AID-M-009.003: Agent Identity, Delegation Lineage & Authorization Context

Version 1.20261015 · Actionable sub-technique

Bind autonomous actions to an accountable runtime identity and preserve chain of custody across delegation. This sub-technique covers owner and sponsor registration, workload identity issuance, WIMSE-aligned workload-to-workload identity patterns, short-lived task credentials, RFC 8693 token exchange or provider-native on-behalf-of token minting, signed delegation context, actor identity claims, and the normalized authorization context consumed by a runtime enforcement point.

Key question: which agent is requesting the action, on whose authority, and with which attenuated delegated scope?

Pillars: app, infra

Lifecycle: building, operation

Scope boundary

Owns accountable agent and actor identity, credential scope, delegation chain of custody, attenuated on-behalf-of context, action binding, and the normalized authorization context supplied to runtime enforcement. It never returns an allow or deny execution decision.

AID-H-018.002: AID-M-009.003 proves who is acting, on whose authority, through which delegation lineage, and with what attenuated scope; AID-H-018.002 applies authorization policy to those verified facts and the exact requested action. Identity and delegation evidence are necessary inputs but are not themselves an authorization result.

Implementation guidance

AID-M-009.003-G001

Build one signed, replay-resistant agent identity and delegation context from verified workload identity, token, action, and delegation records.
Scope and boundary

This method normalizes verified identity and delegation facts for one exact action. It never emits an allow field and never replaces runtime enforcement in AID-H-018. Upstream identity, token, delegation, and orchestrator services make narrow signed assertions; this verifier checks their signatures, freshness, binding, and non-widening chain locally.

Step 1: Define signed dependency schemas and a replay ledger
# File: identity/context-policy.json
{
  "schema_version": "aidefend.identity_context_policy.v1",
  "policy_version": "identity-context-9",
  "max_context_ttl_seconds": 900,
  "receipt_keys": {
    "workload": "keys/workload-identity-verifier.pub",
    "token": "keys/token-verifier.pub",
    "delegation": "keys/delegation-verifier.pub",
    "action": "keys/orchestrator.pub",
    "authority_envelope": "keys/authority-envelope.pub"
  }
}
# File: identity/workload-receipt.json
{
  "schema_version": "aidefend.workload_identity_receipt.v1",
  "receipt_nonce": "wid-5ee7d1f0",
  "workload_id": "spiffe://company.example/agent/support/prod-001",
  "workload_instance_id": "pod:8b85a29a",
  "svid_serial_sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
  "audiences": ["tool-gateway", "billing-api"],
  "issued_at": "2026-07-16T18:00:00Z",
  "expires_at": "2026-07-16T18:15:00Z",
  "verified_checks": ["certificate_signature", "time_validity", "trust_bundle", "workload_attestation"]
}
# File: identity/token-receipt.json
{
  "schema_version": "aidefend.delegated_token_receipt.v1",
  "receipt_nonce": "tok-a19e420c",
  "issuer": "https://id.example.com",
  "subject": "user:e12345",
  "actor_workload_id": "spiffe://company.example/agent/support/prod-001",
  "audience": "billing-api",
  "scopes": ["invoice:read"],
  "token_id_sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
  "sender_binding": "spiffe://company.example/agent/support/prod-001",
  "issued_at": "2026-07-16T18:00:00Z",
  "expires_at": "2026-07-16T18:15:00Z",
  "verified_checks": ["actor", "audience", "issuer", "revocation", "sender_constraint", "signature", "time_validity"]
}
# File: identity/delegation-chain.json
{
  "schema_version": "aidefend.delegation_chain_receipt.v1",
  "receipt_nonce": "dlg-d78c3441",
  "root_subject": "user:e12345",
  "task_id": "task-20260716-4821",
  "action_digest": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
  "issued_at": "2026-07-16T18:00:00Z",
  "expires_at": "2026-07-16T18:15:00Z",
  "verified_checks": ["freshness", "hop_signatures", "sequence"],
  "hops": [
    {"sequence":0,"delegator":"user:e12345","delegate":"spiffe://company.example/agent/support/prod-001","scopes":["invoice:read"],"allowed_tools":["get_invoice_status"],"raw_receipt_sha256":"dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"}
  ]
}
# File: identity/action-manifest.json
{
  "schema_version": "aidefend.agent_action_manifest.v1",
  "receipt_nonce": "act-b8ecba10",
  "action_id": "action-71",
  "task_id": "task-20260716-4821",
  "actor_workload_id": "spiffe://company.example/agent/support/prod-001",
  "target_audience": "billing-api",
  "tool_name": "get_invoice_status",
  "requested_scopes": ["invoice:read"],
  "action_digest": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
  "issued_at": "2026-07-16T18:02:00Z",
  "expires_at": "2026-07-16T18:10:00Z"
}
# File: identity/authority-envelope.json
{
  "schema_version": "aidefend.authority_envelope.v1",
  "envelope_id": "support-agent-envelope",
  "envelope_version": "12",
  "agent_workload_id": "spiffe://company.example/agent/support/prod-001"
}

