Score an agent's trust, do not just check a box
AIP is the identity face: it proves which agent this is (challenge-response key possession) and how far to trust it (a 9-factor score). It sits on the key that did:opena2a resolves, and it feeds the credential ATX carries.
Before the spec: the usual way
The usual way: a single 'verified: true' boolean. It cannot tell a clean agent apart from one that is verified but has active security alerts, no track record, and failing health checks.
the usual way
One boolean cannot tell a clean agent apart from one that is verified but has active security alerts, no operating history, and failing health checks. It is the same green check for both.
AIP is a 1.0.0 draft. The nine factors and their weights are from the spec (section 6.1); the per-factor scores shown are illustrative inputs for one example agent, not measured. Trust scores are computed server-side: the spec requires that agents cannot self-report them and that every input be independently verifiable. The challenge-response signature check is real.
// Illustrative API sketch — @opena2a/aip is not a published package.
// The executable ground truth for AIP §5.1 is the conformance suite:
// https://github.com/opena2a-standards/aip-conformance
import { trustScore } from "@opena2a/aip";
// Server-side: agents cannot self-report; every input is verifiable.
const { score, level } = await trustScore(agentDid);
if (score >= 0.8) allowHighTrustOperations(); // Elevated band