Per-Agent Cryptographic Identity
· 2 min read
GRIFF Brain now records who performed each governed action, cryptographically, on every turn.
Each governed MCP call resolves a signed, per-turn identity assertion (HMAC-SHA256, RFC 8693
sub/act, RFC 8707 audience binding, a 15-minute TTL cap, and a per-turn nonce). The resolved
principal — a specific agent, lab, and session, not just "an AI" — is written alongside the
authorization decision in the governance audit record.