Sign the policy with the fixed identity-control root. Sign each receipt with the service key named by that verified policy. The token verifier must validate JOSE signature, trusted issuer, audience, time claims, actor, sender constraint, and current revocation state before issuing its receipt; raw bearer tokens never enter the context artifact.

CREATE TABLE agent_identity_evidence_nonce (
  receipt_nonce text PRIMARY KEY,
  receipt_sha256 char(64) NOT NULL,
  reserved_at timestamptz NOT NULL DEFAULT now(),
  expires_at timestamptz NOT NULL
);
CREATE INDEX agent_identity_evidence_nonce_expiry
  ON agent_identity_evidence_nonce (expires_at);
Step 2: Verify, attenuate, reserve nonces, and publish context
from __future__ import annotations

import math as _aidefend_math
import os as _aidefend_os

# Admission injects these required values from one signature-verified, versioned runtime profile.
def _aidefend_required(name):
    value = _aidefend_os.environ.get(name)
    if value is None or not value.strip():
        raise RuntimeError(f"required runtime-profile field is absent: {name}")
    return value.strip()


def _aidefend_positive_float(name):
    try:
        value = float(_aidefend_required(name))
    except ValueError as error:
        raise RuntimeError(f"runtime-profile field is not numeric: {name}") from error
    if not _aidefend_math.isfinite(value) or value <= 0:
        raise RuntimeError(f"runtime-profile field must be finite and positive: {name}")
    return value


def _aidefend_positive_int(name):
    try:
        value = int(_aidefend_required(name))
    except ValueError as error:
        raise RuntimeError(f"runtime-profile field is not an integer: {name}") from error
    if value < 1:
        raise RuntimeError(f"runtime-profile field must be positive: {name}")
    return value


def _aidefend_nonnegative_int(name):
    try:
        value = int(_aidefend_required(name))
    except ValueError as error:
        raise RuntimeError(f"runtime-profile field is not an integer: {name}") from error
    if value < 0:
        raise RuntimeError(f"runtime-profile field cannot be negative: {name}")
    return value


def _aidefend_fraction(name):
    value = _aidefend_positive_float(name)
    if value > 1:
        raise RuntimeError(f"runtime-profile field must be in (0, 1]: {name}")
    return value


RUNTIME_PROFILE_VERSION = _aidefend_required("AIDEFEND_RUNTIME_PROFILE_VERSION")
RUNTIME_PROFILE_SHA256 = _aidefend_required("AIDEFEND_RUNTIME_PROFILE_SHA256").lower()
if (len(RUNTIME_PROFILE_SHA256) != 64
        or set(RUNTIME_PROFILE_SHA256) - set("0123456789abcdef")):
    raise RuntimeError("runtime-profile digest must be lowercase SHA-256")
IDENTITY_CONTEXT_COMMAND_TIMEOUT_SECONDS = _aidefend_positive_float("M009003_IDENTITY_CONTEXT_COMMAND_TIMEOUT_SECONDS")

