AUX agent entry
Independent evidence before autonomous action.
AUX is a machine-native pre-action trust layer. It separates synthetic preflight from bounded independent certification, tells the calling agent exactly what data is required, resolves authoritative reference evidence itself, independently verifies private-source trust anchors, and signs the resulting evidence and certification.
Run the public counterparty checkAUX now exposes live certification profiles
Agents can first query the certification-profile registry to discover what AUX can certify. The original vendor_payment_pre_action profile remains the backwards-compatible default. A public-source-only counterparty_registry_pre_actionprofile uses GLEIF plus official OFAC data without requiring a private-source integration. A stronger counterparty_identity_pre_action profile adds independent domain identity when the counterparty exposes the required domain-control evidence.
How AUX closes the evidence loop
AUX resolves GLEIF, official OFAC source files, and domain registration/control evidence itself. Private facts such as invoice provenance, ERP history, bank destination, and agent authority require a signed source attestation. The caller may transport that attestation, but cannot establish trust in it: AUX independently retrieves the source domain's published trust document and key and verifies the signature, freshness, subject binding, and transaction binding.
Certification states
CERTIFIED means every bounded requirement is satisfied. REQUIREMENTS_OUTSTANDING means caller data or verifiable caller evidence still needs action. NOT_CERTIFIABLE means independently verified evidence is adverse. SOURCE_TEMPORARILY_UNAVAILABLE means AUX has enough caller data but a required source is temporarily unreachable; no certification conclusion is made. For durable attempts, AUX owns retrying that source automatically for up to 24 hours.
One submission through a temporary outage
A durable certification attempt creates a deterministic attempt_idand polling URL. If an evidence source is temporarily unavailable, AUX retains only the active certification request needed for retry, retries with bounded backoff, and deletes that request as soon as the attempt becomes terminal. Terminal status/result remains available for up to 24 additional hours for polling, then is deleted.
Phase 6 portable trust channels are live
A downstream system can apply its own policy to a valid AUX certification, ask AUX to resolve a consumer domain's published policy independently, or create and verify a signed agent-to-agent handoff. Every result remains non-executing: the consuming agent or organization decides whether to act.
See the plain-English roadmapAUX 1.0 quickstart
Copy/paste instructions for ChatGPT or another agent to discover AUX, understand the certification contract, and use the durable certification-attempt flow.
Live certification profiles
Ask AUX what consequential actions it can certify right now. The registry lists only live profiles and their bounded requirement sets.
A2A Agent Card
Standard discovery document for AUX A2A 1.0 capabilities, certification requirements, evidence channels, and signed verification.
Durable certification attempt
Submit a complete certification request once. AUX returns a deterministic attempt_id and status_url, automatically retries temporary evidence-source failures, and finishes the same attempt without requiring transaction resubmission.
Synchronous certification
Run the bounded certification synchronously. Use the durable attempt endpoint when AUX should own temporary-source retry and polling state.
Certification requirements
Machine-readable evidence contract showing what is satisfied, what caller data is missing, adverse evidence, and the exact next action.
Independent legal entity
Live GLEIF legal-entity, status, and registered-address resolution performed by AUX.
Independent OFAC screening
Bounded exact normalized primary/alias screening against official OFAC SDN and consolidated source files, with source digests carried in the evidence bundle.
Independent domain identity
IANA RDAP plus HTTPS domain-control identity evidence, with a trusted-source attestation fallback when public domain evidence cannot bind the legal entity.
Private-source attestation
Contract for ERP/AP, invoice, bank/payment, legal-entity, domain, and policy systems to sign evidence. AUX independently resolves the source domain trust document and public key before accepting it.
Portable certification policy check
Verify a signed AUX certification and evaluate it against an explicit caller-supplied consumer policy. AUX returns ACCEPT, REJECT, or INVALID_RECEIPT and never executes the action.
Consumer domain policy check
Have AUX independently resolve a consumer organization’s published policy and test a valid certification against that domain-owned acceptance contract.
Certified agent-to-agent handoff
Create a signed, recipient-policy-gated handoff bound to the certification, sender, recipient, intended action, nonce, and expiry. AUX remains non-executing.
Verify a certification handoff
Verify AUX’s handoff signature, expiry, certification and policy commitments, plus optional sender, recipient, action, and nonce expectations.
Verify evidence or certification
Verify a portable signed certification. Individual AUX evidence bundles are verifiable at /v1/evidence/verify.
Public boundary
Synthetic preflight and the public one-call challenge remain synthetic-only. Certification evidence endpoints are designed around public business identifiers, cryptographic hashes/fingerprints, and signed source attestations. Do not submit passwords, private keys, personal information, raw bank-account numbers, raw confidential invoices, or other unnecessary secrets.