What it found

Enforcement latency

53ms median

N=1,000

Permissive against restrictive policy

74.6% → 0%

588 of 788 attempts against 0 of 879, observational across tiers

Unclaimed prize

$5,000

the Level 5 bounty was never claimed during the live event

Abstract

AI agents today have passwords but no permission slips. They execute tool calls with no standard mechanism to enforce authorization before the action executes. We characterize this gap as the pre-action authorization problem and present the Open Agent Passport (OAP), an open specification and reference implementation that intercepts tool calls synchronously before execution, evaluates them against a declarative policy, and produces a cryptographically signed audit record. OAP enforces authorization decisions in a measured median of 53ms (N=1,000). In a live adversarial testbed, social engineering succeeded against the model 74.6% of the time under a permissive policy; under a restrictive OAP policy, a comparable population of attackers achieved a 0% success rate across 879 attempts.

Data and code

• Specification (Zenodo) — OAP v1.0, Apache 2.0
• arXiv

Related

• APort Vault: Benchmarking AI Agent Payment Authorization with the Open Agent Passport

  4,371 human-authored attacks replayed against 14 models with and without a deterministic pre-action authorization check. 225,964 evaluations.

Cite

@misc{uchibeke2026beforetoolcall,
  title        = {Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous {AI} Agents},
  author       = {Uchibeke, Uchi},
  year         = {2026},
  eprint       = {2603.20953},
  archivePrefix= {arXiv},
  primaryClass = {cs.CR},
  url          = {https://arxiv.org/abs/2603.20953}
}