Everything Agent Passport does, why it exists, and how it works — without the jargon.
You ask an AI agent to book you a flight. The agent has your full account access — your credit card, your email, your calendar, everything. It could book a $50 flight, or it could wire $10,000 to the Bahamas. Right now, there's nothing stopping it.
Today's agents use static API keys — the same credentials the human has. There's no way to say "you can read my calendar but not delete anything" or "you can spend up to $500 but not a cent more."
Agent Passport is the permission slip. It says exactly what the babysitter can do (watch kids, use the kitchen), what they can't (no car, no safe), and when it expires (when you get home).
A passport is a signed digital token — a small piece of data that says:
Permissions use a simple namespace:action format. You list exactly what the agent can do.
calendar:read — can read your calendar
calendar:write — can create/edit events
calendar:* — can do anything calendar-related (wildcard)
* — can do literally everything (you almost never want this)
If an agent tries to do something not on its list, it gets denied instantly. No exceptions, no workarounds.
Every passport can have a spending cap. The server tracks how much the agent has spent cumulatively — the agent can't lie about it because the tracking happens server-side.
If the agent tries to spend $200 but only has $150 remaining, the action is denied with a clear reason: "Spend $200 exceeds remaining limit $150 USD."
Every passport has an expiration timestamp. After that moment, the passport is dead — no amount of retrying will make it work.
Default is 24 hours. You can set it to 5 minutes, 1 hour, 7 days — whatever fits the task. A child passport can never outlive its parent. If dad's passport expires at midnight, the kid's passport can't survive past midnight either.
Every time the agent wants to do something, it hits a six-step checkpoint:
If any step fails, the action is denied with a reason. If all pass, the action goes through. Either way, it's logged.
This is the magic. An agent with a passport can create a child passport for a sub-agent — but with equal or fewer permissions. Never more.
The travel bot can give the email drafter permission to send emails — but it cannot give it calendar access or spending power it doesn't have. Permissions only shrink down the chain, never grow. This is called monotonic narrowing.
You can cancel any passport at any time. The moment you do, that passport and every child passport it ever created dies instantly.
This is cascade revocation. You don't need to hunt down every sub-agent and cancel them one by one. Kill the root, and the entire tree falls.
Every single authorize() call is logged — whether it was allowed or denied. The audit trail records:
When it happened · Which passport was used · What action was attempted · Whether it was allowed or denied · Why it was denied
When you're using the authority server, audit logs are persisted in SQLite so they survive restarts. You can query them by passport ID to see everything that agent ever tried to do.
Every passport is signed with Ed25519 — the same cryptographic algorithm used to secure SSH connections and cryptocurrency wallets. If anyone changes even a single character in the passport, the signature breaks and it's rejected.
For simple single-agent setups, passports use JWT (JSON Web Tokens) — the same standard used by most web apps. Simple, well-understood, battle-tested.
For multi-agent delegation chains, passports use Biscuit tokens. Biscuits are a newer token format with a superpower: Datalog policies.
When an agent delegates to a sub-agent using Biscuit mode, the child's restrictions are appended to the token cryptographically — the parent's rules can never be removed, only added to. This is how monotonic narrowing is enforced at the protocol level, not just the application level.
The SDK works locally for development, but for production you want a central authority — a server that issues passports, tracks spending, persists revocations, and stores audit logs.
Agent Passport isn't a standalone tool — it's a layer that drops into frameworks you already use. One import, a few lines of config, and every action is passport-checked.
For HTTP middleware (Express, Fastify, Next.js), the passport is extracted from the x-agent-passport header. The action is auto-derived from the HTTP method + path: POST /api/users becomes api:users:post.
Open source doesn't mean no moat. Here's what compounds over time: