Affinidi and AgentValet use almost the same words: every agent a verifiable identity, policy at the moment of action, per-agent attribution, audit by design. They come from opposite directions. Affinidi's Agent Gateway sits in front of an agent and answers "who is calling, and may they?" across organisations. AgentValet sits between the agent and the systems it acts on and answers "what may this agent do to our Slack, Stripe or GitHub, and does a human need to say yes first?" This page is plain about where each one wins, and about the standards both now speak.
Affinidi Agent Gateway is a Rust network proxy you put in front of an agent or an MCP server. It mints a DID for the agent, evaluates an OPA Rego policy on every request (per tool, for MCP), can hold an OAuth token per caller and inject it downstream, and signs a Verifiable Presentation so a partner organisation's gateway can check who called. Behind it sits Radix, a trust registry that answers Trust Registry Query Protocol questions, and an eight-language SDK stack. It is built for the inbound problem: a stranger's agent arrives at your door, and you need to know whether to open it.
AgentValet is built for the outbound problem: your own agent wants to post to Slack, refund in Stripe, or open a pull request, and you need to know it can only do the things you granted, that a person can be asked first, and that the key never lives where the agent could leak it. The broker holds the credential, evaluates grant, policy and guardrails on the real call, pauses for approval when the rule says so, and writes the audit row for what was executed. It does not know how to admit a stranger's agent, and Affinidi's gateway does not know what Slack is.
Strong on who may call. The gateway can also inject a per-caller OAuth token on the way out, but you hand-configure every provider, and there is no owner inbox where a human approves the individual action.
The credential lives only in the vault and the owner is in the loop. Remove AgentValet and the agent has nothing to call with. Inbound admission of other people's agents is not something it does.
| AgentValet | Affinidi Agent Gateway | |
|---|---|---|
| Chokepoint | Between your agent and the SaaS or MCP server it acts on. Outbound. | In front of your agent or MCP server, deciding who may call it. Inbound, with optional outbound token injection. |
| Holds platform credentials | ✓ Yes. Envelope-encrypted, one key per credential, hardware-backed tenant keys on paid plans, decrypted in memory per call. A catalogue of ready-made connectors plus any MCP server as a platform. | ✓ Per-caller OAuth vault and a secrets store. Authorization Code flow only; every provider's endpoints, client id and scopes are configured by hand. |
| Human approval on a specific action | ✓ Built in. The call pauses at the broker; the owner approves from the dashboard, a push notification, Slack or a passkey, and the call replays. Denials are logged with the rule that caused them. | Approval is expressed as a Rego condition ("a second factor granted in the last ten minutes"). We could not find an approver inbox or a hold-and-replay loop in the public documentation. |
| Policy language | Grants per agent, platform and scope, org guardrails, and a policy kernel with deny over require-approval over allow. Recipient allow-lists and an external-sends control on grants. No policy language to learn; a predicate escape hatch is on the roadmap. | ✓ OPA Rego, policy-as-code, per tool for MCP. Far more expressive, and you write and test Rego. |
| Agent identity | An RS256 keypair per agent, bound to a human owner, revocable by that owner. Published as a did:web document per agent when the organisation opts in. Child agents get their own short-lived identities with scopes cut down to a subset of the parent's, enforced on every call. | A deterministic did:webvh per agent configuration, no registration or key management, verifiable across organisations, multi-hop caller context in signed presentations. |
| Trust registry (TRQP) | Answers ToIP TRQP v2.0 /authorization and /recognition queries live, from the same grant, policy, expiry, breaker and liveness check that gates every governed call. A revoked agent answers "no" on the next query, with no cache. Self-assessed against the v2.0 HTTPS binding; ToIP publishes no conformance suite for anyone to pass. | ✓ Radix, a governance-framework registry with an open-source Rust implementation, and the gateway consults it as a trust check. Affinidi co-authors the protocol. |
| Cross-organisation federation | ✕ Not today. Identities are verifiable by any DID resolver, and a partner can query the registry endpoint, but there is no signed presentation handed between gateways yet. | ✓ The core idea. Workload binding: gateway to gateway, verifiable presentations, unbounded depth. |
| Deny by default | Structural. No grant means no credential, so an ungoverned call has nothing to authenticate with. | Rego default-deny if you write it that way. |
| Circuit breaker | ✓ Three auth failures or five API errors suspend the agent automatically. Revoking a parent contains its children on their next call. | Not seen in the public documentation. |
| Audit | Append-only at the database level: the app can add rows, never edit or delete. Records the execution, the policy version, the request id, and on Enterprise the forensic fields. | Correlation id per request, OpenTelemetry, a tamper-evident event stream, and signed presentations of the decisions taken. The "proof of control" framing is strong for auditors. |
| Deployment | Managed service in Australia. The parts that touch your machines (MCP server, CLI, broker library, SDKs) are MIT open source. | Managed appliance or your own infrastructure. SDKs and the registry are Apache-2.0; the gateway binary is closed and access is whitelisted. |
| Compliance | Aligned to ISO 42001, OWASP NHI and LLM Top 10, NIST AI RMF. No third-party certification yet; see the trust page for exactly what is and is not true. | ✓ ISO 27001:2022 certified. Regulated-industry positioning for Singapore and healthcare buyers. |
| Time to first governed call | One command, three environment variables, under five minutes, self-serve. | Portal sign-up, create a surface, configure each provider, point the client at the access point. |
| Pricing | Priced on calls, not seats. Free tier, paid plans from $38/mo, self-serve. | Free community plan (five projects). Everything else is a conversation with sales. |
If your problem is agents from other organisations arriving at yours, Affinidi is built for that and AgentValet is not. Verifiable presentations passed gateway to gateway, a deterministic DID for every agent with no key management, a governance-framework registry they help standardise, and Rego when you want the full power of policy-as-code. They can run on your own infrastructure, which matters to regulated buyers, and they hold an ISO 27001 certificate today. Their consent modes for MCP, in particular the inline elicitation flow, are a nicer user experience than ours and we are borrowing the idea.
If your problem is your own agents acting on your own systems, the enforcement has to live where the action happens, and a human has to be reachable at that moment. AgentValet holds the credential, so the grant check, the approval and the audit row happen on the real call to Slack or Stripe, not on a description of it. The owner approves from a phone, a passkey or a notification, and the call replays. There is a connector catalogue, so nobody configures OAuth endpoints by hand. A misbehaving agent trips a breaker and a revoked parent contains its children. And the first governed call is minutes away, without a sales call.
On identity standards the gap has closed. Every AgentValet agent can publish a did:web document over the same key that signs its calls, and the same grant-and-policy check that gates every call now answers TRQP authorization and recognition queries for anyone, including an Affinidi gateway, without an AgentValet SDK. The answer is computed at query time from live state, which is a stronger freshness guarantee than a stored tuple can make.
And the two compose. Put Affinidi at the door if other organisations' agents call yours; put your keys behind a broker either way. They never touch the same seam.
The free tier takes one command: npx @agentvalet/register. Run one real agent through it, revoke it, and query the registry endpoint to watch the answer change. Affinidi details on this page were checked against affinidi.com, docs.affinidi.com and the public Affinidi GitHub repositories on 13 September 2026; if something has changed, email us and we will correct it.