DooDooLamb News
Show HN: Aroha – signed, shrinking permissions for AI agents, checked offline
Brief published October 28, 2026 · Original source published October 27, 2026
Original reporting by rajganesan-aroh at github.com.
Automated brief. Verify important details at the original source.
What happened
ArohaLabs released Aroha Protocol as an open-source SDK on GitHub. The project provides signed, attenuating permissions for AI agents that can be verified offline. The published code snippet shows an SDK split into at least two packages, @aroha-sdk/core and @aroha-sdk/credentials, exposing functions for generating key pairs and decentralized identifiers, issuing intent mandates, narrowing those mandates to specific actions such as payments, and verifying the resulting credential chain. The design appears aimed at constraining what actions an AI agent or orchestrator can take without requiring a live authorization server.
Why it matters
Offline-verifiable, shrinking permission chains address a real gap in agentic AI deployments, where agents often operate with broad or poorly audited access. If the mandate attenuation model holds up under scrutiny, builders could scope agent capabilities at issuance time rather than relying on runtime policy checks, reducing blast radius from compromised or misbehaving agents.
What to watch
Adoption depends on whether the credential and DID standards the SDK builds on are clearly documented, how the attenuation model handles complex multi-agent chains, and whether the project attracts external security review given its early community traction.