ZeroID
Identity infrastructure for autonomous agents that issues short-lived, cryptographically verifiable credentials, enforces delegated authority through chains of agents, and revokes access in real time.
ZeroID answers the question of which agent performed an action, on whose authority, and with what permissions, replacing the common pattern of agents impersonating users through shared service accounts. Each agent gets a stable, globally unique identity URI, built on OAuth 2.1, WIMSE/SPIFFE and RFC 8693 token-exchange delegation.
When one agent delegates to another, its scope is automatically attenuated so the sub-agent can only receive permissions the orchestrator already holds, capped further by the sub-agent's own policy; every issued token carries the full on-behalf-of chain recording who authorized it, what scope was granted, and how deep the delegation goes. The project describes its scope as agent identity specifically, distinct from human-identity providers such as Okta or Entra and from general workload-identity systems such as SPIFFE/SPIRE, meant to federate with those systems rather than replace them.
It is written in Go, uses PostgreSQL, and is licensed under Apache-2.0.