Your agents can transact. Can you prove who they act for, and stop them in one call?
PasskeyBridge binds every AI agent to a verified human principal through scoped delegation, scores agent behavior into a live trust coefficient, and revokes the entire delegation tree in one cascade when a hard signal fires. Shipped, in production, zero PII.
- Bind agent identity to a verified human principal, not to an API key.
- Delegate with explicit scope that narrows automatically when threat signals arrive.
- Let agents establish trust with other agents through attested handshakes, not shared secrets.
- Revoke a compromised principal's entire agent tree in one parametric cascade.
Why agent identity breaks today's stack
Identity infrastructure assumes a person at a keyboard. Agents break every assumption underneath it: OAuth scopes are static grants that accumulate into standing privilege, API keys are bearer tokens with no behavioral binding, and two agents interacting have no mechanism to establish mutual trust beyond secrets they both hold. The result is lateral-movement risk with no human in the loop to notice.
The questions that matter go past whether an agent holds a valid credential: whether it is operating inside the scope a verified human delegated, whether its behavior still matches its history, and whether you can revoke everything it touches the moment its principal is compromised.
What shipped: A2A Trust Attestation
PasskeyBridge's Agent-to-Agent Trust Attestation protocol is in production. Human users delegate identity to agents with explicit scope boundaries anchored to a verifiable credential, not a session cookie. Each agent carries a behavioral trust score derived from its action history and scope usage; when two agents negotiate, their scores combine into a trust coefficient that governs allowed scopes, transaction limits, and session duration.
The handshake itself is attestation-based: each agent submits a cryptographic proof anchored to its delegation chain and behavioral history, producing a bilateral attestation record with explicit expiration, a revocation path, and an audit trail.
- Scoped delegation with dynamic narrowing: a SIM-swap signal on the principal's line reduces scope across every downstream delegate in under 100ms.
- Bilateral trust coefficients, so a low-trust agent negotiates smaller scopes and shorter sessions instead of a binary allow.
- Cascade revocation: one hard signal atomically invalidates the affected delegates, their A2A negotiations, and their sessions.
The delegation chain is anchored to a human
Every delegation traces back through three pillars: carrier signals on the principal's line, a W3C Verifiable Credential attesting legal identity, and a FIDO2 passkey binding the principal to a device. Agent trust inherits that provenance. A compromised phone number degrades trust for every agent the user delegated; a compromised device revokes the whole delegation tree.
This is the difference between machine identity as inventory (a vault of service-account credentials) and machine identity as accountability: at any moment, for any agent, you can answer who it acts for, what it may do right now, and what happens when its principal's identity comes under attack.
The PasskeyBridge approach
Revocation in one cascade
A hard signal on the principal—SIM swap, port-out, credential breach—atomically invalidates the agent delegates, their negotiations, and their sessions. No standing privilege to hunt down.
Whitepaper →Attested agent-to-agent trust
Agents establish bilateral trust through attestation records anchored to delegation chains and behavioral history, not shared secrets. Patent-pending, shipped in production.
Patent portfolio →Zero PII in the loop
Delegation, scoring, and revocation run on hashed identifiers and signed attestations. No agent, and no counterparty agent, ever handles the principal's personal data.
Privacy architecture →We are not a secrets vault or an IAM replacement
PasskeyBridge does not manage service-account passwords, rotate API keys, or replace your identity provider. It is the verification layer underneath those systems: it attests which human an agent acts for, scores whether the agent's behavior still deserves its scope, and revokes delegation when the principal's identity degrades. Your IAM, your agent framework, and your OAuth flows stay; they gain a trust signal they currently have to assume.
Frequently asked
- How is an AI agent bound to a human principal?
- Through a scoped delegation anchored to the principal's verified identity: a W3C Verifiable Credential for legal identity, a FIDO2 passkey for device binding, and live carrier state on the principal's line. The agent receives a delegation with explicit scope boundaries and an auditable chain back to that human, not a free-floating API key.
- What happens when an agent starts behaving abnormally?
- Each agent carries a behavioral trust score derived from its action history and scope-usage patterns. Anomalies lower the score, which narrows what the agent can negotiate: smaller scopes, lower transaction limits, shorter sessions. A hard threat signal on the principal goes further and triggers parametric revocation of the delegation tree. Degradation is graduated; revocation is atomic.
- Does this replace OAuth for our agents?
- No. Delegations and attestations complement existing OAuth and API-key flows rather than replacing them. The difference is what sits behind the token: instead of a static grant that accumulates standing privilege, the agent's effective authority is evaluated against its live trust coefficient and its principal's current identity state at decision time.
- Does this cover machine identities that are not AI agents?
- The same primitives apply to any non-human identity that acts with delegated authority: workload identities, automation, and service processes. The agentic case is the demanding one because agents negotiate with each other and change behavior over time, which is why the protocol is built around behavioral scoring and bilateral attestation rather than static inventory.
- How do two agents verify each other without a shared secret?
- Through the A2A handshake: each side submits a cryptographic proof anchored to its delegation chain and behavioral history, optionally including an mTLS certificate fingerprint. The protocol produces a bilateral attestation record with explicit expiration and a revocation path, so the trust decision is verifiable and reversible instead of implicit in a secret both parties hold.
Talk to us
One reply gets you a 2-page architecture brief and a real latency probe against production. No demo booking required.