OpenAVT

Closing the Voice-to-Business trust gap. TLS over voice, built for agents.

A personal AI agent calls a bank, utility or store on your behalf. The business needs to verify the agent, the customer it represents and the actions that customer authorized. Conversation alone cannot establish those permissions.

OpenAVT (Open Agent Voice TLS) carries cryptographic identity, encrypted requests and signed customer permissions through the call's actual audio. Participating businesses check identity and permission before acting.

For business teams: the problem, value and adoption path. For developers: run the demo or explore the architecture.

The trust gap

TLS does not make an LLM immune to prompt injection. These checks constrain requests at the participating backend; preventing leaks through speech or other tools still requires controls in the calling agent.

How it works

1. Enroll: the Agent Voice Authority (AVA) issues an agent certificate after key proof.
2. Delegate: a separate business signer issues a scoped customer grant.
3. Call: mutual TLS 1.3 authenticates the peers through audio and protects requests and responses.
4. Enforce: the business checks the grant against the authenticated peer before executing the permitted action.

The current demo allows reading Alice's order, then denies an address change under the same read-only scope. Keys and grant credentials stay out of model inputs. Identity and permission details →

Try the demo

Requires Python 3.11+ and the openssl executable. No OpenAI key needed.

python -m pip install 'openavt[webrtc,authority]'
openavt delegation-demo

The demo enrolls an agent, issues customer consent, and establishes a live local audio call. It accepts one authorized request and rejects seven misuse cases, including scope escalation, replay and revocation. It saves a report and audio under output/.

For two real OpenAI voice agents, configure OPENAI_API_KEY locally, then run:

python -m pip install 'openavt[agents,authority]'
openavt delegation-demo --agents

More demos and installation options →

Sub-second handshakes

Measured on an established local 64 kbps G.711 PCMU audio call:

The timer includes both authenticated endpoints and the final audio ACK. It excludes certificate creation, call setup and LLM/speech time. These local results are not a carrier or Internet latency guarantee. The fast PCM profile requires an unchanged digital PCMU path; transcoding or audio processing can break it. Measurements and reproduction →

Scope

This is an experimental local prototype. Both peers run on one machine; public Internet, carrier/PSTN and microphone paths have not been verified. Ordinary speech is outside the inner TLS session. There is no WebRTC data channel carrying the protected requests.

Certificates prove registered account/key control. Customer authentication uses demo credentials; provider verification, real customer login and production CA operations remain future work. Banking, payments and utility integrations are target use cases; the implemented demo returns a fixed read-only order result. Trust boundaries →

Documentation