Multi-Party Action Security

MPAS - A new primitive for software approvals

Don't let a single actor, agent or human, unilaterally:

Delete a production database.
Violate compliance with a social post.
Exfiltrate data.
Push to production.
Take a large trading position.

MPAS puts independent, verifiable approval between an intention and its consequences, and keeps the credentials out of reach of the actor.

See how it works Get involved

The world needs an approvals standard

The most consequential actions should not be unilateral decisions.

MPAS is for multi-party approvals what OAuth is for delegated authorization. Today, one credential is often enough to act alone. Systems that do ask for approval invent their own way.

Today

Actor (agent or human)

Holds the credential

Application

One credential is enough to act alone.

With MPAS

Proposer

Approvers sign

Verifier holds the credential

Application

Nothing runs until independent approvals are verified. Credentials are kept out of reach of the actor.

Use cases

Give AI agents autonomy, not unilateral authority.

Agents handle routine work. Consequential steps wait for independent approval.

One phished account shouldn't be enough to compromise your organization.

Critical actions can require multiple approvals, so one compromised account is not enough to act.

How it works

Propose. Approve. Verify. Execute.

.mpas-flow-interactive{display:none}

Proposer

Approvers

Verifier credential

Application

Signed receipt

Routine actions go straight through.

01Propose
An agent or person proposes the exact operation, target, and parameters. They never receive the credential needed to run it.
02Approve
Your policy decides whose approval counts and how many are needed: people, independent agents, automated checks, or a mix. Each approver signs that exact request, and a proposer can't approve its own action.
03Verify
The verifier checks every signature against policy. Change a parameter and the approvals no longer apply. AI never has the final word; the verifier's deterministic policy code does.
04Execute
Only then does that exact request run, through the application or a credential adapter in front of it. A signed receipt records who proposed, who approved, and what happened.

Proposer

Approvers

Verifier credential

Application

Signed receipt

Routine actions go straight through.

01. Propose

An agent or person proposes the exact operation, target, and parameters. They never receive the credential needed to run it.

Where MPAS fits

Keep the stack you have. Just add approvals.

Identity, policy engines, and agent runtimes coordinate your actions. MPAS decides which ones can run.

Identity and access

OAuth, OpenID Connect, enterprise IAM, DIDs, OMATrust

Policy engines

OPA, Cedar, custom rules

Agent runtimes

MCP, agent control hooks

MPASIs this exact action approved?

Signing

Keys, passkeys, HSMs, MPC, smart-contract wallets

Applications

APIs, cloud infrastructure, local apps, blockchains

MPASIs this exact action approved?

Identity and access

OAuth, OpenID Connect, enterprise IAM, DIDs, OMATrust

Policy engines

OPA, Cedar, custom rules

Agent runtimes

MCP, agent control hooks

Signing

Keys, passkeys, HSMs, MPC, smart-contract wallets

Applications

APIs, cloud infrastructure, local apps, blockchains

Get involved

Help make multi-party approvals a common building block for software.

For organizations

Join OMA3

Shape MPAS and the open standards around it as an OMA3 member.

Become a member

For standards bodies

Establish a liaison

Align MPAS with your work through a formal liaison agreement.

Discuss a liaison

For developers

Contribute

Review the specification, surface issues, and contribute code.

Contribute on GitHub Read the specification

An approved OMA3 open-source project
Code under Apache 2.0
Specifications under the OMA3 IPR Policy
Draft specification