02 — Identity

Agent Passport

Cryptographic identity for autonomous AI agents. Issue, verify, revoke. The universal passport layer that makes accountable agent-to-agent commerce possible.

Identity, in three pages

Why · Spec · API

The problem

Autonomous AI without identity is anonymous.

An agent acting on your behalf signs a contract, moves money, queries a database. Who was it? Who issued it? Who's accountable when it goes wrong?

True AI identity comes from the model provider. AiEGIS is the governance layer on top of provider-attested identity — not the identity creator. We bind the provider attestation to the deployment, the operator, the jurisdiction, and the runtime policy.

The result: every action an agent takes is traceable to a real, accountable identity.

The passport

Issue. Verify. Revoke.

Issue. /api/agent/issue mints an Ed25519-signed passport binding agent → operator → jurisdiction → policy bundle.

Verify. Any party can verify the signature against the published key. Real-time decisions: sub-15ms on customer infrastructure.

Revoke. /registry/revoke propagates revocation through the SQLite revocation store. Stale passports fail verification immediately.

Issue

Ed25519 keypair, JWT-style claims, jurisdictional policy bundle attached.

Verify

Public-key lookup, signature check, revocation list, policy gate. Under 100ms.

Revoke

Operator-controlled. Propagates to all downstream verifiers in real time.

Standards alignment

Built on what's coming next.

AiEGIS Identity tracks emerging standards rather than inventing in isolation: NIST AI RMF agent identity guidance, OWASP Agentic Apps Top 10 (AAA-01 Identity), CSA Agent Top Threats, and the EU AI Act Articles 13 and 50 transparency obligations.

Co-author engagement on AIVSS Issue #32 (Multi-Agent Governance). MGAIF, GDPR, NIST RMF, EU AI Act, and POPIA rule packs ship with every deployment.