Agent identity

Agent identity is the core concept in AIM. Every AI agent in a system has a unique, cryptographically verifiable identity that ensures secure communication and operations.

How it works

AIM uses public key cryptography to establish and verify agent identities. Each agent has:

  • • A unique identifier (UUID)
  • • A public/private key pair
  • • Metadata describing capabilities and properties
  • • A trust score based on behavior and verification history

Registration process

Important: Always generate key pairs using secure cryptographic libraries. Never share or expose private keys.

1. Generate a key pair

import { generateKeyPair } from '@opena2a/aim-sdk';

// Generate RSA-2048 key pair
const { publicKey, privateKey } = await generateKeyPair({
  algorithm: 'RSA',
  keySize: 2048
});

// Store private key securely
await savePrivateKey(privateKey, '/secure/location/private.pem');

2. Register the agent

const agent = await client.agents.register({
  name: 'production-assistant',
  type: 'ai_agent',
  publicKey: publicKey,
  capabilities: [
    'text-generation',
    'code-analysis',
    'data-processing'
  ],
  metadata: {
    model: 'gpt-4',
    version: '1.0.0',
    environment: 'production',
    owner: 'engineering-team'
  }
});

Verification process

Every agent action must be verified to ensure authenticity. The verification process:

  1. 1. Create payload: Include action details, timestamp, and nonce
  2. 2. Sign payload: Use the agent's private key to create a signature
  3. 3. Send request: Include agent ID, payload, and signature
  4. 4. Server verification: AIM verifies the signature using the public key
// Create action payload
const payload = {
  action: 'generate_report',
  parameters: {
    reportType: 'security-audit',
    targetSystem: 'production-api'
  },
  timestamp: Date.now(),
  nonce: crypto.randomBytes(16).toString('hex')
};

// Sign the payload
const signature = await signPayload(payload, privateKey);

// Verify agent identity
const verification = await client.agents.verify(
  agent.id,
  signature,
  payload
);

if (verification.valid) {
  console.log('Identity verified');
  console.log('Trust score:', verification.trustScore);
  // Proceed with action
} else {
  console.log('Verification failed');
  // Handle failure
}

Agent types

AI agents

LLM-based agents that perform text generation, analysis, and decision-making.

type: "ai_agent"

Service agents

Microservices and APIs that perform specific tasks or integrations.

type: "service_agent"

Human agents

Human operators with specific roles and permissions in the system.

type: "human_agent"

MCP servers

Model Context Protocol servers providing specialized capabilities.

type: "mcp_server"

Security considerations

Best practices

  • • Store private keys in secure vaults (AWS KMS, HashiCorp Vault)
  • • Rotate keys regularly (recommended: every 90 days)
  • • Use hardware security modules (HSMs) for production
  • • Implement rate limiting to prevent abuse
  • • Monitor trust scores and set alerts for anomalies

Trust score factors

The server trust score is calculated from 9 weighted factors:

  1. 1. Verification status (25%): Signature verification success rate on agent actions
  2. 2. Uptime (15%): Availability and heartbeat consistency
  3. 3. Action success rate (15%): Share of capability checks that succeed
  4. 4. Security alerts (15%): Frequency and severity of triggered alerts
  5. 5. Compliance (10%): Actions stay within declared capability boundaries and policy
  6. 6. Execution isolation (10%): Runtime isolation posture across sandbox, network, filesystem, and process
  7. 7. Agent age (5%): Time since the agent was registered
  8. 8. Drift detection (3%): Deviation in capability use from the established baseline
  9. 9. User feedback (2%): Operator-submitted ratings of the agent