Agent Native
A project exploring how businesses can decide what outside agents may discover, request, and safely do, with evidence instead of a suspiciously cheerful readiness score.
System flow
How the pieces move.
- Discover Collect bounded public business artifacts and protocol signals.
- Authorize Separate agent identity, delegated authority, and business policy.
- Control Simulate actions, bind confirmations, and enforce transaction safety.
- Prove Return receipts, traces, recovery evidence, and public findings.
Problem Statement
A business can have a good website and a working API while still leaving software agents unable to identify capabilities, prove delegated authority, stay inside policy, avoid duplicate side effects, recover from failure, or show what actually happened.
Architecture Summary
The project starts with bounded readiness assessment, then points toward protocol adapters, agent identity, delegated authority, participation policy, controlled simulation, transaction safety, receipts, and traces. The goal is to explore the control layer between agent capability and trusted business action.
Key Design Tradeoffs
- Uses deterministic checks for the core scan so findings remain reproducible, inspectable, and safe under hostile content.
- Keeps passive readiness scanning separate from active simulation because understanding a capability is not the same as safely executing it.
- Treats identity, delegation, policy, and transaction safety as separate controls instead of hiding them behind one trusted-agent flag.
- Rejects a global readiness score because severe authorization or transaction weaknesses should remain visible, not averaged into comfort.
- Adapts existing interface standards into an internal model instead of publishing another protocol for everyone to tolerate.
Technologies
Agent Native asks a direct question: can an AI agent actually do business with you?
The first release answered that question with a passive scanner. It reviews public business material such as a website, OpenAPI document, or agent card. It checks whether an agent can discover the interface, understand its operations, identify authentication and authorization requirements, distinguish reads from mutations, recover from failures, and preserve evidence for the user.
The current catalog contains 20 deterministic checks. Results stay separate by design. Missing version information should not average away an exposed credential, and excellent response schemas should not excuse wildcard authorization.
The scan is passive. It does not log in, submit forms, make purchases, or invoke discovered operations. When public evidence cannot prove runtime behavior, the result says so.
The less visible part of the project is the report boundary. Fetched content remains internal. Public reports include sanitized summaries and bounded evidence fragments, and every finding must match a known artifact ID, URI, type, and content hash before rendering.
Version 1.0.0 is standard-library-only and includes 50 passing tests across unit, integration, security, and evaluation suites. It is a readiness assessment, not a certification. The distinction is less marketable and more accurate.
The next module explores the move from passive readiness into controlled participation. That means agent identity, delegated authority, business policy, simulation boundaries, idempotency, receipts, traces, and reviewable evidence.
The larger idea is that agent-mediated business will require explicit interfaces for capability, authority, side effects, recovery, and human control. Agent Native is an early attempt to make those requirements concrete, testable, and open for improvement.