Open technology for the spatial web.

OMA3 is a member-governed standards body building the interoperability layer for spatial computing, autonomous agents, and the open internet. Our specifications are open, our governance is neutral, and membership is open to anyone.

Explore the projects Join OMA3

Four specifications. One problem.

Independent systems increasingly have to interact without a central authority vouching for either side. A user crosses from one virtual world into another. An AI agent calls a service it has never used. A device meets a facility it does not belong to.

Each encounter raises the same four questions, and OMA3 has a specification for each: what context travels with you, whether the other side is legitimate, whether a consequential action is authorised, and how you move between worlds at all.

OMATrust

Verification protocol for the open internet

The open internet was never built to prove legitimacy. SSL proves domain ownership, not safety. Audits sit in PDFs no machine can check. Reputation is locked inside app stores and marketplaces. As AI agents begin transacting at machine speed, that gap becomes systemic risk — an agent cannot pause to read a forum thread. OMATrust makes trust machine-verifiable: cryptographic attestations anyone can publish on any internet service, and any human or agent can query in real time.

In production

omatrust.org →

MPAS

Banking-grade approvals for API calls and AI agents

Most consequential actions are authorised by a single credential. One token, one key, one session — and if it is compromised, that is enough to execute. MPAS requires consequential actions to collect independently verifiable approvals before they run. Agents keep their autonomy; the destructive operations, production deployments, and financial transactions an operator designates require signatures that can be checked and audited. The first execution profile targets MCP, so an agent's tool call can be governed without the agent ever holding the credentials.

Open source, working in production, iterating rapidly

View the repository →

Universal Manifest

The missing permission layer

The web has TCP/IP for packets, HTTPS for encrypted traffic, and DNS for names. It doesn't have a protocol for who you are and what you bring when two things meet. Universal Manifest is that layer: a compact, signed envelope of identity, credentials, permissions, and terms that travels with its subject and can be verified by whoever receives it. Heavy files stay at the source. Sealed data stays sealed. Every exchange leaves both sides a structured receipt of what was verified, accepted, or refused.

Approved standards track, initial implementations available

universalmanifest.net →

IWPS

Teleportation between virtual worlds

Virtual worlds are silos. A user cannot cross from one into another carrying their identity, assets, or context. There is no hyperlink for 3D space. IWPS is an API specification for that crossing. Two calls — a query that negotiates what is permitted, then the teleport itself — work across cloud, blockchain, and hybrid architectures. It covers what happens to your avatar and items on arrival, how identity is verified, and how a user can route the whole exchange through a trusted intermediary so neither world can track them.

Draft specification, one implementation to date

Read the specification →

Credibly neutral by design.

OMA3 is a Swiss association, established in Zug. That structure is the point, not a detail: it gives the standards a legally neutral home that no single company owns, funds, or can quietly redirect.

Decisions are made by members through an open consortium model, following a standards process used by the most established consortiums in the industry. The specifications are open. Membership is open to anyone willing to participate — not by invitation, and fair governance is available to all.

How membership works →