Score an agent's trust, do not just check a box
AIP is the identity face: it proves which agent this is (challenge-response key possession) and how far to trust it (a 9-factor score). It sits on the key that did:opena2a resolves, and it feeds the credential ATX carries.
Before the spec: the usual way
The usual way: a single 'verified: true' boolean. It cannot tell a clean agent apart from one that is verified but has active security alerts, no track record, and failing health checks.
the usual way
One boolean cannot tell a clean agent apart from one that is verified but has active security alerts, no operating history, and failing health checks. It is the same green check for both.
AIP is 1.2.0-draft (draft-fane-opena2a-aip-04). The nine factors and their weights are from the spec (section 6.1); the per-factor scores shown are illustrative inputs for one example agent, not measured. Trust scores are computed server-side: the spec requires that agents cannot self-report them and that every input be independently verifiable. The challenge-response signature check is real.
// Illustrative API sketch: @opena2a/aip is not a published package.
// The executable ground truth for AIP §5.1 is the conformance suite:
// https://github.com/opena2a-standards/aip-conformance
import { trustScore } from "@opena2a/aip";
// Server-side: agents cannot self-report; every input is verifiable.
const { score, level } = await trustScore(agentDid);
if (score >= 0.8) allowHighTrustOperations(); // Elevated band