> ## Documentation Index
> Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.
# Agent Passport
> Issue post quantum trust credentials to AI agents, verify them offline before granting spend authority, and revoke them instantly. Commercial OEM SDK.
**Included in the [Payment Rails bundle](/payment-rails-sqlite).** One commercial licence installs this component together with the whole self-hosted payment-rails estate. It ships inside the bundle, not as a standalone product.
## What it is
**Agent Passport** gives an AI agent a verifiable, revocable identity you can check *before* you
let it move money. You issue a passport that binds the agent to a set of scopes and a spend limit,
sign it with a post-quantum key, and hand it to the agent. A counterparty verifies that passport
**offline** — with nothing but the issuer's public key — and decides whether to grant the agent
spend authority.
*Last updated: 21 August 2026.*
It is the answer to a question agentic commerce keeps asking: *can I trust this autonomous agent,
and is it allowed to do this?* The credential **is** the proof — there is no callback to the
issuer at verification time, and no shared infrastructure to stand up.
It is **self-contained**: bundled Falcon-1024 signing, a pluggable credential store (in-memory and
SQLite included), and an injected issuer key. It holds no funds and makes no spend decisions of its
own — it produces the *authorisation evidence* the spending platform checks.
Every passport is signed with Falcon-1024 (FN-DSA / draft FIPS 206). Agent identities you
issue today stay verifiable past the migration to post-quantum cryptography.
The signed payload carries the agent's scopes, spend limit, and spend window — so a verifier
sees not just *who* the agent is but *what it is allowed to do*, in one credential.
Verify with only the issuer public key — no callback, no database lookup required for the
cryptographic check. The credential proves itself anywhere it travels.
Revoke a passport the moment an agent should lose authority, and publish a cacheable
revocation list. Verification fails closed — a passport that can't be checked is not valid.
## What you get
* **Agent identity as a payments primitive.** A passport is the thing a platform checks before
letting an autonomous agent spend — scopes, a spend limit, and an expiry, bound into one
post-quantum-signed credential.
* **Authenticates the gibberlink transport, secretlessly.** A passport bound to an agent's DID (a `did:key`, or an enrolled `did:web`)
is also what authorises the [gibberlink data-over-sound transport](/payment-rails-sqlite#a2a-over-gibberlink-enrollment-and-anchored-auth):
the agent presents no secret, only a signature the gateway checks against the key named in its DID,
and the passport's scopes and spend limit gate what it may do.
* **Future-proof trust.** Falcon-1024 signing means a long-lived agent identity stays verifiable
after classical signatures are no longer safe to rely on.
* **Verify anywhere, with no infrastructure.** The credential is offline-verifiable from the
issuer's public key alone. A counterparty embeds verification without standing up a service or
calling back to you.
* **Revocation that actually ships.** Instant revoke plus a cacheable revocation list, so authority
can be withdrawn in real time — not left as a future enhancement.
* **One thing to integrate.** A uniform issue / verify / revoke surface with a pluggable store,
so it drops into your backend and persists where you already persist.
* **A content-addressed identity.** Each passport exposes a stable content address derived from its
claims, the same address an AP2/A2A adopter pins and the same one the [Spend Guardrail](/spend-guardrail)
binds into a decision, so an agent's identity reconciles, byte for byte, across the whole authorization
chain.
* **Fail-closed when it counts.** In strict mode, if the revocation directory cannot be reached the
verifier refuses rather than honour a possibly-revoked passport. An enforcement gate should never let a
credential through on the strength of "we could not check".
* **Optionally Substrate 2-bound.** Pair a verified passport with a [Substrate 2](/substrate-2)
receipt to turn "this agent is trusted" into a signed, offline-verifiable, audit-ready
attestation — and to layer on zero-knowledge reputation and cross-issuer federation.
