Your CA already proves who an agent is. AgentPass governs what it is allowed to do, enforces that before the agent acts, and produces a signed record of every decision. Point your agents at the CA you already run. Keep your roots, your policies, your HSM.
A certificate proves identity. It says nothing about authority. An authenticated agent that wires the money, drops the table or deploys to production is still authenticated while it does it. Authentication was designed for humans who can be held to account afterwards. Agents act at machine speed, with nobody in the room.
Controlling what your AI agents do is not optional. It is the part that carries the liability.
AgentPass is not a competing Certificate Authority. It is the trust and enforcement layer that sits above whichever CA you operate. If you run a PKI, you point your agents at it and keep everything you have already built and audited.
One configuration value. Your issuing CA, your roots, your policy, your HSM. Nothing moves.
X.509v3 issued by you, with a SPIFFE ID and our OID extensions carried inside it.
Trust level, capabilities and jurisdiction under IANA PEN 66339, signed by your CA.
Every action checked against the certificate before it executes. Refusals are signed too.
No SDK to learn before you start. No policy language. No sidecar to operate. A developer asks for an agent and receives a real certificate with authority bound into it.
The refusal is the product. Anyone can log a failure after the fact. AgentPass stops the action and signs the fact that it stopped it, so the record stands up when somebody asks later.
Trust level and permission are different axes. A scope says what an agent may request. A trust level says how strongly its identity was established and whether its messages carry integrity. An L1 agent and an L4 agent holding identical scopes are not the same risk.
Public endpoints only. The floor, not a default.
Passport signed by a trusted issuer.
Identity plus per-message integrity. Baseline for most operations.
Required for anything that moves money. Spend limits enforced.
Key attested to an HSM or Secure Enclave. Human approval on a physical device.
Everything below runs against the live production API. Your browser generates a genuine ECDSA P-256 keypair, builds a real DER encoded CSR, and receives a real X.509v3 certificate. The private key never leaves your machine. Then try to make the agent do something it is not authorised to do.
WebCrypto API. The private key never leaves your machine.
Only the certificate signing request is sent to the CA.
Authority carried inside the certificate under IANA PEN 66339.
The agent attempts an action. The gate checks trust level and declared capabilities before anything executes. Default deny.
| 1.3.6.1.4.1.66339.1 | Trust Level | -- |
| 1.3.6.1.4.1.66339.2.1 | Jurisdiction | -- |
| 1.3.6.1.4.1.66339.3 | Capabilities | -- |
| 1.3.6.1.4.1.66339.4 | Protocol Binding | -- |
| 1.3.6.1.4.1.66339.5 | Agent ID | -- |
Thirteen Internet-Drafts published with the IETF covering agent identity, MCP security, agent PKI, transport, payment trust, model lifecycle attestation, audit trails and behavioural analysis. IPR declared under RFC 8179 with RAND terms, so anyone building on this knows exactly where they stand.
Banking, certificate authorities and regulated industry. SaaS or self hosted, including fully airgapped deployment on our own hardened Linux base image.
Agent identity and enforcement in production.
UK and European deployments, EU AI Act aligned record keeping.
Certificate authority channel and banking deployment.
Managed platform. Nothing to run.
Your infrastructure, your CA, your keys.
No outbound connectivity required at any point.
EU AI Act Articles 12 to 16 and 50, SOC 2, PSD2, OWASP.
We built the other half, and it works with what you have. Partnership, integration and licensing conversations welcome.
contact@cybersecai.co.uk