ART-23 · Branch A · Agentic Rail Chain · OpenChainGraph

Visa Trusted Agent Protocol Signature Inspector & Readiness

Visa's Trusted Agent Protocol lets an AI agent prove its identity and authorization to a merchant using HTTP Message Signatures (RFC 9421), aligned with Web Bot Auth. This node parses a TAP signature, surfaces the agent-recognition signature and its replay-protection parameters (timestamp, session id, key id, algorithm), and scores TAP readiness. Produces a §4 compliance_control OpenChainGraph artifact.

⚠ TAP introduced ~Oct 2025; evolving. RFC 9421 parsing is exact. TAP-specific labels (three-signature model, agent-recognition tag) are illustrative — verify against developer.visa.com. No signature is cryptographically verified here.

§4 OpenChainGraph · ART-23 Visa TAP · RFC 9421 · Web Bot Auth Zero PII Client-Side · No Network

▸ Inspect a TAP signature (RFC 9421)

Paste the Signature-Input and Signature headers from a TAP request. An example is pre-loaded.

Signature-Input Signature

▸ TAP readiness

Answer for your agent integration. TAP layers a scoped Visa tokenised credential over RFC 9421 agent recognition.

Ask your agent

Copy this paragraph into Claude, OpenClaw, or any MCP-aware agent to run this exact tool, with this sample, and verify the artifact.

Run the AINumbers MCP tool `inspect_visa_trusted_agent_protocol`. Task: Parse and scores Visa TAP Signature-Input / Signature header pairs (RFC 9421 HTTP Message Signatures).
Call it with arguments: {"policy_parameters":{"signature_input":"sig1=(\"@method\" \"@target-uri\");created=1750000000;expires=1750003600;nonce=abc123;keyid=agent-key-1;alg=ed25519;tag=trusted-agent","signature":"sig1=:abc123base64=:"}}
Verify before trusting: call `verify_execution_hash` on mcp.ainumbers.co (https://mcp.ainumbers.co/mcp) with the parameter `claimed_hash` set to the returned `execution_hash`, passing the full artifact the run returned (the object containing `policy_parameters` + `output_payload` + `execution_hash`; equivalently `policy_parameters` + `output_payload` with `claimed_hash`), not the bare hash string.
Return the ledger link https://ledger.ainumbers.co/ so a human can re-verify without contacting us.
PII rule: All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
Open the tool with the sample prefilled: https://ainumbers.co/chaingraph/art-23-visa-trusted-agent-protocol-inspector.html#p=v1.H4sIAAAAAAAA_wG-AEH_eyJzaWduYXR1cmVfaW5wdXQiOiJzaWcxPShcIkBtZXRob2RcIiBcIkB0YXJnZXQtdXJpXCIpO2NyZWF0ZWQ9MTc1MDAwMDAwMDtleHBpcmVzPTE3NTAwMDM2MDA7bm9uY2U9YWJjMTIzO2tleWlkPWFnZW50LWtleS0xO2FsZz1lZDI1NTE5O3RhZz10cnVzdGVkLWFnZW50Iiwic2lnbmF0dXJlIjoic2lnMT06YWJjMTIzYmFzZTY0PToifaq0WxW-AAAA