AgentMesh Identity and Trust Specification 1.0 — Ed25519

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/microsoft/agent-governance-toolkit/llms.txt

Use this file to discover all available pages before exploring further.

​

Design Principles

1. Every agent has a human sponsor. No orphan agents. Accountability traces to a verified person.
2. Trust is earned, not declared. Initial scores are defaults; only behavioral signals move them.
3. Scope chains only narrow. Delegation can never grant more capabilities than the parent holds.
4. Fail closed. Any identity or trust verification failure MUST result in denial.
5. Cryptographic binding. Identity claims are backed by Ed25519 signatures; no unsigned assertions are trusted.

​

Agent Credential Structure

​

Agent DID Schema

did:mesh:<unique-id>

​

AgentIdentity Required Fields

​

Optional Fields

​

Validation Rules

1. name MUST NOT be empty or whitespace-only.
2. public_key MUST NOT be empty or whitespace-only.
3. sponsor_email MUST contain @.
4. If parent_did is not null, it MUST match the did:mesh: prefix.
5. delegation_depth MUST be >= 0.
6. The private key MUST NOT appear in any serialized representation (JSON, dict export, logging, API responses, error messages).

​

Identity Lifecycle

​

Status Transitions

             ┌──────────┐
create() ───►│  active  │
             └─────┬────┘
                   │
          ┌────────┼────────┐
          ▼                 ▼
    ┌──────────┐     ┌─────────┐
    │suspended │     │ revoked │
    └─────┬────┘     └─────────┘
          │ reactivate()   ▲
          └────────────────┘
            (security suspension
             requires override_reason)

​

Transition Rules

​

Cryptographic Primitives

​

Signing

1. Verify a private key is available; if not, raise an error.
2. Sign the data using the Ed25519 private key.
3. Return the signature as a base64-encoded string (or bytes, depending on SDK).

​

Verification

1. Base64-decode the signature if necessary.
2. Verify using the stored Ed25519 public key.
3. Return True on success, False on failure.
4. MUST NOT raise an exception on verification failure — failures are returned as False.

​

Trust Score Algorithm

​

Score Model

​

Score Update Formula

new_score = clamp(
    current_score + (reward_delta × dimension_weight),
    0,
    min(1000, trust_ceiling)
)

​

Trust Decay

decayed_score = current_score × decay_rate ^ hours_elapsed

​

Trust Tier Definitions

​

Delegation Chain Structure and Validation

​

Scope Chain Rules

1. Monotonic narrowing: Child capabilities MUST be a strict subset of the parent’s capabilities. A child MUST NOT hold capabilities the parent does not hold.
2. Wildcard restriction: The wildcard capability "*" MUST NOT be delegated.
3. Depth limit: The maximum delegation depth is implementation-defined but MUST be enforced. The default maximum depth is 5.
4. Trust ceiling propagation: Each child’s maximum achievable trust score is the parent’s trust ceiling (or 1000 for root agents).

​

Chain Validation

1. Every link’s parent_did resolves to an active identity in the registry.
2. Every link’s capabilities are a subset of its parent’s capabilities.
3. The chain depth does not exceed the maximum.
4. No wildcard "*" capability appears in any non-root delegation.

# Valid delegation chain
Root:  capabilities=["read:*", "write:data", "search"]
  └── Child: capabilities=["read:data", "search"]       # narrowed ✅
        └── Grandchild: capabilities=["read:data"]      # narrowed again ✅

# Invalid delegation attempts
Child attempts: capabilities=["read:*", "admin"]  # "admin" not in parent ❌
Child attempts: capabilities=["*"]                # wildcard forbidden ❌

​

Inter-Agent Trust Negotiation (IATP)

​

Handshake Flow

Agent A                                           Agent B
  │                                                  │
  │──── IssueChallenge(target=B.did) ──────────────►│
  │     { challenge_id, nonce (256 bits), expires }  │
  │                                                  │
  │◄─── RespondToChallenge(challenge_id, sig) ───────│
  │     { response_nonce (128 bits), signature }     │
  │                                                  │
  │──── VerifyResponse() ──────────────────────────►│
  │     Returns: HandshakeResult                    │

​

Challenge Requirements

• Challenge nonces MUST use at least 256 bits of cryptographically secure randomness.
• Response nonces MUST use at least 128 bits.
• Challenges MUST expire and be cleaned up. The default TTL is 60 seconds.
• Pending challenge count MUST be bounded to prevent DoS.
• Each challenge nonce is single-use: MUST be removed after use (success or failure).

​

Signature Verification

​

Freshness Support

​

JWK / JWKS Serialization

{
  "kty": "OKP",
  "crv": "Ed25519",
  "x": "<base64url-encoded-public-key>",
  "kid": "did:mesh:<unique-id>",
  "use": "sig"
}

​

DID Document Export

{
  "@context": ["https://www.w3.org/ns/did/v1"],
  "id": "did:mesh:<unique-id>",
  "verificationMethod": [{
    "id": "did:mesh:<unique-id>#key-<fingerprint>",
    "type": "Ed25519VerificationKey2020",
    "controller": "did:mesh:<unique-id>",
    "publicKeyBase64": "<base64-encoded-public-key>"
  }],
  "authentication": ["did:mesh:<unique-id>#key-<fingerprint>"],
  "service": [{
    "id": "did:mesh:<unique-id>#agentmesh",
    "type": "AgentMeshIdentity",
    "serviceEndpoint": "https://mesh.agentmesh.dev/v1"
  }]
}

​

Identity Registry

​

Security Considerations

​

Conformance Requirements

1. DID format MUST be did:mesh:<unique-id> with ≥ 128 bits of randomness.
2. Ed25519 MUST be the signature algorithm.
3. Private keys MUST NOT appear in serialized output.
4. Every identity MUST have a human sponsor.
5. Trust scores MUST be clamped to [0, 1000].
6. Trust ceilings MUST be enforced on every score update.
7. Scope chain capabilities MUST only narrow, never widen.
8. Wildcard "*" MUST NOT be delegated.
9. Handshake challenges MUST expire and be cleaned up.
10. Token verification MUST use constant-time comparison.
11. Signature verification failures MUST NOT raise exceptions.
12. Revoked identities MUST NOT be reactivated.
13. Key rotation MUST produce verifiable proofs.
14. JWK export MUST NOT include private keys by default.