Skip to main content

Per-Agent Cryptographic Identity

· 2 min read

GRIFF Brain now records who performed each governed action, cryptographically, on every turn.

Each governed MCP call resolves a signed, per-turn identity assertion (HMAC-SHA256, RFC 8693 sub/act, RFC 8707 audience binding, a 15-minute TTL cap, and a per-turn nonce). The resolved principal — a specific agent, lab, and session, not just "an AI" — is written alongside the authorization decision in the governance audit record.

What shipped​

  • identity_assertion verifier in the Brain runtime (griffai-memory dev39), with a cross-language golden test pinning it to the reference implementation.
  • Shadow first (dev39): identity was resolved and logged with zero change to any authorization decision, so the resolution could be observed against real traffic before it became load-bearing.
  • Staged enforce (dev40): a resolved identity is now authoritative provenance in the audit record. Enforcement is fail-asymmetric by design:
    • a local caller is never denied on identity grounds (operator-never-lock), so arming enforcement can never interrupt on-box operation;
    • the hosted "deny on unresolved" rung is armed but off until the hosted identity channel is confirmed;
    • a single break-glass switch returns the system to log-only.

Why it matters​

Attribution is the missing half of an audit trail. Knowing what an agent did is only useful when you also know which agent did it, under whose session, with a signature you can verify. Per-agent identity closes that gap without adding a second identity store — it reuses the same signed-marker discipline already at the core of GRIFF governance.

Identity resolution is separately keyed per surface: local operator identity and hosted tenant/user identity stay in distinct namespaces with distinct fail behavior. Tenant and operator scopes are never conflated.

Rolling out now across the platform.