OpenAVT

Closing the Voice-to-Business trust gap. TLS over voice, built for agents.

A personal AI agent calls a bank, utility or store on your behalf. The business needs to verify the agent, the customer it represents and the actions that customer authorized. Conversation alone cannot establish those permissions.

OpenAVT (Open Agent Voice TLS) carries cryptographic identity, encrypted requests and signed customer permissions through the call's actual audio. Participating businesses check identity and permission before acting.

For business teams: the problem, value and adoption path. For developers: run the demo or explore the architecture.

The trust gap

TLS does not make an LLM immune to prompt injection. These checks constrain requests at the participating backend; preventing leaks through speech or other tools still requires controls in the calling agent.

How it works

1. Enroll: the Agent Voice Authority (AVA) issues an agent certificate after key proof.
2. Delegate: a separate business signer issues a scoped customer grant.
3. Call: mutual TLS 1.3 authenticates the peers through audio and protects requests and responses.
4. Enforce: the business checks the grant against the authenticated peer before executing the permitted action.

The current demo allows reading Alice's order, then denies an address change under the same read-only scope. Keys and grant credentials stay out of model inputs. Identity and permission details →

Try the demo

Requires Python 3.11+. No OpenAI key needed.

python -m pip install 'openavt[webrtc,authority]'
openavt sdk-demo

The demo enrolls an agent, issues customer consent, and establishes a live local audio call. It accepts one authorized request and rejects seven misuse cases, including scope escalation, replay and revocation. The peers run in separate Python processes and save a report under output/.

For two real OpenAI voice agents, configure OPENAI_API_KEY locally, then run:

python -m pip install 'openavt[agents,authority]'
openavt sdk-demo --agents

Integrate a voice agent or configure Twilio → · More demos →

PAP sessions and fraud monitoring

OpenAVT works alongside Personal Agent Protocol (PAP/Poppy): PAP supplies HTTPS discovery, sign-in and account permissions; OpenAVT binds those permissions to an authenticated audio call and exact requests. The optional adapter targets PAP draft 0.1 with a negotiated custom voice extension.

python -m pip install 'openavt[pap,webrtc]'
openavt pap-demo

This local demo reads an order over audio, proposes an exchange, and confirms it through PAP's HTTPS operations endpoint exactly once. It also verifies fraud blocking and sign-out before execution. Integration and supported profile →

A vendor-neutral fraud adapter supports unsupported callers and suspicious authenticated requests. It can restrict execution without expanding permissions. Provider-specific integrations and external PAP interoperability still require validation with those providers.

Sub-second handshakes

Measured on an established local 64 kbps G.711 PCMU audio call:

The timer includes both authenticated endpoints and the final audio ACK. It excludes certificate creation, call setup and LLM/speech time. These local results are not a carrier or Internet latency guarantee. The fast PCM profile requires an unchanged digital PCMU path; transcoding or audio processing can break it. Measurements and reproduction →

Scope

This is an experimental local prototype. Both peers run on one machine; public Internet, carrier/PSTN and microphone paths have not been verified. Ordinary speech is outside the inner TLS session. There is no WebRTC data channel carrying the protected requests.

Certificates prove registered account/key control. Customer authentication uses demo credentials; verified provider identities, real customer login and production CA operations remain future work. Banking, payments and utility integrations are target use cases; the standalone demo returns a fixed order result, and the PAP demo adds a simulated exchange with explicit HTTPS confirmation. Trust boundaries →

Documentation