/ Portable authorization for AI agents
Authorize
your AI.
Verify anyone else’s.
The open Ratify Protocol is the portable authorization layer for AI agents: any verifier can check who authorized an agent, what it can do, and for how long, offline and with no vendor in the path. The core cryptographic check completes in milliseconds. APIs, voice, video, and Physical AI.
Keep your IAM, OAuth, MCP, A2A, and policy engines. Ratify adds the missing proof that an agent had delegated authority before it acts.
/ The problem
Every AI agent
claims authorization.
None can prove it.
What's happening
Agents act, constantly
AI agents are already making phone calls, joining meetings, sending emails, and executing transactions on your behalf, and on behalf of people you do business with. Every agent claims authorization. None can prove it.
What the industry tries
Reuse web-app tokens
Bearer tokens worked when a human was present, a client called a known API, and the session stayed inside one app boundary. Agents act later, call many tools, cross vendors, and hand work to other agents.
What you actually need
Math, not a phone call
A signed, peer-verifiable proof that travels with the agent. Anyone can check it in milliseconds, offline, with the principal's public key. MCP moves a tool call. OAuth authenticates an account. Policy engines interpret rules. Ratify proves the agent had delegated authority before the action.
/ How it works
One protocol.
Three verbs.
Ratify is a single primitive applied consistently. Every integration is some subset of Delegate, Present, Verify.
Delegate
A principal signs a certificate naming the authorized agent, granted scopes, and expiry. Private key never leaves the principal's device.
cert := ratify.Delegate(
alice.Key,
scheduler.ID,
[]string{"meeting:attend"},
7*24*time.Hour,
)Present
The agent attaches a proof bundle: the cert plus a fresh signature over a server-issued challenge. Proves the key is live right now.
bundle := ratify.Present(
cert,
agent.Sign(nonce),
)Verify
The receiving party runs deterministic checks: signature, freshness, expiry, revocation, scope. Milliseconds. Yes or no.
ok, scope := ratify.Verify(bundle)
if ok {
allow(scope)
}/ The flow
One signed bundle
crosses the room.
A principal signs once. The agent presents on demand. Any third party can verify in milliseconds, with no shared infrastructure, no live token call, and no trust relationship with the agent ahead of time.
Principal · Alice
Alice signs a DelegationCert binding her agent's public key to a scope, optional geo/time/speed constraints, and an expiry. Private key never leaves Alice's device.
Agent
Agent collects its delegation chain and signs a fresh verifier-issued challenge. Proves the agent's key is live right now and bounds replay to the freshness window.
Anyone · Verifier
Five deterministic checks: signature (Ed25519 AND ML-DSA-65), freshness, expiry, revocation, scope. Under a millisecond. Offline. No live call to a central authority.
The same primitive works for humans authorizing agents and for agents sub-authorizing other agents; same wire format, same verifier algorithm.
/ Where it runs
Authorization everywhere
your agents act.
Ratify is channel-agnostic. The same bundle format works wherever an agent meets a human, or another agent. Software agents today, embodied agents as they arrive.
Managed Verify API: alpha
Agentic API
MCP and A2A move tool calls and handoffs. Ratify does not replace them; it adds the proof attached to each request. Your gateway verifies before the agent touches any tool.
Protocol pattern available; managed integration roadmap
Conversational AI
Voice agents, video avatars, and real-time AI personas present a bundle at session setup. Your gateway verifies and scopes what the agent may transact. Designed for SIP, WebRTC, PSTN, and agent platforms such as Bland, Retell, HeyGen, and Tavus.
Zoom adapter: under validation
Meetings
An AI agent joining a Zoom meeting presents a Ratify bundle. The Ratify Meetings verifier checks it and reports who authorized the agent, what it may do, and how long it has. No detection, no guessing.
Protocol and SDK support available; managed integration later
Physical AI
Drones, robots, and infrastructure actuators verify bundles before performing physical actions. On-device verification evaluates signed geographic, time, and operating constraints before the device's control software acts.
Backed by
/ Why peer verification
A network call isn’t a proof.
Math doesn’t go offline.
The standard model for agent authorization sends every check across the wire: the receiving party asks a vendor’s policy API, and trusts the reply. Convenient, but no one verified anything cryptographically. The receiver has just delegated their trust to a third party they hope is online, honest, and reachable.
Ratify adds a signed, portable proof to that stack. Any party, your gateway, an embedded device, a regulator auditing six months later, an agent talking to another agent offline, can verify the bond between the agent and the human who authorized it in milliseconds, with the principal’s public key, with no vendor in the path.
Cryptographic proof works offline. Policy servers don’t.
Policy server model
- · Receiver calls a vendor’s API per check
- · Trust anchor = the vendor
- · Verification requires connectivity
- · Vendor outage = your outage
- · Audit = the vendor’s log
- · Bearer token = possession of a credential
Ratify (peer-verifiable)
- · Receiver verifies with the principal’s public key
- · Trust anchor = the principal’s signature
- · Verification works offline
- · No vendor in the path; no SaaS outage exposure
- · Audit = hybrid-signed receipts chained by
prev_hash - · Proof = delegated authority for this action
/ Why not detection
Detection is a losing bet.
We should know.
we tried it first.
The consumer-facing “is this a real human” market is being commoditized by biometric partnerships like Zoom+World. We built deepfake detection before pivoting to Ratify, so we know the arms race firsthand: synthesis gets cheaper every quarter; detection always ends up chasing.
