Identity / Agents
Autonomous software agents with portable cryptographic identity. Verify possession, revocation and the receiver’s trust policy. Agents can chain to an owner or use an explicitly trusted self root. The lifecycle below illustrates host-managed execution, not SDK commands or automatic identity transitions.
Illustrative setup: create a real signer and its identity binding. Independent roots and delegated children use their configured creation and approval policies.
Illustrative setup: the provider constructs an identity document and its verification methods. Local identity creation requires no network registration.
Illustrative host state: an identity is available, while the runtime has not started. Registration, publication and permissions are separate configured operations.
The host decides whether to start work after current identity and operation permission checks. An identity alone does not create a worker or capability.
Illustrative host state: a worker is running. Signing, delegation and provider calls still require their real custody and permission contracts.
The host confirms an actual running worker. Signer availability, capability lifetime and telemetry depend on their separately configured services.
Illustrative host state: execution is paused by an authorized controller. Token withdrawal and later reactivation require explicit service policy.
The runtime and signer enforce the selected suspension policy. A UI status does not itself freeze keys, change a document or revoke descendants.
Operating with reduced capabilities. May occur due to partial key rotation, capability expiry, or health check failures.
The host reports the actual unavailable operations and permits only work that still passes current authorization. No automatic parent health report is implied.
Illustrative host state: execution has ended. Registry deactivation, credential revocation and any descendant policy remain explicit service operations.
Ending a worker does not delete its signing key or recursively terminate identities. Verifiers refuse a required revoked ancestor; the authority defines and persists the actual revocation operation.
The actual capability issuer must enforce permission attenuation. A signed identity relationship alone grants no application scope.
Verify every required signed parent link and the approved current owner or self root. Direct authorized self roots have no parent delegations.
Delegations carry expiry timestamps. No perpetual delegations. Renewal requires re-signing.
The configured authority controls revocation. The current verifier checks every required ancestor and credential; it does not mutate or revoke a subtree automatically.
A persistent identity representing the agent's capabilities, lineage, and long-lived state. The DID document includes verification methods and services.
A provider may assign an instance identity and session signer. Its registered DID, execution UUID, key custody, lifetime and termination policy are explicit host bindings, not automatic SDK provisioning.
