Agent Trust Protocol

The AIC is the foundational primitive. It is a JSON document conforming to a subset of W3C Verifiable Credentials, signed using Ed25519 (or ECDSA-P256 for hardware-backed keys). The issuer is any entity operating an ATP Authority — a service that validates agent binaries, system prompts, and model configurations before issuing certificates.

• agent_id — Globally unique, stable identifier. Format: agt_{hex32}
• name — Human-readable name of the agent, from its manifest.
• version — SemVer of the agent software. Included in signature.
• model — Full model identifier (provider:model:version) of the underlying LLM.
• public_key — Ed25519 public key in SubjectPublicKeyInfo format (base64url).
• issuer.did — DID of the ATP Authority that issued this certificate.
• issued_at / expires_at — Unix timestamps. Default validity: 365 days.
• signature — Detached JWS over canonical JSON-LD serialization of all above fields.

The SAT is issued per-session by the orchestrating system. It is structurally inspired by OAuth 2.0 access tokens but is self-contained and verifiable without a token endpoint. The SAT is presented by an agent when making API calls; receiving services validate the scope before executing.

• scope — Array of action:resource pairs (e.g., "read:logs", "exec:sandboxed").
• resources — Optional URI list restricting resource-level access within each scope item.
• constraints — Structured rate limits, output size caps, and forbidden operations.
• nonce — One-time use token to prevent replay attacks.
• bound_to — Must reference a valid AIC agent_id; prevents token theft across agents.

TEAL implements a hash-linked chain analogous to a Certificate Transparency log, but scoped to an individual agent session. Every action (tool call, API request, LLM inference, file write) generates a signed log entry. The chain is anchored to the AIC and SAT at session start.

• seq — Monotonically increasing sequence number within the session.
• timestamp — RFC 3339 timestamp with millisecond precision.
• action_type — Enum: tool_call, llm_inference, file_op, network_req, delegation.
• payload_hash — SHA-256 of the full action payload (inputs + outputs).
• prev_hash — Hash of the previous TEAL entry, creating the chain.
• agent_sig — Ed25519 signature over seq + timestamp + action_type + payload_hash + prev_hash.

When an agent with an active SAT spawns a sub-agent, it must produce a Delegation Receipt. The DR is signed by both the parent agent (proving it willingly delegated) and the ATP Authority (proving the delegation is within the parent's authorized scope). The child's effective scope is the intersection of the DR's delegated_scope and the child's own SAT.

• parent_agent_id — AIC agent_id of the delegating agent.
• child_agent_id — AIC agent_id of the receiving agent.
• delegated_scope — Strict subset of the parent's current SAT scope.
• chain_depth — Current delegation depth. Authorities may cap this (recommended: 3).
• parent_sig — Parent's Ed25519 signature over the DR.
• authority_countersig — ATP Authority countersignature validating the scope reduction.

The RAB solves a distinct problem: an agent may have a valid AIC but be running in a tampered environment (modified system prompt, unexpected tools, different model). The RAB is generated at session start and can be re-requested by verifiers at any point during the session. It ties the runtime state to the agent's declared identity.

• model_hash — SHA-256 of the full model identifier string (provider-consistent format).
• prompt_digest — SHA-256 of the system prompt, excluding dynamic injections.
• tool_manifest — Sorted list of tool names + version hashes the agent has access to.
• platform_id — Identifier of the execution platform (e.g., anthropic:claude-api:v1).
• platform_sig — Platform's signature over the RAB (where supported); else self-attested.
• attest_time — Unix timestamp of attestation generation.