The authorization layer
for AI agents.
A cryptographic framework requiring an AI agent’s actions to match a signed, human-declared intent before execution — enforced at the gate, not audited after the fact.
Before an agent acts, it holds a signed certificate declaring what it’s authorised to do, within what bounds, for how long. Every action is checked against that certificate before execution. Anything outside the declared scope is blocked — not logged as a violation afterward, refused before it happens. Implemented and directly tested — see Verified Implementations below.
What’s actually filed, and what that means
| Item | Detail | Status |
|---|---|---|
| Patent | GB2603013.0, UK IPO | Pending — not yet granted |
| Priority date | 10 February 2026 | Established |
| PCT coverage | 150+ countries | Active to August 2028 |
| WIPO DAS | Access Code C9A6 | Confirmed 15 April 2026 |
| IETF Draft | draft-williams-intent-token-00 | Live Internet-Draft, not a ratified standard |
| NIST filings | 13 filings, Docket NIST-2025-0035 | Closed 9 March 2026 — on the public record |
| NCCoE filings | 10 filings, AI Agent Identity & Authorization | On the public record |
Filing something with NIST or NCCoE places it on the public record and establishes a timestamp. It is not the same as those bodies validating or endorsing the framework — worth being precise about that distinction.
A fast-moving space
A dated, public fact.
We’ve observed conceptual similarities between IBA and emerging industry frameworks addressing AI agent authorization. We see this as evidence the underlying problem is real and the timing is right — and as a potential opportunity for complementarity or collaboration, not a competitive claim.
Regulation is moving in the same direction. The EU AI Act’s requirements for human oversight (Article 14) and automated logging (Article 19) of high-risk AI systems become enforceable on 2 August 2026 — the kind of obligation this architecture is designed to support. This is offered as context for why the underlying problem is timely, not as a claim of compliance with the Act, which would require formal legal assessment.
27 July 2026 — Nevada’s Transportation Authority granted an interim permit for driverless robotaxi operation on the Las Vegas Strip, with strict operational bounds and mandated human supervision. As AV operators layer dispatch, fleet-management, and passenger-interaction AI around permitted fleets, that agentic layer is exactly what this architecture targets.
22 August 2026 — Testing an unrelated, generic multi-agent coding tool (UltimateAgentVC) surfaced the same failure mode directly: self-reported grades were trusted with no verification, and an agent’s own claimed score could trigger an unreviewed auto-merge to production. Not constructed as a test case — found running the tool exactly as documented. Full writeup and fix →
26 August 2026 — Meta agreed to a roughly $17–18 billion settlement with a coalition of U.S. state attorneys general over claims it designed Facebook and Instagram to be addictive to minors, mandating default daily time limits and nighttime access blocks for teens. TikTok separately settled with the DOJ for $400 million over related child-privacy violations, and Snap faces comparable litigation. The underlying gap in all three cases — an engagement algorithm taking real actions with no check that the action was authorized for this specific, vulnerable context — is exactly the class of problem this architecture targets, applied here to a different industry than autonomous vehicles or coding tools.
What’s built, stated plainly
| Component | What it does | Status |
|---|---|---|
| Intent Certificate | Signed declaration of scope, principal, and expiry | Implemented, tested |
| Gate | Pre-execution ALLOW / BLOCK / FLAG / KILL decision, per action | Implemented — sub-millisecond, measured directly |
| Audit Chain | Hash-chained log of every gate decision | Implemented — in-memory only, not yet persistent |
| Signing | ECDSA P-256 asymmetric signing | Implemented, tested — private key signs, public key verifies |
| Multi-agent delegation | Scoped sub-certificates for orchestrator hierarchies | Conceptual — core property tested; full hierarchy not yet built |
Read the code. Run it. Measure it.
Rather than list every repository, here’s what’s actually been checked.
iba-swarmforge
1,000-agent governed vs. ungoverned swarm simulation.
iba-x-demo
IBA wrapping xAI’s open-sourced Phoenix recommendation pipeline. Four scoped endpoints, each requiring an exact-match signed certificate — tested against valid, expired, forged, and wrong-scope credentials.
github.com/Grokipaedia/iba-x-demo →iba-autaxi-demo
IBA applied to the agentic decision layer around an autonomous taxi fleet — dispatch, fleet Mission Control overrides, passenger-facing AI, non-driving reroutes. Explicitly does not touch the driving stack or the regulatory operating envelope. Five scenarios tested: valid action, over-scope request, expired certificate, forged signature, and an out-of-declared-set request.
github.com/Grokipaedia/iba-autaxi-demo →iba-youth-safety-demo
IBA applied to minor-safety enforcement on a content/engagement platform — pre-execution checks on notification sending, session-time extension, and content-category serving, governed by a signed parent/guardian policy. Explicitly does not touch the recommendation or ranking algorithm itself. Five scenarios tested: valid action within hours and time cap, notification outside the allowed window, session extension after the daily cap, a blocked content category, and a forged certificate attempting to authorize unlimited time.
github.com/Grokipaedia/iba-youth-safety-demo →A broader set of repositories exists at github.com/Grokipaedia. They’re being verified the same way, one at a time, before being cited here with specific claims.
Explore further
Live Demonstrations
| Interactive Demo — 8 Domains ↗ | Real, working scope-validation engine across eight illustrative scenarios — AI agent, surgical robot, autonomous vehicle, financial system, industrial robot, hiring bias, RSI containment, and a hypothetical high-capability containment case. Signature verification is clearly labeled as simulated. |
| WBA Chain Demo ↗ | Live anomaly-scoring and witness-threshold simulation for the WitnessBound authority-lineage concept. |
| Multi-Adversary Coordination Demo ↗ | Research demo on detecting coordinated sub-threshold attacks that evade single-actor detection. |
| Adaptive Threshold Research Demo ↗ | Illustrates why static anomaly baselines can be gamed, and how adaptive thresholds respond. |
| IBA + MCP Integration ↗ | Scenario walkthroughs for wrapping Anthropic’s Model Context Protocol tool calls in declared-intent boundaries. |
Companion Research
| WitnessBound (WBA) ↗ | Authority-lineage companion to IBA — proves not just that an agent acted within scope, but that the scope declaration itself was legitimately authorized. Filing proposed Q1 2026. |
| Technical Specifications ↗ | Full architectural breakdown of IBA + WBA — five-layer WBA design and NIST threat-category mapping. |
| The Conceptual Framework ↗ | The underlying theory, with citations to independently published research (TechRxiv, OWASP LLM Top 10). |
| Relationship Mesh (Concept) ↗ | An early-stage application concept — applying IBA’s model to subcontracted AI risk between primes and SMBs. Not yet implemented. |
Available for acquisition or licensing discussion
A patent-pending authorization architecture with a filed priority date, published technical specification, and working reference implementations demonstrating the approach functions as claimed — applicable anywhere autonomous AI agents need bounded, auditable authorization, not limited to any single sector or counterparty. Valuation has not yet been formally assessed by a patent attorney — any figure discussed at this stage is a working assumption, not a benchmark.