How it works
Trust you can check, not just take.
OpenAIIS records who claimed what, who allowed it and who answers for it, then lets any service check that chain for itself. Here is the whole idea in five parts.
Everything starts as a signed claim
A claim says what was asserted, by whom, about which exact thing, and with what supporting evidence. The issuer signs it with their own key, so it can't be altered or misattributed.
Only a fingerprint of the content is recorded. The file itself can stay private: anyone who later receives it can check it is the same one.
- Type
- Software release
- Subject
- billing-app 2.4.0
- Issuer
- Company X release agent
- Content
- sha256:c40e…e6e4
- Evidence
- 1 linked report
Every agent links back to people who answer for it
Holding an agent's key is never enough. Before an agent's action counts, each link in the chain must be signed separately: the organisation, the operator, a person who accepts responsibility, and a delegation that covers this exact action.
Authority is specific. A key trusted to publish software can't change its own permissions, and a credential issuer has no say over software releases.
- Company X is the organisation that answers for the agent
- Operator binds the agent to its control
- Responsible person accepts responsibility for its work
- Agent receives a defined authority to publish
- Release is signed by the agent, down to the exact bytes
- Evidence such as a security scan is signed by its issuer
History stays. Trust can change.
Things change after a claim is published: keys leak, consent is withdrawn, people disagree. OpenAIIS never edits the past. Each change is a new signed record with its own author, so the full story is always visible.
A revocation, a withdrawal and a dispute mean different things, and they are kept apart rather than squashed into one "verified" badge.
- RegisteredCompany X registers billing-app 2.4.0
- AttestedA security firm signs a scan report for it
- DisputedA third party raises a dispute; the record stays, the dispute sits beside it
- RevokedCompany X revokes the agent key after a breach
One shared history no one can quietly rewrite
Claims are added to an append-only log. Each one gets a receipt proving it is there, and every new checkpoint proves it extends the last one without changing anything before it. Independent witnesses can compare checkpoints to catch an operator showing different histories to different people.
Checkpoints can also be sealed into Bitcoin, so one small commitment covers every record beneath it. See ours.
Each service decides, under its own rules
When an agent acts, the service on the receiving end gathers the related records and checks them against the keys it trusts and the policy it sets. OpenAIIS never decides for anyone. Given the same evidence and policy, every verifier reaches the same answer.
Every requirement in the service's policy is met by authenticated evidence.
A rule fails, a signature is wrong, or something has been revoked.
Evidence is missing, stale or contradictory, so a person should look.
Private by design
The registry holds fingerprints and signed statements, not your files. Private profiles protect content that would otherwise be easy to guess from its fingerprint.
Built on open standards
OpenAIIS draws on Certificate Transparency, SCITT, Sigstore, C2PA, W3C Verifiable Credentials and OpenTimestamps, and can carry their evidence.
Designed to be owned by no one
The target is a network of independently run nodes. It isn't live yet; the roadmap shows what comes first.
Want the exact rules?
The Protocol defines every format, signature and verification step for anyone building an implementation.