openagentidentityprotocol/agentidentityprotocol

Implements authentication and authorization through cryptographically-signed Agent Authentication Tokens (AAT) that encode agent identity, user binding, and capabilities, with runtime enforcement via a transparent MCP proxy that verifies signatures, checks revocation lists, and evaluates policies before each tool call. Built in Go with Layer 1 establishing agent identities through a root registry and Layer 2 enforcing permissions via DLP scanning and audit logging at the tool-call boundary, designed to address the "god mode" problem where agents currently inherit full user credentials without distinction from human actions.