Service
Agent identity and trust-aware tooling
Agent systems need to know which agent, model, rules, and toolchain produced an action. That is identity and provenance first, then authorization.
iftodo designs and prototypes agent identity layers backed by TrustChain-style source records: Ed25519 signed statements, explicit delegation, revocation, and tooling that checks trust state before acting. The work is scoped around your internal system and the controls it needs.
Where this fits
- You are building agent workflows where actions need provenance, delegation, and auditability.
- You need clear language and technical boundaries between identity, trust, and access authorization.
- You want a deployable internal pattern or research prototype before committing to a larger platform.
What gets delivered
- 01
Identity model describing agent principals, source records, delegation chains, revocation, and verifier behaviour.
- 02
Prototype record format and verification library using Ed25519 signatures over canonical source statements.
- 03
Trust-aware tool gate examples showing how identity evidence informs, but does not replace, authorization checks.
What I need from you
- The agent roles, tools, and actions that need to be distinguished.
- Existing IAM, secrets, audit, and policy constraints.
- Examples of provenance questions your operators or auditors must answer.
How the work runs
- 01
Separate the questions: who or what produced this action, who delegated it, is the evidence still trusted, and is the action authorized now.
- 02
Model signed source records and revocation paths before wiring them into tool execution.
- 03
Build a thin verifier and test fixtures, then integrate with one or two representative tools.
Acceptance and evaluation
- A verifier accepts valid chains, rejects tampered records, and respects revocation fixtures.
- Tool examples make authorization decisions with normal policy checks plus identity context.
- Documentation explains where the prototype ends and what would be required for production hardening.
Evidence and work
Common questions
- Is this the same as giving an agent permission?
- Identity says which agent or source produced an action and how that statement is proven. Authorization says whether that identified actor may perform a specific action right now.
- What is TrustChain in this context?
- A source-record pattern for signed agent provenance: Ed25519 signatures, delegation, revocation, and verification logic. The engagement can adapt that pattern to your internal systems.
- Is this a finished certification or compliance product?
- This is architecture and implementation support for trust-aware agent systems. Certification, regulatory approval, or external attestation is a separate process.