agent mints and presents it, the verifier decides on it, and the executor gates what actually runs.
Consumer side. Obtains a fresh, short-lived AIC end to end (human approval → CA mint), carries it over mTLS or as a Bearer AIC-JWT, pre-checks capabilities locally, and drives MCP servers with the issued identity.
GitHub → Docs →Service side. Per-request pipeline: certificate validity → CRL/OCSP → role → AIC decision → capability ∩ principal grant → parameter bounds → allow / allow_unresolved / deny. mTLS and Bearer transports, middleware and reverse-proxy integrations, every decision preserved as DSSE-signed evidence.
GitHub → Docs →Execution side. One decision core: admission, argv→CLC projection, CLC decision, shell-free execution, and per-call evidence. CLI and MCP entry points, local or remote authority, chained serve.
GitHub → Docs →The capability language shared by the verifier and executor — a minimal, deterministic grammar for "what an agent may do." Readable 17-page reference with its conformance corpus, spec-anchored, in EN and 中文.
Overview → Lab → GitHub → Docs →Five languages, one model, zero lock-in — verify AIC anywhere in your stack.
AIC is an individual IETF submission. Implementers, reviewers, and interop partners are invited to test the public stack and join the conversation.