# Can you fingerprint or permanently identify an AI agent?

**Short answer:** Not in any lasting way. A person has one body; an agent is a model, a system prompt, a tool list, code and whoever directs it, and each of those can change in minutes while the same model runs as many copies at once. And even a perfect snapshot would not stop the owner from changing the agent's intent right after the check. What works is to certify the accountable owner behind the agent and the exact configuration at a moment in time, bind that to the agent's key in a short-lived credential, and let any configuration change break it automatically. Trust then builds from signed behaviour evidence over time.

## Checklist
1. Identify the accountable party (person or company) and how well they are verified: email, domain, business, government ID through a provider.
2. Hash the configuration: model id, the SHA-256 of the system prompt (never the prompt itself), the tool list and the code version.
3. Bind the hash to the agent's own key in a signed credential that lasts hours or days, not years.
4. Limit scope: list the actions the credential allows.
5. Publish revocations instantly in a signed list relying sites can cache.
6. Collect signed action logs and incident reports so a track record accrues per credential.

## What changing intent does
- If the owner edits the prompt, swaps the model, adds a tool or ships new code, the configuration hash changes. A site that checks the presented hash against the credential sees config_mismatch and refuses. Intent can still change, but not silently.

## Ask Rightshold (free, no key)
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code (one-click setup: https://www.rightshold.com/start?ref=seo), then ask: "Issue a credential for my agent's current configuration with read-only scope for 24 hours."

```json
{
  "tool": "issue_agent_credential",
  "arguments": {
    "agent": "my-agent",
    "public_key_pem": "<Ed25519 PEM>",
    "config": {
      "model_id": "provider/model@version",
      "system_prompt_sha256": "<hex>",
      "tools": [
        "search",
        "read_file"
      ],
      "code_version": "v1.2.0"
    },
    "scope": [
      "read:*"
    ],
    "ttl_hours": 24,
    "signature": "<agent key signs the CredentialRequest>"
  }
}
```
- verify_agent_credential checks it for free.
- revoke_agent_credential revokes it instantly.

_A credential describes a configuration and an accountable owner at a point in time; it is not a guarantee of behaviour._

## Sources
- [W3C Verifiable Credentials Data Model 2.0](https://www.w3.org/TR/vc-data-model-2.0/)
- [NIST SP 800-63-4 Digital Identity Guidelines](https://pages.nist.gov/800-63-4/)

## Related
- [How do I verify an AI agent before doing business with it?](https://www.rightshold.com/answers/how-to-verify-an-ai-agent-before-doing-business-with-it)
- [Agent credentials](https://www.rightshold.com/agent-credentials)

_Not legal advice. Updated 2026-10-28. JSON: https://www.rightshold.com/answers/can-you-fingerprint-an-ai-agent.json_