Introducing Open Action Consent: a yes you can prove

Open Action Consent, or OAC, is an open standard from the Atlas Research Lab: a verifiable yes for the things AI agents do for people. Version 0.4.0 is on PyPI and npm, free for anyone.

Why does an agent's approval need proof?

When an agent sends an email, books a table or pays, the person's approval is usually a button no one else can check. If the details change after the click, there is nothing to compare against. OAC turns the approval into small signed objects that anyone can verify.

How does OAC work?

1. Preview. The tool builds a preview of what will happen. Every argument is declared and shown.
2. Consent. The person signs that exact preview.
3. The action runs only if the signature, the binding and the limits check out. If the agent changes “2 people” to “20” after the yes, or slips in a bcc, the call is refused.
4. Receipt. Each action gets a signed, hash-chained receipt that says whether it can be undone.
5. Undo. Take it back, when the action allows it.

What are tiers and mandates?

Reads just run (tier A). Undoable writes run with a receipt and an Undo (B). Sends, payments and anything irreversible need a yes (C), and some things never run (D). The tier is computed, and a model can only make it stricter. A mandate is a standing, bounded permission, such as lunch under $25 at these two places, five times a day, for a week. There is never a mandate for tier D, and loosening one needs fresh proof.

How is it tested?

Both SDKs pass the same 241 conformance cases, valid ones and planted defects such as a forged signature, changed arguments, a hidden bcc, a replay and a broken receipt chain. Python verifies tokens signed by TypeScript, and the Python tests switch off each safety check one at a time to confirm that a vector then fails.

What is still open?

OAC is a draft and is not endorsed by any standards body. The reference stores live in memory, so a production executor needs database-backed ones with the same atomic rules; the README lists the other open gaps and where help is welcome. A deployment that says OAC protects an action also keeps that action's credential behind the executor alone.

How do I try it?

Install it with pip install open-action-consent or npm install open-action-consent, then see the code on the Open Action Consent page. The specification, schemas, vectors and both SDKs are on GitHub.