UMA for Agents — User-Managed Access for AI agents, and decentralized agent authorization the resource owner controls

How UMA for Agents worksAlice sets her access terms and goes offline. Bob's AI agent is refused by her vault and given a ticket, takes the ticket to Alice's authorization server, is handed her terms, signs them, and is granted scoped access. For a trade, her phone buzzes and she approves one single-use key.ALICEan owner, not an operatorHER AUTHORIZATION SERVERher policy, her sideALICE'S HOLDINGSMERIDIAN WEALTH · RESOURCE SERVERmany owners, one server?THE LEDGERpromisedterms, signedtouchedwhat it readapprovedthe one tradeALICEhosted for herCAROLon her own boxDEVa phone in a drawerPRIYAhosted for herSAMon her own boxJUNhosted for hima bare keyan issued tokenan operator that vouchesa bare keyHUMAN OVER THE LOOPher terms answer; she is asked at first contactHUMAN IN THE LOOPevery request waits for a personAUTHORITY DOWNone authority downthe other five never noticedONE AUTHORITY, OWNED BY THE OPERATORALICEher terms, in the operator’s tableCAROLher terms, in the operator’s tableDEVher terms, in the operator’s tablePRIYAher terms, in the operator’s tableSAMher terms, in the operator’s tableJUNher terms, in the operator’s tableONE OUTAGE · EVERYBODY’SSTERLING & VANCEthe requesting partyEDGEMERIDIAN WEALTHthe resource serverALICEthe resource ownerhis agentsigns every requestagent-operatorwho runs it · its keyskgatewayTLS *.uma.labagentgatewayhosts the PEPMCP · A2Auma-pep ×2alice-vaultan MCPServer · no auth code in ituma-as ×3her policy · her termstickets · grants · ledgerPostgres ×3keycloakis this Alice?her portalwhere she tapsevery line is mTLS · every box has a cryptographic name1 · challenged2 · her terms4 · grantedno direct path — the mesh refuses itone grant, spent once — across all threeUMA for AgentsShe isn’t online. Her policy is.

Alice’s money sits at her brokerage — in a system that holds a thousand other clients’ holdings too.

  1. Alice’s money sits at her brokerage — in a system that holds a thousand other clients’ holdings too.
  2. Her new advisor’s agent is going to come asking for it. The brokerage cannot answer for her — and she will not always be awake.
  3. So she writes her terms once — what an agent may see, for what purpose, for how long.
  4. Then she closes the laptop. Nothing that follows waits for her to open it again.
  5. Bob is that advisor. His firm works through an agent, and it needs her portfolio.
  6. Beat 1 · challenge. The server refuses it — and hands it a ticket, with the address of Alice’s authorization server.
  7. Beat 2 · the terms. The agent takes the ticket to her server. She isn’t there. Her terms are.
  8. Beat 3 · commit. The agent signs them, or it walks away. There is no third option and no haggling.
  9. Beat 4 · grant. Signed, it is let in — for that purpose, for that long, and no further. Alice is still asleep.
  10. Then it asks to sell something. Her policy says: not this one. Ask me.
  11. Her phone buzzes. She approves that one order, from the couch.
  12. The key she grants opens the door once, for that trade, and then it is spent.
  13. And all of it is written down on her side: what was promised, what was touched, what she personally approved.
  14. That is the whole protocol. Four beats, one owner, one agent that is not hers.
  15. But what if Alice has one too?. Nothing in those four beats required Alice to be a person at a laptop. The side that decides needs an authority and a way to reach her — and both can sit on something she owns.
  16. Hers, not an agent. Her personal AI is not another agent asking for things. It holds her key and it knows her terms — it is the side that answers, moved onto a machine of hers.
  17. So she is not woken. For the tiers she has already stood behind, her AI answers and the door opens. She is not at her desk, and she does not need to be — the decision was hers, made earlier.
  18. And it still wakes her. For a trade she has not stood behind, it refuses and asks her. An agent that cannot reach its person must not answer for it — that is the hard part.
  19. Now do it a million times. That is one owner. The server holding her money holds a thousand others — so pull back, and ask what the same four beats look like when every row has someone behind it.
  20. Carol brings her own. Carol banks here too. She points the server at an authorization server of her own, and it has never heard of her before — no secret was exchanged, because nobody was there to exchange one.
  21. Her terms, not the firm’s. Agents come asking for Carol’s row, and they are refused and sent to her server — which answers with her terms. The firm never wrote them and cannot read them.
  22. None of them arrive alike. One holds a bare key. One carries a token from an issuer. One names an operator that publishes its keys. Her authority checks what each can actually show — and none of it buys access, only less friction.
  23. Every one of them is Alice. And there is no special one. Each owner has an authority, a personal AI that holds her key, and terms of her own — the same cell, repeated. Adding the next is copying it.
  24. Hers runs where she keeps it. Alice’s authority is hosted for her. Carol’s is a box on her own shelf. Nothing on the wire can tell the difference — which is the whole point: where it runs is hers to choose, not the firm’s to grant.
  25. Over the loop, not in it. Now count the interruptions. Standing terms answer nearly everything, so almost nobody is woken. Put a person in the loop instead and every one of these becomes a tap somebody owes — which is the thing that does not scale.
  26. The architecture. That is the protocol. This is the machine it runs on — and the four beats are the same four beats.
  27. The parties. Each party is its own boundary. Bob’s firm, the brokerage that holds the assets, and Alice — who owns them and is not either of the others.
  28. The mesh. Every connection between them is mutually authenticated, and every box has a cryptographic name rather than an address.
  29. Beat 1 · challenge. The agent arrives at the front door like anyone else, and the enforcement point in front of the vault refuses it — with a ticket.
  30. Beats 2 and 3. The ticket takes it past the resource server entirely, to Alice’s own authorization server — three of them, agreeing through one database.
  31. Beat 4 · grant. What comes back is scoped to what was agreed, and the enforcement point spends it once. A second attempt with the same grant is refused.
  32. The boundary. And there is no shortcut. Bob’s side cannot reach Alice’s at all — not because nobody wrote the address down, but because the mesh refuses it.
  33. The shape we had. Put that world into the arrangement we already had, and the authority is one service the operator runs. Every owner is a row inside it. Whose policy it is becomes a column in somebody else’s table.
  34. Where it breaks. Then it is the operator who can read every owner’s terms, the operator an agent must be enrolled with, and the operator who has to be awake. One outage, one policy change, one breach — and it is everybody’s.
  35. The shape that holds. Centre the owner instead and none of that is shared. Her terms, her authority, her record — one each, and the firm keeps only what it always had: the assets, and an enforcement point that can read none of it.
  36. And when one stops. Not failover — there is nothing shared to fail over from. One owner’s authority goes down, and hers is the only row that stops. Nobody else is having an incident, because nobody else was depending on it.