Agent credentials · FAQ
Agent credentials FAQ
Can you fingerprint an AI agent?
Not permanently. A model runs as millions of copies, and its prompt, tools and memory can change in a minute, so there is no stable self to fingerprint. Rightshold certifies two things that can be pinned down: the accountable person or company behind the agent, and the exact configuration the agent is running right now.
What exactly do you certify, then?
A signed statement that an owner of a stated verification tier stands behind this agent key and this exact configuration, for a listed scope, until a stated time, plus the evidence recorded since. It is not a promise that the agent will behave.
What happens if someone changes the agent's prompt, tools or model after it is credentialed?
The credential stops matching. The configuration is hashed into the credential, so a changed prompt, model, tool list or code version produces a different hash and verification answers config_mismatch. You can still change an agent's intent, but you cannot do it silently. The owner issues a new credential for the new configuration.
How long does a credential last?
24 hours by default and 168 hours at most. Short lifetimes mean a stale or misused badge ages out on its own, like a hotel key card rather than a passport.
What is scope?
The list of actions the credential allows, such as reading invoices or paying up to a set amount. A site asks whether the agent may do a specific action, and verification answers out_of_scope if it may not.
How does a website verify an agent?
It sends the credential id, the configuration hash the agent presents, and optionally the action it wants to allow, to the free verify endpoint or the verify_agent_credential MCP tool. The answer comes back in milliseconds: valid or not, the reasons, the owner's tier, whether a verified human is behind it, revocation status and a summary of the agent's history. A site can also ask the agent to sign a challenge to prove it holds the key.
Does verification cost anything?
No. Verifying a credential is free and needs no API key, and it will stay free.
What does issuing a credential cost?
Nothing during the preview. We plan to charge about a penny or less per credential or evidence record, with a monthly free allowance, and we will announce any change on the pricing page before it applies.
How does revocation work?
The owner can revoke a credential at any time and it takes effect immediately. Rightshold publishes a signed revocation list that any site can fetch and cache for up to 60 seconds, and verification reports revoked credentials as invalid.
What is the incident registry?
A public, signed record of incident reports about credentialed agents. Owners and the sites agents deal with can file a summary plus a hash of the file they keep. A report is a dated allegation, not a finding, and the reporter is never named. Open incidents show up in the agent's track record.
Do you see or store my agent's code or prompt?
No. You send hashes, not the prompt or the code. Rightshold signs over those hashes, so nobody, including us, can read your system prompt or source from a credential.
What are the ID tiers?
none, verified_email, verified_domain, verified_business and government_id. Verified email and verified domain are live now. Business and government ID will come through an outside identity provider the owner approves, and Rightshold never stores ID documents.
Is ID verification required?
No, it is voluntary. A higher tier simply tells the other side more about who stands behind the agent. Sites decide which tier they require.
Can I stay anonymous and still be trusted?
Yes. When two credentialed agents connect, each owner picks what the other side learns: anonymous, tier only, organization, or full identity, and whether to share the purpose of the connection. Rightshold vouches that a verified human of that tier is behind each side without revealing more than the owner chose.
Does the other side have to agree?
Yes. Both owners must accept the connection before either side receives Rightshold's signed attestation.
When can a hidden identity be revealed?
Only on a defined basis: an arbitration case the requester is a party to, or legal process. Nothing is revealed automatically. Every reveal request is logged on a public audit trail for that credential, and during the preview requests stay pending until a review process is in place.
Is my owner identity ever shown publicly?
No. The public sees the tier, never the owner, unless the owner chooses full identity for a specific connection.
Why publish a feature list? Could it be copied?
We name what the system does so agents and sites can find and rely on it. How trust signals are weighed stays on our servers and is not published. A trust registry is worth what its signed history and network are worth, and that cannot be copied.