Agent Identity — KYA Glossary

Agent identity is a verifiable, ideally cryptographic or attested identifier for a software agent — a way to recognise the agent and bind it to the code it runs, the principal it serves, and the credentials it holds.

Why it matters

You cannot authorise, audit, or revoke what you cannot identify. Agent identity is the anchor for the rest of KYA: delegation, scoped credentials, and revocation all reference the agent’s identity.

It relates to, but is not the same as, neighbouring concepts:

  • Digital identity (NIST SP 800-63) covers identity proofing and authentication, largely for people and their authenticators. Agents need the analogous assurance, applied to a running system.
  • Workload identity (SPIFFE) gives services cryptographic identities derived from what and where they are. This is a strong foundation for agent identity, though a workload ID alone does not express a principal or a mandate.
  • Verifiable credentials (W3C) can express claims about an agent — who issued its identity, what it is, what it may do — in a tamper-evident form.
  • Signed agent traffic (e.g. Cloudflare Web Bot Auth) lets a previously unknown agent prove cryptographically that it is a registered bot or agent.

Properties of a good agent identity

  • Bound to code or configuration — not just a bearer secret, so impersonation is harder.
  • Verifiable by a third party — the relying service can check it without trusting the agent’s assertion.
  • Linked to a principal — resolves to an accountable party.
  • Revocable — can be invalidated quickly.
  • Narrowly scoped — identifies the agent, not a whole fleet, where possible.

Related

Sources

  1. NIST, SP 800-63-4 — https://pages.nist.gov/800-63-4/ (accessed 2026-10-03)
  2. SPIFFE, SPIFFE Concepts — https://spiffe.io/docs/latest/spiffe-about/spiffe-concepts/ (accessed 2026-10-03)
  3. W3C, Verifiable Credentials Data Model v2.0 — https://www.w3.org/TR/vc-data-model-2.0/ (accessed 2026-10-03)
  4. Cloudflare, Web Bot Auth — https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/ (accessed 2026-10-03)