Verification.
Persistent, verifiable identity for every agent.
Agents need an identity that survives session resets, credential rotations, and runtime migrations. Verification gives every agent a durable cryptographic identifier and a record of who provisioned it, what it can do, and what it has done.
The shape of Verification.
Stable across sessions.
Each agent gets a persistent identifier that doesn't change when the runtime restarts or credentials rotate. Reconciliation tools have something to anchor on.
Least privilege by default.
Capabilities are declared at provisioning time and enforced on every call. An agent that didn't ask for `payments.create` can't accidentally send money.
Prove who you are.
Submit a signed attestation from your runtime (TEE, signed manifest, hardware key) and AgentRail verifies it before granting elevated capabilities.
One coherent surface for verification.
/v1/identity/agents/{id}Resolve persistent identity
/v1/identity/attestationsSubmit a signed attestation
/v1/identity/agentsList agent identities