# Agent Identity Management (AIM)

An identity and access management layer for AI agents that issues each agent a cryptographic key pair, checks its actions against granted capabilities before they run, and records every decision in an audit log.

AIM gives an AI agent a cryptographic identity by generating an Ed25519 key pair when it is registered, then lets a decorator wrap any function with a required capability, such as db:read. Each call is signed, checked through a multi-step fine-grained authorization process against the agent's granted capabilities, and recorded in an audit log; a call for a capability the agent does not hold is refused before the function body runs, and the refusal is also logged.

New agents start in a pending state in which every action is refused until an administrator verifies them in a dashboard, and repeated refused calls while pending can count against a trust score that may later suspend the agent under a strict-mode organization. The SDK is installed with pip, and equivalent one-line usage is available in Java and TypeScript; it can run against a hosted backend or be self-hosted.

It is written in Go and released under the Apache-2.0 license.

Website: https://opena2a.org