Practical overview
When it fits
Use AIM when an agent service needs a separate identity and capability checks for actions, with organization-level enforcement and an audit record of outcomes.
Who it is for
- Teams building AI-agent services that need distinct identities for non-human agents.
- Developers who want capability checks around protected function calls.
- Administrators who need to verify agents, set enforcement modes and review action outcomes.
Documented uses
- Register an agent and assign the capabilities it holds.
- Require a specified capability before an agent can invoke a protected function.
- Record authorized and denied action outcomes in an audit log.
- Choose how the organization handles unverified agents through monitoring or strict enforcement.
Requirements & limits
The project is open source under Apache-2.0. The README documents login to AIM Cloud using an OAuth 2.0 device flow and login to a self-hosted server; it does not establish pricing.
- The documented quick start uses a Python SDK, while the repository identifies Go as its primary language.
- Agents begin in a pending state and require administrator verification; strict mode denies their calls until verified.
- A new organization starts in monitoring mode, where an unverified agent’s call may run and generate an alert.
- The documented local development stack uses Docker Compose with PostgreSQL, Redis, backend and frontend services.
- Refresh-token revocation depends on Redis being configured and available.
Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.
Register an agent and authorize a protected function
Use the Python SDK to register an agent with a capability and protect a function call with that capability.
Before you start
- Python and the aim-sdk package; the README shows installing aim-sdk[rich].
- Access to AIM Cloud or a self-hosted AIM server.
- An administrator who can verify the pending agent in the dashboard.
Steps
Install the SDK with pip install "aim-sdk[rich]".
Run aim-sdk login for AIM Cloud, or aim-sdk login --url http://localhost:8080 for a self-hosted server.
In Python, create an agent with from aim_sdk import secure and agent = secure("my-first-agent", capabilities=["db:read"]).
Have an administrator verify the pending agent in the dashboard, then decorate a function with @agent.perform_action(capability="db:read") and call it.
Expected outcome
The agent is registered with the db:read capability, and calls to the decorated function are checked against the agent’s granted capabilities and organization policies, with outcomes recorded in the audit log.
Guide limitations
- The agent begins pending; strict-mode organizations deny its calls until an administrator verifies it.
- A capability not granted to the agent is denied before the protected function runs.
- A new organization starts in monitoring mode, where an unverified agent’s call may run and raise an alert.
Start the documented minimal local development stack
Generate local development secrets, start the minimal Docker Compose services, and check the backend health endpoint.
Before you start
- A local checkout of the repository.
- Docker Compose.
Steps
Run ./scripts/gen-dev-secrets.sh > .env for one-time secret generation.
Run docker compose up -d postgres redis backend frontend.
Run curl -fsS localhost:8080/health.
Expected outcome
The documented PostgreSQL, Redis, backend and frontend services are started, and the health endpoint is queried.
Guide limitations
- The documented command starts the minimal development stack, not the additional services in the full Docker Compose configuration.
- The README does not specify deployment guidance for production.
Sources & review
Source record details
- Source availability
- Active
- Sources checked
- 13 October 2026
- Original website title
- opena2a-org/agent-identity-management · Official homepage title · retained in its source language