The authorization layer
for AI agents.
A cryptographic framework requiring an AI agent’s actions to match a signed, human-declared intent before execution — enforced at the gate, not audited after the fact.
Before an agent acts, it holds a signed certificate declaring what it’s authorised to do, within what bounds, for how long. Every action is checked against that certificate before execution. Anything outside the declared scope is blocked — not logged as a violation afterward, refused before it happens. Implemented and directly tested — see Verified Implementations below.
What’s actually filed, and what that means
| Item | Detail | Status |
|---|---|---|
| Patent | GB2603013.0, UK IPO | Pending — not yet granted |
| Priority date | 10 February 2026 | Established |
| PCT coverage | 150+ countries | Active to August 2028 |
| WIPO DAS | Access Code C9A6 | Confirmed 15 April 2026 |
| IETF Draft | draft-williams-intent-token-00 | Live Internet-Draft, not a ratified standard |
| NIST filings | 13 filings, Docket NIST-2025-0035 | Closed 9 March 2026 — on the public record |
| NCCoE filings | 10 filings, AI Agent Identity & Authorization | On the public record |
Filing something with NIST or NCCoE places it on the public record and establishes a timestamp. It is not the same as those bodies validating or endorsing the framework — worth being precise about that distinction.
A fast-moving space
A dated, public fact.
We’ve observed conceptual similarities between IBA and emerging industry frameworks addressing AI agent authorization. We see this as evidence the underlying problem is real and the timing is right — and as a potential opportunity for complementarity or collaboration, not a competitive claim.
Regulation is moving in the same direction. The EU AI Act’s requirements for human oversight (Article 14) and automated logging (Article 19) of high-risk AI systems become enforceable on 2 August 2026 — the kind of obligation this architecture is designed to support. This is offered as context for why the underlying problem is timely, not as a claim of compliance with the Act, which would require formal legal assessment.
What’s built, stated plainly
| Component | What it does | Status |
|---|---|---|
| Intent Certificate | Signed declaration of scope, principal, and expiry | Implemented, tested |
| Gate | Pre-execution ALLOW / BLOCK / FLAG / KILL decision, per action | Implemented — sub-millisecond, measured directly |
| Audit Chain | Hash-chained log of every gate decision | Implemented — in-memory only, not yet persistent |
| Signing | ECDSA P-256 asymmetric signing | Implemented, tested — private key signs, public key verifies |
| Multi-agent delegation | Scoped sub-certificates for orchestrator hierarchies | Conceptual — core property tested; full hierarchy not yet built |
Read the code. Run it. Measure it.
Rather than list every repository, here’s what’s actually been checked.
iba-swarmforge
1,000-agent governed vs. ungoverned swarm simulation.
iba-x-demo
IBA wrapping xAI’s open-sourced Phoenix recommendation pipeline. Four scoped endpoints, each requiring an exact-match signed certificate — tested against valid, expired, forged, and wrong-scope credentials.
github.com/Grokipaedia/iba-x-demo →A broader set of repositories exists at github.com/Grokipaedia. They’re being verified the same way, one at a time, before being cited here with specific claims.
Explore further
Live Demonstrations
| Interactive Demo — 8 Domains ↗ | Real, working scope-validation engine across eight illustrative scenarios — AI agent, surgical robot, autonomous vehicle, financial system, industrial robot, hiring bias, RSI containment, and a hypothetical high-capability containment case. Signature verification is clearly labeled as simulated. |
| WBA Chain Demo ↗ | Live anomaly-scoring and witness-threshold simulation for the WitnessBound authority-lineage concept. |
| Multi-Adversary Coordination Demo ↗ | Research demo on detecting coordinated sub-threshold attacks that evade single-actor detection. |
| Adaptive Threshold Research Demo ↗ | Illustrates why static anomaly baselines can be gamed, and how adaptive thresholds respond. |
| IBA + MCP Integration ↗ | Scenario walkthroughs for wrapping Anthropic’s Model Context Protocol tool calls in declared-intent boundaries. |
Companion Research
| WitnessBound (WBA) ↗ | Authority-lineage companion to IBA — proves not just that an agent acted within scope, but that the scope declaration itself was legitimately authorized. Filing proposed Q1 2026. |
| Technical Specifications ↗ | Full architectural breakdown of IBA + WBA — five-layer WBA design and NIST threat-category mapping. |
| The Conceptual Framework ↗ | The underlying theory, with citations to independently published research (TechRxiv, OWASP LLM Top 10). |
| Relationship Mesh (Concept) ↗ | An early-stage application concept — applying IBA’s model to subcontracted AI risk between primes and SMBs. Not yet implemented. |
Available for acquisition or licensing discussion
A patent-pending authorization architecture with a filed priority date, published technical specification, and working reference implementations demonstrating the approach functions as claimed — applicable anywhere autonomous AI agents need bounded, auditable authorization, not limited to any single sector or counterparty. Valuation has not yet been formally assessed by a patent attorney — any figure discussed at this stage is a working assumption, not a benchmark.