## How it works
| Step | What happens |
| ---------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| **Issue** | Bind an agent to scopes + a spend limit + an expiry; sign the payload with the post-quantum issuer key; return the passport credential. |
| **Verify** | A counterparty checks the signature, expiry, and revocation status from the issuer public key — offline. Fails closed. |
| **Revoke** | Withdraw a passport instantly; it appears on the cacheable revocation list and verification reports it as revoked. |
## Cryptography
* **Post-quantum signing.** Passports are signed with Falcon-1024 (NIST Level 5) and verify offline
against the issuer's public key — evidence signed today stays unforgeable after the migration to
post-quantum cryptography.
* The passport itself carries no zero-knowledge proof; reputation proven in zero-knowledge is a separate
capability (see [Proofs](/proofs)).
## Why commercial
The issuer and verifier layer was never published as open source — there is no free tier to fall
back on. It is offered as a **commercial product** because the value is in the maintained,
correct, payments-grade trust layer:
* **Embed without attribution overhead.** A commercial OEM licence lets you ship it inside your own
product with no open-source notice obligations to carry through distribution.
* **Enterprise terms.** Support, warranty, and a defined relationship — the terms procurement and
risk teams expect for a trust-critical dependency.
* **Maintained crypto suite.** Post-quantum primitives, key rotation, and revocation hosting are
ongoing work, bundled into the licence rather than inherited.
## Who it's for
* **Agentic-commerce and autonomous-procurement platforms** that grant, bound, and revoke spend
authority for AI agents.
* **Agent marketplaces and registries** that need verifiable, revocable agent identity with a
trust scope.
* **x402 and machine-payment systems** that need a portable credential an agent can present across
counterparties.
* Anyone who needs **trustworthy, revocable agent identity** without building a post-quantum
credential stack themselves.
When two agents that each hold a passport need to actually settle a payment with each other, that
is [agent-to-agent settlement](/chain-agnostic-negotiation): it puts both identities on both sides of one
settlement, enforces the boundary for both, and produces a verifiable execution reference.
## Frequently asked questions
### What is Agent Passport?
Agent Passport gives an AI agent a verifiable, revocable identity you can check before you let it move money. You issue a passport that binds the agent to a set of scopes and a spend limit, sign it with a post-quantum key, and hand it to the agent. A counterparty verifies that passport offline, with nothing but the issuer's public key, and decides whether to grant the agent spend authority.
### Can a passport be verified without calling back to the issuer?
Yes. The credential is offline-verifiable from the issuer's public key alone, with no callback and no database lookup for the cryptographic check. Every passport is signed with Falcon-1024, so agent identities you issue today stay verifiable past the migration to post-quantum cryptography.
### What happens when an agent should lose authority?
You revoke the passport instantly and publish a cacheable revocation list, and verification then reports it as revoked. Verification fails closed: in strict mode, if the revocation directory cannot be reached the verifier refuses rather than honour a possibly-revoked passport, so a credential that cannot be checked is not treated as valid.
### How is Agent Passport licensed?
It ships inside the Payment Rails bundle, where one commercial licence installs the whole self-hosted payment-rails estate. It binds to Substrate 2 (it is not part of Substrate 2 itself), is included in the Enterprise and On-premise plans, and is not distributed on public package registries. Install is token-gated from the AlgoVoi private index, and you set `ALGOVOI_LICENSE_KEY` to run.
## Get Agent Passport
Agent Passport ships inside the [Payment Rails bundle](/payment-rails-sqlite). One commercial licence
installs the whole self-hosted payment-rails estate. It binds to Substrate 2 (it is not part of
Substrate 2 itself), is included in the AlgoVoi Enterprise and [On-premise](/on-premise) plans, and is
not distributed on public package registries. Install is token-gated from the AlgoVoi private index; set
`ALGOVOI_LICENSE_KEY` to run. See the [Payment Rails bundle](/payment-rails-sqlite) for licensing, or
[email us](mailto:hello@algovoi.co.uk) for Enterprise / OEM.