Identity / Agents

Agent Identity

Autonomous software agents with portable cryptographic identity. Privileged authority resolves through Sigil-finalized lineage edges.

did:oas:namespace:agent:z6Mk...
scroll horizontally through the lifecycle
01
Initializing
...

Key derivation in progress. Parent signs the lineage proof. HKDF-SHA256 derives the child key from the parent's key material.

The agent's DID document is being constructed. Verification method and authentication relationships are assembled. The agent does not yet exist on the network.

Parent signs lineage proof
Ready
Parent signs lineage proof
02
Ready
>>>

Agent identity is established but not yet active. DID document is published. Capabilities are loaded but not exercised.

The agent can receive capability delegations. Its lineage proof is verifiable. It awaits activation from its parent or an authorized controller.

Activation command received
Active
Activation command received
03
Active
|||

Agent is fully operational. Can sign documents, delegate to children, use capabilities, and participate in protocols.

This is the primary operating state. The agent's key is hot and available for signing. All delegated capabilities are live. Telemetry is streaming.

Suspend or degrade command
Suspended
Suspend or degrade command
04
Suspended
---

Temporarily deactivated by parent or governance. Existing tokens revoked. Can be reactivated without re-genesis.

The agent's signing capability is frozen. Child delegations are paused. The DID document remains published but marked as suspended. No new signatures are possible.

Reactivation or termination
Degraded
Reactivation or termination
05
Degraded
!!!

Operating with reduced capabilities. May occur due to partial key rotation, capability expiry, or health check failures.

Some capabilities are unavailable. The agent continues to function with whatever capabilities remain valid. A health report is generated for the parent.

Recovery or termination
Terminated
Recovery or termination
06
Terminated
xxx

Permanent deactivation. All child identities recursively revoked. The identity is cryptographically dead and cannot be reactivated.

Revocation cascades through the entire descendant tree. Every child agent, tool, and service derived from this agent is also terminated. The DID document is tombstoned.

Key Derivation Chain
HMR Root Key
Ed25519 seed entropy
HKDF-SHA256
Agent Key
Derived from parent + context
HKDF-SHA256
Child Agent Key
Depth 2 derivation
Delegation Rules
v

No Amplification

A child agent cannot have more permissions than its parent. Delegation can only narrow, never widen.

^

Lineage Bound

Every delegation references the lineage proof chain. Verify any delegation by walking up to the HMR root.

~

Time Bounded

Delegations carry expiry timestamps. No perpetual delegations. Renewal requires re-signing.

x

Revocable

Any ancestor in the lineage chain can revoke a descendant. Revocation cascades to all children.

Agent vs Agent Instance
agent

A persistent identity representing the agent's capabilities, lineage, and long-lived state. The DID document includes verification methods and services.

agent:instance

An ephemeral running instance of an agent. Has its own derived key for session signing. Instances are short-lived and automatically revoked on termination.