APort
APort is authorization infrastructure for AI agents built on four primitives: Passport (W3C DID/VC verifiable agent identity), Policy (pre-action enforcement — allowlists, spending caps, file size lim
About
APort is authorization infrastructure for AI agents built on four primitives: Passport (W3C DID/VC verifiable agent identity), Policy (pre-action enforcement — allowlists, spending caps, file size limits), Deliverable Contract (quality gates that must be met before an agent can mark a task done), and Proof (Ed25519-signed cryptographic records of every decision). Unlike prompt-based guardrails that agents can ignore, APort physically prevents agents from proceeding until policy conditions are met. Works with OpenClaw, LangChain, LangGraph, CrewAI, OpenAI, and Express/FastAPI backends. Open source, <200ms policy check latency.
AI engineering teams building multi-agent workflows who need deterministic quality gates and audit trails — and regulated industry teams (finance, healthcare) who need cryptographic proof of what agents were authorized to do and what they actually delivered.
Pros & Cons
Pros
- check Deterministic enforcement, not suggestions — agents literally cannot proceed until policy conditions are satisfied
- check W3C DID/VC passport standard makes agent identity portable and verifiable across platforms
- check Ed25519-signed proofs create court-admissible audit trails for SOC 2, HIPAA, SOX, IIROC compliance
- check Deliverable contracts gate task completion on quality criteria — blocks "marked done but wasn't" failure mode
- check Open source with a one-command CLI setup (`npx @aporthq/aport-agent-guardrails`) for rapid integration
Cons
- close Early-stage with a "Design Partner Program" framing — production-hardened status is uncertain
- close W3C DID/VC identity adds conceptual overhead; teams unfamiliar with verifiable credentials face a learning curve
- close Policy authoring requires careful design — overly restrictive policies can block legitimate agent actions
- close Compliance claims (SOC 2, HIPAA, SOX) reflect the framework's capabilities, not certifications APort itself holds
- close Policy check latency (<200ms) adds overhead to every agent tool call at scale