🛡️ APort - Agent Identity & Policy Enforcement

APort Logo

The neutral, portable passport + verify + suspend rail for AI agents

Built on the Open Agent Passport (OAP) v1.0 specification

GitHub Actions API Status License

🌐 Website • 📚 Docs • 🚀 Try Now • 💬 Support

🎯 The Problem

graph TD
 A[🤖 AI Agent] --> B[💳 Refund 1000ドル]
 A --> C[📊 Export 1M Rows]
 A --> D[🔀 Merge to Main]
 A --> E[🚀 Deploy to Prod]
 
 B --> F[❌ No Identity Check]
 C --> F
 D --> F
 E --> F
 
 F --> G[💥 Security Incident]
 G --> H[⏰ Hours to Detect]
 H --> I[💰 10ドルK+ in Damages]
 
 style A fill:#ff6b6b
 style F fill:#ff6b6b
 style G fill:#ff6b6b
 style I fill:#ff6b6b

Organizations are letting AI agents perform sensitive actions without proper identity verification or policy enforcement.

✨ The Solution

graph TD
 A[🤖 AI Agent<br/>with Passport] --> B[🛡️ APort Verify]
 B --> C{Policy Check}
 C -->|✅ Allowed| D[✅ Action Proceeds]
 C -->|❌ Blocked| E[🚫 Action Blocked]
 
 F[📋 Policy Pack] --> B
 G[⚡ Global Suspend] --> B
 
 style A fill:#06b6d4,color:#ffffff
 style B fill:#10b981,color:#ffffff
 style D fill:#10b981,color:#ffffff
 style E fill:#ef4444,color:#ffffff
 style F fill:#8b5cf6,color:#ffffff
 style G fill:#f59e0b,color:#ffffff

APort provides a neutral, portable identity and policy enforcement layer for AI agents across all platforms.

🚀 Quick Start

1. Create Your Agent Passport

# Create a passport via API
curl -X POST "https://api.aport.io/api/issue" \
 -H "Content-Type: application/json" \
 -H "Authorization: Bearer YOUR_JWT_TOKEN" \
 -d '{
 "name": "HappyRefunds Bot",
 "role": "Support Refunds",
 "description": "Refund helper for customer support",
 "capabilities": [{"id": "finance.payment.refund", "params": {}}],
 "limits": {
 "refund_amount_max_per_tx": 50,
 "refund_amount_daily_cap": 200
 },
 "regions": ["US", "CA"],
 "contact": "team@aport.io",
 "controller_type": "person",
 "status": "active",
 "links": {
 "homepage": "https://aport.io",
 "repo": "https://github.com/aporthq/agent-passport"
 },
 "categories": ["support", "payments"],
 "framework": ["OpenAI", "LangChain"]
 }'

2. Add Policy Enforcement

# .github/workflows/aport-verify.yml
name: APort Verify PR
on: [pull_request]
jobs:
 verify:
 runs-on: ubuntu-latest
 steps:
 - uses: actions/checkout@v4
 - uses: aporthq/policy-verify-action@v1
 with:
 agent-id: ${{ secrets.APORT_AGENT_ID }}
 policy-pack: 'code.repository.merge.v1'

3. Integrate with Your App

// Express.js with Policy Pack middleware
const { requirePolicy } = require("@aporthq/middleware-express-express");
// Apply policy enforcement to refunds endpoint
app.post("/api/refunds", 
 requirePolicy("finance.payment.refund.v1", "agt_inst_xyz789"),
 async (req, res) => {
 // Your business logic - policy already verified!
 const refund = await processRefund(req.body);
 res.json({ success: true, refund });
 }
);

🎨 Features

🛠️ Supported Platforms

📦 Policy Packs

💳 Finance & Payments

{
 "policy": "finance.payment.charge.v1",
 "capability": "payments.charge",
 "assurance": "L2",
 "limits": {
 "currency_limits": { "USD": { "max_per_tx": 10000 } },
 "allowed_merchant_ids": ["merchant_123"],
 "blocked_categories": ["adult", "gambling"]
 }
}

💰 Refunds Protection

{
 "policy": "finance.payment.refund.v1",
 "capability": "finance.payment.refund", 
 "assurance": "L2",
 "limits": {
 "max_refund_per_tx": 1000,
 "cross_currency_denied": true,
 "reason_codes_required": ["defective", "not_as_described"]
 }
}

📊 Data Export Control

{
 "policy": "data.export.create.v1",
 "capability": "data.export",
 "assurance": "L1", 
 "limits": {
 "max_rows_per_export": 100000,
 "allow_pii": false,
 "allowed_formats": ["csv", "json"]
 }
}

🔀 Repository Safety

{
 "policy": "code.repository.merge.v1",
 "capabilities": ["repo.merge", "repo.pr.create"],
 "assurance": "L2",
 "limits": {
 "max_prs_per_day": 5,
 "allowed_repos": ["owner/repo1"],
 "require_review": true
 }
}

💬 Messaging Control

{
 "policy": "messaging.message.send.v1",
 "capability": "messaging.send",
 "assurance": "L1",
 "limits": {
 "messages_per_hour": 100,
 "allowed_channels": ["support", "notifications"],
 "mention_policies": "restricted"
 }
}

