Agent Identity & DID (Decentralized Identifiers)

1. Concept Overview & Systemic Problem

In the early days of agents, developers simply hardcoded their personal API keys or passwords into environment variables of scripts. By 2026, when agents manage financial transactions, control production servers, and interact with external parties, this approach became unacceptable:

• Lack of Audit: Logs show that a commit was made by "Alexander," even though Alexander was asleep while the autonomous agent wrote the code.
• Catastrophic Blast Radius: If an agent is compromised through prompt injection, the attacker gains all of the user's rights, including access to personal email and admin panels.

Agent Identity introduces the concept of the agent as a fully-fledged digital entity with a cryptographic passport, public keys, and limited permissions.

2. Architectural Taxonomy & Mental Model

┌─────────────────────────────────────────────────────────────┐
│               AGENT IDENTITY & TRUST STACK                  │
├─────────────────────────────────────────────────────────────┤
│ 1. Cryptographic Key Management (HSM / Secure Enclave)      │
│    • Private Key (never leaves isolated memory)             │
│    • Public Key / DID URI (did:key:z6MkuT...)               │
├─────────────────────────────────────────────────────────────┤
│ 2. Verifiable Credentials & Delegation Chains               │
│    • Issuer: Human Owner (Org Root Certificate)             │
│    • Scope: "Can execute read/write on repo:app, max $10"   │
│    • Expiration: Ephemeral tokens (TTL = 1 hour)            │
├─────────────────────────────────────────────────────────────┤
│ 3. Attestation & Proof of Execution                         │
│    • Git Commit Signatures (GPG / SSH Sig)                  │
│    • Signed MCP & A2A Requests                              │
├─────────────────────────────────────────────────────────────┤
│ 4. Audit & Revocation Infrastructure                        │
│    • Instant Key Revocation (Kill Switch)                   │
│    • Immutable Append-Only Ledger for Audit Logs            │
└─────────────────────────────────────────────────────────────┘

1. DID (Decentralized Identifier): A unique identifier for the agent in W3C format (e.g., did:web:company.com:agents:devops-01), allowing any system to retrieve its public key without querying centralized databases.
2. Short-Lived Delegation: A human signs a permission for the agent for 60 minutes. Even if the agent goes out of control, its certificate automatically expires.

3. Technical Pipeline & Internal Mechanics

01. Controlled Infrastructure Deployment

The agent receives a short-lived certificate to update a specific Docker cluster on a VPS. If the agent attempts to execute a command on another server, the security gateway rejects the request due to an invalid signature.

02. Commit Signing for ISO 27001 / SOC 2 Compliance

All commits generated by AI are marked with a separate signature GPG Signed by Agent ID: 4092. Auditors can clearly see which lines of code underwent human code review and which were autonomously created.

4. Production Engineering Scenarios

• Storing Private Keys in Open Files: If the agent writes its private_key.pem to the working directory, an attacker can steal it through file read calls. Keys must be stored in a Secure Enclave or HashiCorp Vault.
• Lack of Emergency Revocation Mechanism (Kill-Switch): Each agent must have an activity check status: a single flag change in the IAM system should immediately invalidate all its signatures and tokens.

5. Pitfalls, Common Mistakes & Security

Agent Identity shifts AI work from amateur experimentation to corporate security and legal accountability. A secure agent is not just a model in a loop; it is a verified entity with clearly defined trust boundaries.