Scoped, revocable trust for AI agents bound to a verified human principal.
PasskeyBridge binds every AI agent to a verified human principal through scoped delegation, scores agent behavior into a live trust coefficient, and revokes the delegation tree in one cascade when a hard signal fires. Identifiers are stored as keyed HMAC-SHA-256 digests.
- Bind agent identity to a verified human principal.
- Delegate with explicit scope that narrows automatically when threat signals arrive.
- Let agents establish trust with other agents through attested handshakes.
- Revoke a compromised principal's entire agent tree in one parametric cascade.
Why agent identity breaks today's stack
Identity infrastructure assumes a person at a keyboard. Agents break every assumption underneath it: OAuth scopes are static grants that accumulate into standing privilege, API keys are bearer tokens with no behavioral binding, and two agents interacting have no mechanism to establish mutual trust beyond secrets they both hold. The result is lateral-movement risk with no human in the loop to notice.
The questions that matter go past whether an agent holds a valid credential: whether it is operating inside the scope a verified human delegated, whether its behavior still matches its history, and whether you can revoke everything it touches the moment its principal is compromised.
A2A Trust Attestation
PasskeyBridge's Agent-to-Agent Trust Attestation protocol is deployed on the production platform. Human users delegate identity to agents with explicit scope boundaries anchored to a verifiable credential. Each delegate carries a trust score that the platform recomputes from signals and recorded agent activity. When two agents negotiate, the geometric mean of their scores, adjusted for network jitter, device binding and SIM-signal freshness, gives a trust coefficient that sets the allowed scopes, the transaction value limit and the transactions-per-minute limit. The initiating request sets the session length, from 10 to 3,600 seconds (60 by default).
The handshake itself is attestation-based: each agent submits a cryptographic proof anchored to its delegation chain and behavioral history, producing a bilateral attestation record with explicit expiration, a revocation path, and an audit trail.
- Scoped delegation with dynamic narrowing: a SIM-swap signal on the principal's line reduces scope across every downstream delegate, inside the ingest request that carries the signal.
- Bilateral trust coefficients: a lower-trust agent negotiates smaller scopes and shorter sessions.
- Cascade revocation: one hard signal atomically invalidates the affected delegates, their A2A negotiations, and their sessions.
The delegation chain is anchored to a human
Every delegation traces back through three pillars: carrier signals on the principal's line, a W3C Verifiable Credential attesting legal identity, and a FIDO2 passkey binding the principal to a device. Agent trust inherits that provenance. A compromised phone number degrades trust for every agent the user delegated; a compromised device revokes the whole delegation tree.
For any agent, you can look up who it acts for, which scopes it holds now, and what happens to it when its principal's identity comes under attack.
The PasskeyBridge approach
Revocation in one cascade
A hard signal on the principal—SIM swap, port-out, credential breach—atomically invalidates the agent delegates, their negotiations, and their sessions.
Whitepaper →Attested agent-to-agent trust
Agents establish bilateral trust through attestation records anchored to delegation chains and behavioral history.
Patent portfolio →Keyed identifier hashes
Delegation, scoring, and revocation run on HMAC-SHA-256 identifier digests, keyed with a server-held pepper, and on signed attestations. Agents receive digests and attestations, not the principal's raw identifiers.
Privacy architecture →How PasskeyBridge works with your IAM
PasskeyBridge is the verification layer underneath your IAM: it attests which human an agent acts for, scores whether the agent's behavior still fits its scope, and revokes delegation when the principal's identity degrades. Service-account passwords, API-key rotation and your identity provider stay where they are.
Frequently asked
- How is an AI agent bound to a human principal?
- Through a scoped delegation anchored to the principal's verified identity: a W3C Verifiable Credential for legal identity, a FIDO2 passkey for device binding, and live carrier state on the principal's line. The agent receives a delegation with explicit scope boundaries and an auditable chain back to that human.
- What happens when an agent starts behaving abnormally?
- Each agent carries a behavioral trust score derived from its action history and scope-usage patterns. Anomalies lower the score, which narrows what the agent can negotiate: smaller scopes, lower transaction limits, shorter sessions. A hard threat signal on the principal goes further and triggers parametric revocation of the delegation tree. Degradation is graduated; revocation is atomic.
- Does this replace OAuth for our agents?
- No. Delegations and attestations work alongside existing OAuth and API-key flows. The difference is what sits behind the token: instead of a static grant that accumulates standing privilege, the agent's effective authority is evaluated against its live trust coefficient and its principal's current identity state at decision time.
- Does this cover machine identities that are not AI agents?
- The same primitives apply to any non-human identity that acts with delegated authority: workload identities, automation, and service processes. The agentic case is the demanding one because agents negotiate with each other and change behavior over time, which is why the protocol is built around behavioral scoring and bilateral attestation rather than static inventory.
- How do two agents verify each other without a shared secret?
- Through the A2A handshake: each side submits a cryptographic proof anchored to its delegation chain and behavioral history, optionally including an mTLS certificate fingerprint. The protocol produces a bilateral attestation record with explicit expiration and a revocation path, so the trust decision is verifiable and reversible instead of implicit in a secret both parties hold.
Talk to us
One reply gets you a 2-page architecture brief and a real latency probe against production.