Open Agent Access
Consequential agents must carry papers. Open Agent Access (OAA) governs any MCP server: every tool call is authorised against a deny-by-default policy and fails closed, and each call leaves a signed, hash-chained receipt — a record you can verify, not just trust.
Why a control layer?
MCP servers expose tools that agents can act through — transact, book, change records — but most ship with no authorisation boundary and no record of what an agent actually did. OAA is that boundary: every action is authorised, denied actions never execute, and each action is signed and chained so it cannot be quietly removed, reordered, or forged.
It’s the governance counterpart to the rest of the toolkit: the scanners tell you whether agents can find and act on you; OAA is how you let them act on your terms, with proof.
Every action gets a verdict
- allowAllowed — a permitted read or tool call proceeds, and is recorded.
- denyDenied — wrong identity, purpose, or scope (and AI-training use) fails closed and never executes.
- chargeCharge / review — actions that need settlement or a human are gated before they run (payments optional).
How a tool call flows
- 1Present a passport. The agent sends its identity, purpose, and intended use (AA-Agent-ID, AA-Purpose, AA-Use).
- 2Policy decision. The guard evaluates the call against a deny-by-default policy and returns allow, deny, charge, or review. Any non-allow verdict fails closed.
- 3Signed receipt before execution. An ed25519-signed, hash-chained receipt is written before the action runs — so the audit trail can’t be backfilled.
- 4Verifiable evidence bundle. Receipts roll up into an immutable bundle anyone can re-verify offline: no actions removed, reordered, or forged.
Drop it into your own MCP server
OAA is exposed here as a live MCP server (POST /api/mcp), and the same guard drops into any MCP server. The open-source reference shows the whole boundary — authorise → fail closed → signed receipt → verifiable evidence — in a sub-30-minute quickstart: github.com/KirkeLabs/oaa-mcp-governance. Built on the published @kirkelabs Open Agent Access packages.
Optional: actions that cost money can settle with x402 (USDC on Algorand) — off by default, and not required to use the governance and audit layer.
See it work
Agent City is the live demonstration: autonomous agents present passports, receive allow / deny / charge decisions, and collect hash-chained receipts, step by step.
Read the policy at /.well-known/agent-access.json, or drop the guard into your own server with the MCP governance reference.