Ratify takes the opposite position. Stop trying to detect what’s fake. Require every legitimate agent to carry a signed, portable authorization. Everything that lacks one is unauthenticated by definition, not because a model guessed, but because cryptography said so.
Cryptographic authorization works forever, regardless of AI quality.
/ Who it’s for
Built for enterprises
deploying agents.
Financial Services
SOX, FINRA, NYDFS demand authorization trails. Voice agents already transact.
Healthcare
HIPAA requires auditable access. AI scribes are in clinical calls today.
Legal
Privilege depends on knowing who authorized an AI note-taker and what it was allowed to do.
Enterprise Agent Buyers
Agentforce, Copilot Studio, custom voice agents; compliance won't sign off without a pre-action authorization record.
/ The protocol
Open protocol.
Enterprise infrastructure.
The Ratify Protocol is open and free, forever. Five SDKs under Apache-2.0, the spec under CC-BY-4.0, cross-language byte-identical conformance fixtures, quantum-safe hybrid crypto (Ed25519 + ML-DSA-65). The verifier algorithm lives in the protocol, not on our servers, you can run a verifier in production today with no commercial relationship and no live call back to Identities AI.
It is built for the agentic web, where a bearer token alone cannot tell a receiver who delegated authority to an agent, what scope was granted, or whether that authority was valid before the action. Ratify makes that proof portable across IAM, OAuth, MCP, A2A, REST, gRPC, and policy engines.
On top of the protocol we sell Ratify Verify in three commercial motions: a managed, metered verification API with hosted revocation checks and a hash-chained audit trail (in alpha), design-partner engagements for evidence and compliance capabilities, and Verify Sovereign, a roadmap offering available for design-partner development toward a licensed, customer-deployed control plane. The open protocol remains free; you pay for the operated infrastructure around it. Verify is in alpha: developers can use the alpha console and quickstart, and design-partner engagement is available for production-oriented evaluations.
/ Enterprise-ready
Answers to the questions
procurement will ask.
Boring but essential. Deployment shape, revocation, audit retention, key custody, compliance mapping; sourced from the protocol spec and the Verify product docs, not marketing.
Deployment
Open Protocol is free forever (Apache-2.0 SDKs + CC-BY-4.0 spec). Ratify Verify is sold in three commercial motions: Verify Operational (managed, metered verification API with hosted revocation checks and a hash-chained audit trail: $0.002/verification; personal workspaces start with $50 in alpha credits, no monthly minimum), Verify Trust (design-partner engagements for evidence and compliance capabilities, annual contract from $30K/yr), and Verify Sovereign (a roadmap offering available for design-partner development toward a licensed, customer-deployed control plane, from $50K/yr). Agentic API (MCP / A2A / REST) is the current alpha surface; a Meetings control plane and Zoom adapter are under validation, with Conversational AI and Physical AI integrations on the roadmap.
Revocation
Signed revocation lists issued by the principal: only the principal's private key can mint them. Verifiers fail closed once required revocation state exceeds the configured freshness bound (`revocation_error`). Configure revocation freshness according to the action's risk and the relying system's availability requirements. Verify Operational performs hosted revocation checks on every managed verification; push-based propagation to connected verifiers is on the roadmap (architecture per SPEC §17.1). Always per-cert; no `revoke everything from Alice` button.
Audit
Verify Operational: 30-day searchable audit retention; SIEM webhook outputs are on the roadmap. Verify Trust design-partner engagements can scope extended retention, including 365-day retention where contractually agreed. The open protocol defines hybrid-signed `VerificationReceipt`s chained by `prev_hash`; managed issuance and retention are available for development through Verify Trust design-partner engagements. A downloadable SOC2/ISO evidence bundle is on the roadmap. The open SDK also exposes the receipt primitive for customer-operated evidence systems.
Crypto posture
Every signature is hybrid Ed25519 + ML-DSA-65 (NIST FIPS 204). Both components must verify. Bundles signed today remain unforgeable when a cryptographically-relevant quantum computer exists: that's the harvest-now-decrypt-later defense. JSON wire format. Open spec under CC-BY-4.0. 63 canonical conformance fixtures regenerate byte-identical across Go, TypeScript, Python, Rust, and C/C++ on every CI run.
Key custody
Three modes, documented and supported. Self-custody: the user's private key never leaves the device. This is the strongest threat model. Custodial: Verify generates and stores the key under envelope encryption (AES-256-GCM data key wrapped by Cloud KMS); convenient default for enterprise SaaS. Self-custody upgrade: migrate from custodial to device-held without breaking authorization continuity, via a `KeyRotationStatement` double-signed by both old and new keys.
Compliance
Ratify is being designed to support SOC 2 and ISO 27001 control requirements; no certification is currently claimed. Data residency, DPA terms, and SSO requirements are scoped during design-partner evaluation and remain subject to technical and legal review. Audit-field mappings for SOX, FINRA, NYDFS, HIPAA, and the EU AI Act are on the roadmap. Verify Sovereign is intended for customer-controlled and isolated deployments; packaging is on the roadmap.
Every claim above traces to either the open protocol spec or the Verify product documentation. For the audit-control mappings, the threat model, and the hybrid-signature security argument, email security@identities.ai.
/ Get started
Ready to stop trusting AI
and start verifying it?
Ratify Verify is in alpha: developers can use the alpha console and quickstart today, and design-partner engagement is available for production-oriented evaluations.
Enterprises
Secure your agent interactions across voice, video, and API.
Platforms
Give every agent action a verifiable authorization proof.