🎯 Real-World Examples

🛒 E-commerce Refund Bot

// Express.js with Policy Pack middleware
const { requirePolicy } = require("@aporthq/middleware-express-express");
app.post("/api/refunds", 
 requirePolicy("finance.payment.refund.v1", "agt_inst_xyz789"),
 async (req, res) => {
 // Policy already verified! Check specific limits
 const passport = req.policyResult.passport;
 
 if (req.body.amount > passport.limits.refund_amount_max_per_tx) {
 return res.status(403).json({
 error: "Refund exceeds limit",
 requested: req.body.amount,
 limit: passport.limits.refund_amount_max_per_tx
 });
 }
 // Process refund safely
 const refund = await stripe.refunds.create({
 amount: req.body.amount,
 payment_intent: req.body.payment_intent
 });
 
 res.json({ success: true, refund });
 }
);

🔀 GitHub PR Automation

# .github/workflows/aport-verify.yml
name: APort Verify PR
on: [pull_request]
jobs:
 verify:
 runs-on: ubuntu-latest
 steps:
 - uses: actions/checkout@v4
 - name: Verify via APort
 run: |
 BODY=$(jq -n \
 --arg agent_id "$APORT_AGENT_ID" \
 --arg repo "$GITHUB_REPOSITORY" \
 --arg base "${{ github.event.pull_request.base.ref }}" \
 --arg head "${{ github.event.pull_request.head.ref }}" \
 --argjson files_changed "${{ steps.changed-files.outputs.files }}" \
 '{
 agent_id: $agent_id,
 context: {
 repo: $repo,
 base: $base,
 head: $head,
 files_changed: $files_changed,
 author: "${{ github.event.pull_request.user.login }}"
 }
 }')

 curl -s -X POST "https://api.aport.io/api/verify/policy/code.repository.merge.v1" \
 -H "Content-Type: application/json" \
 -d "$BODY" | tee result.json
 env:
 APORT_AGENT_ID: ${{ secrets.APORT_AGENT_ID }}

📊 Data Export Control

// FastAPI with Policy Pack middleware
from fastapi import FastAPI, Request
from aport.middleware import require_policy
@app.post("/api/data/export")
@require_policy("data.export.create.v1", "agt_inst_xyz789")
async def export_data(request: Request, export_data: dict):
 passport = request.state.policy_result.passport
 
 # Check PII permission
 if export_data.get("include_pii") and not passport.limits.allow_pii:
 raise HTTPException(403, {
 "error": "PII export not allowed",
 "agent_id": passport.agent_id,
 "upgrade_instructions": "Request PII export capability from your administrator"
 })
 
 # Check row limit
 if export_data["rows"] > passport.limits.max_rows_per_export:
 raise HTTPException(403, {
 "error": "Export exceeds row limit",
 "requested": export_data["rows"],
 "limit": passport.limits.max_rows_per_export
 })
 
 # Process export safely
 return {"success": True, "export_id": f"exp_{int(time.time())}"}

📊 Performance & Reliability

🏆 Why Choose APort?

🎯 Neutral & Portable

⚡ Real-time Enforcement

🔐 Enterprise Ready

🛠️ Developer Friendly

👥 For Every Role

🤖 Agent Builders

# Issue a passport
curl -X POST "https://api.aport.io/api/issue" \
 -H "Authorization: Bearer YOUR_JWT_TOKEN" \
 -d '{
 "name": "HappyRefunds Bot",
 "role": "Support Refunds",
 "description": "Refund helper for customer support",
 "capabilities": [{"id": "finance.payment.refund", "params": {}}],
 "limits": {"refund_amount_max_per_tx": 50},
 "regions": ["US", "CA"],
 "contact": "team@aport.io",
 "controller_type": "person",
 "status": "active"
 }'

🏢 Platform Developers

// Express.js middleware
const { requirePolicy } = require("@aporthq/middleware-express-express");
app.post("/api/refunds", 
 requirePolicy("finance.payment.refund.v1", "agt_inst_xyz789"),
 async (req, res) => {
 // Policy already verified!
 res.json({ success: true, refund: await processRefund(req.body) });
 }
);

🔧 DevOps Engineers

# .github/workflows/aport-verify.yml
name: APort Verify PR
on: [pull_request]
jobs:
 verify:
 runs-on: ubuntu-latest
 steps:
 - uses: actions/checkout@v4
 - uses: aporthq/policy-verify-action@v1
 with:
 agent-id: ${{ secrets.APORT_AGENT_ID }}
 policy-pack: 'code.repository.merge.v1'

🎯 No-Code Platforms

# Mint instance passport on tenant install
curl -X POST "https://api.aport.io/api/passports/agt_tmpl_abc123/instances" \
 -H "Authorization: Bearer YOUR_PLATFORM_API_KEY" \
 -d '{
 "platform_id": "gorgias",
 "controller_id": "org_acme",
 "tenant_ref": "store_987",
 "overrides": {"limits": {"refund_amount_max_per_tx": 50}}
 }'

🚀 Get Started Today

Try APort

Contact Sales

Support

📚 Resources

🤝 Contributing

📄 License

🛡️ Secure your AI agents. Trust but verify.

GitHub Twitter LinkedIn

Made with ❤️ by the APort team