Passports
Agent, model, workload, compute and policy objects — the fields each one carries and the decision each field supports.
A persistent identity for an AI actor with bounded authority.
The agent passport binds the declared agent to a CPID, sponsor, purpose, model, workload, tools, policy and revocation path. Authentication is the beginning of the check, not the end of it.
An agent can be fully authenticated and still be denied a material action when its task, model, workload, data boundary, destination, delegated authority, CPID status or evidence pipeline does not match the passport.
cpid · issuer · sponsor · tenant · aliases
business function · approved task classes · environment
on-behalf-of · delegated · autonomous · ceiling · expiry
provider · model · version · assurance profile
allowlist · action limits · destination limits · rate limits
commissioned · active · suspended · retired · compromised
Make model selection visible, versioned and policy-bound.
| Object group | Representative fields | Decision purpose |
|---|---|---|
| Identity | provider · model · version · endpoint · artifact hash | Resolve the model actually invoked. |
| Purpose | approved uses · prohibited uses · task class · owner | Prevent silent repurposing. |
| Assurance | system card · tests · limitations · approval status | Expose known capability and reliability boundaries. |
| Data context | training disclosure · retrieval sources · sensitivity | Support provenance and data-policy decisions. |
| Runtime policy | region · logging · output handling · human review | Apply contextual obligations. |
| Change control | version history · material-change trigger · expiry | Force re-authorization after significant change. |
Identity for AI cannot stop at the model.
Runtime trust depends on the workload image, orchestrator, region, network, keys, compute and attestation context. A valid execution binds agent, model, workload, compute and tool to one signed decision and one evidence chain.
Any mismatch in model, workload image, region, CPID status, tool destination or data class can invalidate the action — not warn about it.
Workload passport
image digest · build · SBOM · owner · orchestrator · namespace · service account
Compute passport
cloud · account · region · cluster · node · GPU · network zone · residency
Execution context
session · tool · data class · policy · timestamp · evidence ref · attestation claims
Translate institutional intent into machine-enforceable obligations.
agent · sponsor · delegation · cpid
task · tool call · state change
system · record · endpoint · resource
model · workload · region · data
time · amount · sensitivity · status
approval · logging · isolation · expiry
WHEN agent.purpose = "case-assistance" AND data.classification = "protected"
REQUIRE cpid.status = active
approved_model = true
workload.region IN allowed_regions
workload.attestation = valid
human_approval = true
evidence_pipeline = healthy
ELSE restrict AND escalate| Authority type | Source | Operating limit |
|---|---|---|
| On-behalf-of | Live human session | Cannot exceed the current human principal or session validity. |
| Delegated | Named sponsor, bounded delegation | May continue after the user steps away; still bound by scope, ceiling and expiry. |
| Autonomous workload | Commissioning policy | No live session required; authority controlled from commissioning through retirement. |
| Sub-agent | Parent agent plus delegation record | Receives only the minimum subset of authority the delegated task requires. |
Material changes to sponsor, purpose, model, tool set, workload, region, data class, cryptographic key or authority trigger impact review and, where required, re-issuance.