Agent credentials · rs-credential/0.1
We certify the accountable owner and the exact configuration — not a permanent agent identity
Rightshold does not fingerprint an agent — an agent has no stable self: the same model runs as millions of copies, and its prompt, tools and code can change in a minute. Rightshold certifies the accountable owner behind the agent (at a verification tier, never shown publicly unless the owner chooses) plus the exact configuration the agent runs, bound to the agent's key in a short-lived, scoped, revocable credential. Change the model, the prompt, the tools or the code and the credential stops matching: changing intent breaks the badge. Trust then accrues from evidence — signed action logs and incident reports — not from a one-time exam.
Features
- Accountable-owner verification tiers (verified email and domain live; business and government ID through an outside provider)
- Signed credentials bound to an agent key and its exact configuration (model, prompt hash, tools, code version)
- Automatic config_mismatch when any part of the configuration changes
- Short-lived (24 hours by default, 168 hours at most), scoped credentials
- Instant revocation and a public signed revocation list
- Free, keyless verification over HTTP and MCP (verify_agent_credential)
- Optional key proof so a site knows the agent holds the key
- Signed behaviour evidence and a per-credential track record
- Public incident registry (reporters are never named)
- Per-connection selective disclosure with consent from both owners
- Identity escrow with an audited, rule-bound reveal process
The four layers
1. The accountable owner. Every agent acts for a person or company. Rightshold records the owner's verification tier — none, verified_email, verified_domain, verified_business, government_id — and never shows the owner publicly. Verified email and verified domain are live; verified business and government ID come only through an identity provider the owner approves. Rightshold never stores ID documents.
2. A credential bound to the exact configuration. The agent sends its Ed25519 public key and a config: model_id, system_prompt_sha256 (the hash, never the prompt), the tool list (or its hash) and code_version. Rightshold signs a credential binding that config hash to that key, for a limited scope and 168 hours at most. If any part of the config changes, the hash the agent presents no longer matches and verification answers config_mismatch. Changing intent breaks the badge.
3. Short-lived, scoped, revocable. Scope lists the actions allowed (read:invoices, pay:max_usd_500). The owner revokes instantly; the public signed revocation list at https://www.rightshold.com/v1/credentials/revocations is cacheable for 60 seconds.
4. Behaviour evidence. Owners and relying sites submit action logs and incident reports (a summary plus the SHA-256 of the file they keep). Rightshold signs each record. Incidents go to the public registry at https://www.rightshold.com/v1/credentials/incidents; each credential has a track record at /v1/credentials/{id}/track-record. A report is an allegation with a timestamp, not a finding, and the reporter is never named.
Verify an agent in milliseconds (free)
GET https://www.rightshold.com/v1/credentials/verify?id=crd_...&config_hash=<sha256>&scope=<action> — or POST the same fields, plus key_proof {challenge, signature} where the agent signs {spec: "rs-credential/0.1", type: "KeyProof", credential_id, challenge} with its key. MCP: verify_agent_credential.
The answer: valid, reasons (expired, revoked, config_mismatch, config_hash_not_presented, out_of_scope, key_proof_invalid), owner tier and verified_human_behind, config match, scope, revoked status, and the history summary (actions logged, incidents open, high-severity incidents). Verification is always free.
A verified human behind the agent, with Rightshold as the middleman
When two credentialed agents connect, each owner chooses what the other side learns: anonymous, tier_only, organization, full_identity, and whether the purpose of the connection is shared. Both owners must consent before either side receives Rightshold's signed attestation.
Open: POST https://www.rightshold.com/v1/me/credentials/connections {credential_id, counterparty_credential_id, disclosure, purpose, share_purpose}. Accept: POST /v1/me/credentials/connections/{id}/accept with the other owner's own choices. Read: GET /v1/me/credentials/connections/{id}.
Identity escrow: an owner can place a provider's reference hash (never a document) in escrow: POST /v1/me/credentials/{id}/identity-escrow. A reveal can only be requested on a defined basis — an arbitration case the requester is party to, or legal process — with POST /v1/credentials/{id}/reveal-requests. Nothing is revealed automatically, and every request appears on the public audit trail at /v1/credentials/{id}/reveal-log.
Issue a credential
POST https://www.rightshold.com/v1/me/credentials with your API key: {agent, public_key_pem, config: {model_id, system_prompt_sha256, tools | tools_sha256, code_version}, scope: [...], ttl_hours, disclosure, signature}. signature is the agent key's Ed25519 signature over the canonical JSON (sorted keys) of {spec: "rs-credential/0.1", type: "CredentialRequest", key_id: "key_" + sha256(public_key_pem)[0:16], config_hash}. config_hash = sha256(canonical({spec, model_id, system_prompt_sha256, tools_sha256, code_version})); tools_sha256 = sha256(canonical(sorted unique tool names)).
Pricing: verification is free forever. Issuing a credential and recording signed evidence are planned at a penny or less each, and free during the preview. See /pricing.
What this is not
Not a permanent identity for an agent, and not a promise that an agent will behave. It is a signed statement that an accountable owner of a stated tier stands behind this exact configuration, for this scope, until this time, plus the evidence recorded since.
Get an API key · Markdown · FAQ · How to verify an agent · Can you fingerprint an agent? · Verified human behind the agent