Per-Agent Identity
Status: rolling out now across the platform. Identity resolution with staged enforcement is live on the platform Brain (2026-08-10); the strict enforcement rungs activate progressively behind observation windows. See the changelog for the rollout announcement.
Page updated 2026-08-10 against the live platform.
Know which agent did it — cryptographically, every turn. Each governed action carries a signed, per-turn identity assertion, so the operating record attributes work to a specific agent, lab, and session — not just "an AI."
Why per-turn, not per-agent tokens
A long-lived per-agent token is replayable for its whole life, and on a shared machine one process can read a sibling's token and impersonate it. A per-turn signed assertion is different:
- Non-replayable — each turn mints a fresh assertion; a leaked copy is stale by the next turn.
- Delegation-shaped — the assertion records who delegated to whom (operator → agent), giving an auditable delegation record rather than an opaque label.
- Separately-keyed per surface — verifiers for different surfaces refuse each other's assertions, closing cross-surface confusion.
How enforcement rolls out
| Stage | Behavior |
|---|---|
| Shadow | Identity is resolved and logged on every governed call; zero decision change. |
| Staged enforce (live now) | A resolved identity becomes the authoritative principal. Unresolved local callers are permitted and logged (the operator can never be locked out of their own platform); unresolved hosted callers are denied only when the hosted-strict rung is switched on. |
| Strict | Hosted strict-deny and local strict activate after clean observation windows and explicit ratification. |
The fail-open-by-design asymmetry is deliberate: local resolution failures never lock the operator out; hosted/tenant resolution failures fail closed, because there isolation is the point.
What you see as a customer
Governed actions in your workspace's operating record carry the acting agent's identity (agent, lab, session, surface) — so review, replay, and audit answer "which agent did this," not just "an agent did this."