UMA for Agents — User-Managed Access for AI agents, and decentralized agent authorization the resource owner controls

How UMA for Agents worksAlice sets her access terms and goes offline. Bob's AI agent is refused by her vault and given a ticket, takes the ticket to Alice's authorization server, is handed her terms, signs them, and is granted scoped access. For a trade, her phone buzzes and she approves one single-use key.ALICEan owner, not an operatorHER AUTHORIZATION SERVERher policy, her sideALICE'S HOLDINGSMERIDIAN WEALTH · RESOURCE SERVERmany owners, one server?THE LEDGERpromisedterms, signedtouchedwhat it readapprovedthe one tradeSTERLING & VANCEthe requesting partyEDGEMERIDIAN WEALTHthe resource serverALICEthe resource ownerhis agentsigns every requestagent-operatorwho runs it · its keyskgatewayTLS *.uma.labagentgatewayhosts the PEPMCP · A2Auma-pep ×2alice-vaultan MCPServer · no auth code in ituma-as ×3her policy · her termstickets · grants · ledgerPostgres ×3keycloakis this Alice?her portalwhere she tapsevery line is mTLS · every box has a cryptographic name1 · challenged2 · her terms4 · grantedno direct path — the mesh refuses itone grant, spent once — across all threeUUMA for AgentsShe isn’t online. Her policy is.

Alice’s money sits at her brokerage — in a system that holds a thousand other clients’ holdings too.

  1. Alice’s money sits at her brokerage — in a system that holds a thousand other clients’ holdings too.
  2. Her new advisor’s agent is going to come asking for it. The brokerage cannot answer for her — and she will not always be awake.
  3. So she writes her terms once — what an agent may see, for what purpose, for how long.
  4. Then she closes the laptop. Nothing that follows waits for her to open it again.
  5. Bob is that advisor. His firm works through an agent, and it needs her portfolio.
  6. Beat 1 · challenge. The server refuses it — and hands it a ticket, with the address of Alice’s authorization server.
  7. Beat 2 · the terms. The agent takes the ticket to her server. She isn’t there. Her terms are.
  8. Beat 3 · commit. The agent signs them, or it walks away. There is no third option and no haggling.
  9. Beat 4 · grant. Signed, it is let in — for that purpose, for that long, and no further. Alice is still asleep.
  10. Then it asks to sell something. Her policy says: not this one. Ask me.
  11. Her phone buzzes. She approves that one order, from the couch.
  12. The key she grants opens the door once, for that trade, and then it is spent.
  13. And all of it is written down on her side: what was promised, what was touched, what she personally approved.
  14. That is the whole protocol. Four beats, one owner, one agent that is not hers.
  15. But what if Alice has one too?. Nothing in those four beats required Alice to be a person at a laptop. The side that decides needs an authority and a way to reach her — and both can sit on something she owns.
  16. Hers, not an agent. Her personal AI is not another agent asking for things. It holds her key and it knows her terms — it is the side that answers, moved onto a machine of hers.
  17. So she is not woken. For the tiers she has already stood behind, her AI answers and the door opens. She is not at her desk, and she does not need to be — the decision was hers, made earlier.
  18. And it still wakes her. For a trade she has not stood behind, it refuses and asks her. An agent that cannot reach its person must not answer for it — that is the hard part.
  19. The architecture. That is the protocol. This is the machine it runs on — and the four beats are the same four beats.
  20. The parties. Each party is its own boundary. Bob’s firm, the brokerage that holds the assets, and Alice — who owns them and is not either of the others.
  21. The mesh. Every connection between them is mutually authenticated, and every box has a cryptographic name rather than an address.
  22. Beat 1 · challenge. The agent arrives at the front door like anyone else, and the enforcement point in front of the vault refuses it — with a ticket.
  23. Beats 2 and 3. The ticket takes it past the resource server entirely, to Alice’s own authorization server — three of them, agreeing through one database.
  24. Beat 4 · grant. What comes back is scoped to what was agreed, and the enforcement point spends it once. A second attempt with the same grant is refused.
  25. The boundary. And there is no shortcut. Bob’s side cannot reach Alice’s at all — not because nobody wrote the address down, but because the mesh refuses it.