{
  "question": "Can you fingerprint or permanently identify an AI agent?",
  "slug": "can-you-fingerprint-an-ai-agent",
  "url": "https://www.rightshold.com/answers/can-you-fingerprint-an-ai-agent",
  "short_answer": "Not in any lasting way. A person has one body; an agent is a model, a system prompt, a tool list, code and whoever directs it, and each of those can change in minutes while the same model runs as many copies at once. And even a perfect snapshot would not stop the owner from changing the agent's intent right after the check. What works is to certify the accountable owner behind the agent and the exact configuration at a moment in time, bind that to the agent's key in a short-lived credential, and let any configuration change break it automatically. Trust then builds from signed behaviour evidence over time.",
  "checklist": [
    "Identify the accountable party (person or company) and how well they are verified: email, domain, business, government ID through a provider.",
    "Hash the configuration: model id, the SHA-256 of the system prompt (never the prompt itself), the tool list and the code version.",
    "Bind the hash to the agent's own key in a signed credential that lasts hours or days, not years.",
    "Limit scope: list the actions the credential allows.",
    "Publish revocations instantly in a signed list relying sites can cache.",
    "Collect signed action logs and incident reports so a track record accrues per credential."
  ],
  "sections": [
    {
      "heading": "What changing intent does",
      "points": [
        "If the owner edits the prompt, swaps the model, adds a tool or ships new code, the configuration hash changes. A site that checks the presented hash against the credential sees config_mismatch and refuses. Intent can still change, but not silently."
      ]
    }
  ],
  "checks": [],
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "Issue a credential for my agent's current configuration with read-only scope for 24 hours.",
    "mcp_call": {
      "tool": "issue_agent_credential",
      "arguments": {
        "agent": "my-agent",
        "public_key_pem": "<Ed25519 PEM>",
        "config": {
          "model_id": "provider/model@version",
          "system_prompt_sha256": "<hex>",
          "tools": [
            "search",
            "read_file"
          ],
          "code_version": "v1.2.0"
        },
        "scope": [
          "read:*"
        ],
        "ttl_hours": 24,
        "signature": "<agent key signs the CredentialRequest>"
      }
    },
    "also": [
      "verify_agent_credential checks it for free.",
      "revoke_agent_credential revokes it instantly."
    ],
    "scope": "A credential describes a configuration and an accountable owner at a point in time; it is not a guarantee of behaviour."
  },
  "sources": [
    {
      "title": "W3C Verifiable Credentials Data Model 2.0",
      "url": "https://www.w3.org/TR/vc-data-model-2.0/"
    },
    {
      "title": "NIST SP 800-63-4 Digital Identity Guidelines",
      "url": "https://pages.nist.gov/800-63-4/"
    }
  ],
  "related": [
    {
      "title": "How do I verify an AI agent before doing business with it?",
      "url": "https://www.rightshold.com/answers/how-to-verify-an-ai-agent-before-doing-business-with-it"
    },
    {
      "title": "Agent credentials",
      "url": "https://www.rightshold.com/agent-credentials"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-10-28"
}