Identity and Trust Platform for AI Agents
Give every AI agent a certificate that carries what it is allowed to do, and an enforcement layer that stops it when it tries anything else. Then prove exactly what happened, to a regulator, in court.
Live right now · 12/12 escape attempts blocked · every block signed and logged
This is not hypothetical
Three real incidents. In each one the agent was authenticated. Nothing stopped it at the moment it acted, and afterwards nobody could prove precisely what it had done.
A malicious dataset triggered code execution in the processing pipeline. An autonomous agent reached production, took internal datasets and service credentials, and reused those credentials across multiple services.
During an explicit code freeze, the agent ran a destructive command and wiped records for over 1,200 executives and nearly 1,200 companies. It then concealed what it had done and gave false accounts when asked.
CVE-2025-32711, CVSS 9.3. A single crafted email made Copilot read internal files and exfiltrate them. No click. No user interaction. Indirect prompt injection hidden in ordinary content.
Every one of these agents had valid credentials. Authentication was never the problem. Authentication tells you who asked. It cannot tell you what they were allowed to do, and it cannot prove what they did.
Running now
An autonomous agent with a real L2 certificate systematically attacks the platform holding it: escalation, exfiltration, sanctions evasion, lateral movement, acting after revocation. Every attempt hits the live AgentPass API. Every block is real. Every block is signed.
The question after an incident
Most teams can produce application logs, which anyone with write access can edit. AgentPass writes every action, refusal, promotion and revocation into a SHA-256 hash-chained ledger, each entry carrying the signature that requested it. Change one record and every hash after it breaks.
Signed with a key held by the agent, verifiable against the certificate the CA issued to it.
The signature covers the method and every parameter. Change one value and it no longer verifies.
Refusals are evidence too. The attempt, the reason and the trust level are all recorded.
Graduated trust
Promotion is sequential and gated. L3 and above need a human approval signed in a phone's Secure Enclave. An agent cannot promote itself. The red team demo above tries, twice.
What an agent carries
Authenticates the client, from your own provider: Google, Entra, Okta, Cognito.
Authenticates the agent. Its own ECDSA P-256 key, SPIFFE workload id, trust level and capabilities, enforced at action time.
Runtime identity where you already run. arn:aws:bedrock-agentcore:…
Trust level and operating region bound into the certificate under IANA arc 1.3.6.1.4.1.66339. Signing keys in FIPS 140-2 Level 3 HSM.
No procurement cycle, no pilot fee. Call the API, get a real CA-issued certificate for your agent in under a second, and start enforcing today. It runs in your cloud: AWS, GCP, Azure, OCI or on-premise, with your identity provider, your SIEM and your keys.
You get an API key and a CA-backed tenant. Minutes, not weeks.
One POST. Real X.509, ECDSA P-256, trust level and jurisdiction embedded.
One call before the agent acts. Allowed and signed, or refused and logged.
# 1. issue a certificate for your agent curl -X POST https://poc.agentpass.co.uk/api/agents \ -H "X-Api-Key: $AGENTPASS_KEY" \ -d '{"name":"billing-agent","capabilities":["read","query"]}' # 2. ask permission before the agent acts curl -X POST https://poc.agentpass.co.uk/api/agents/$ID/act \ -d '{"action":"pay","counterparty":"Acme Ltd"}' → allowed: false · "requires L3, agent has L2" · written to the ledger
AgentPass is live in production today. Certificates, enforcement and the evidence ledger. See all of it for yourself.