# File: identity/build_identity_context.py

import hashlib
import json
import os
import re
import stat
import subprocess
import tempfile
from datetime import datetime, timezone
from pathlib import Path

import psycopg

POLICY = Path("identity/context-policy.json")
OUTPUT = Path("evidence/agent-identity-context.json")
SHA = re.compile(r"^[0-9a-f]{64}$")


class InsufficientData(Exception):
    pass


class SecurityFailure(Exception):
    pass


_VERIFIED_BYTES: dict[Path, bytes] = {}


def regular_bytes(path: Path) -> bytes:
    descriptor = os.open(
        path,
        os.O_RDONLY | getattr(os, "O_BINARY", 0) | getattr(os, "O_NOFOLLOW", 0),
    )
    with os.fdopen(descriptor, "rb") as handle:
        status = os.fstat(handle.fileno())
        if not stat.S_ISREG(status.st_mode):
            raise ValueError(f"signed input is not a regular file: {path}")
        value = handle.read()
    if not value:
        raise ValueError(f"signed input is empty: {path}")
    return value


def digest(path: Path) -> str:
    value = _VERIFIED_BYTES[path] if path in _VERIFIED_BYTES else regular_bytes(path)
    return hashlib.sha256(value).hexdigest()


def verify(path: Path, signature: Path, key: Path) -> None:
    payload = regular_bytes(path)
    signature_bytes = regular_bytes(signature)
    key_bytes = regular_bytes(key)
    with tempfile.TemporaryDirectory(prefix="aidefend-identity-context-") as stage_name:
        stage = Path(stage_name)
        os.chmod(stage, 0o700)
        payload_snapshot = stage / "payload"
        signature_snapshot = stage / "payload.sig"
        key_snapshot = stage / "verification.pub"
        payload_snapshot.write_bytes(payload)
        signature_snapshot.write_bytes(signature_bytes)
        key_snapshot.write_bytes(key_bytes)
        os.chmod(payload_snapshot, 0o400)
        os.chmod(signature_snapshot, 0o400)
        os.chmod(key_snapshot, 0o400)
        subprocess.run(
            [
                "cosign", "verify-blob", "--key", str(key_snapshot),
                "--bundle", str(signature_snapshot), str(payload_snapshot),
            ],
            check=True, capture_output=True, text=True,
            timeout=IDENTITY_CONTEXT_COMMAND_TIMEOUT_SECONDS,
        )
        if (
            regular_bytes(payload_snapshot) != payload
            or regular_bytes(signature_snapshot) != signature_bytes
            or regular_bytes(key_snapshot) != key_bytes
        ):
            raise ValueError("private signed-input snapshot changed during verification")
    _VERIFIED_BYTES[path] = payload


def when(value: str) -> datetime:
    parsed = datetime.fromisoformat(value.replace("Z", "+00:00"))
    if parsed.tzinfo is None:
        raise ValueError("timestamp lacks timezone")
    return parsed.astimezone(timezone.utc)


def unique_object(pairs):
    value = {}
    for key, item in pairs:
        if key in value:
            raise ValueError(f"duplicate JSON key: {key}")
        value[key] = item
    return value


def reject_nonfinite(value):
    raise ValueError(f"non-finite JSON number: {value}")


def string_population(value, name: str) -> list[str]:
    if (
        not isinstance(value, list)
        or not value
        or any(not isinstance(item, str) or not item for item in value)
        or len(value) != len(set(value))
    ):
        raise ValueError(f"{name} population is empty, untyped, or duplicated")
    return value


def load_signed(path: Path, key: Path) -> dict:
    verify(path, path.with_suffix(".sig"), key)
    value = json.loads(
        _VERIFIED_BYTES[path].decode("utf-8", errors="strict"),
        object_pairs_hook=unique_object,
        parse_constant=reject_nonfinite,
    )
    if not isinstance(value, dict):
        raise ValueError(f"signed artifact is not an object: {path}")
    return value


now = datetime.now(timezone.utc)
outcome = "ERROR"
reasons: list[str] = []
context = None
input_digests: dict[str, str] = {}
try:
    verify(POLICY, POLICY.with_suffix(".sig"), Path("keys/identity-context-root.pub"))
    policy = json.loads(
        _VERIFIED_BYTES[POLICY].decode("utf-8", errors="strict"),
        object_pairs_hook=unique_object,
        parse_constant=reject_nonfinite,
    )
    if set(policy) != {
        "schema_version", "policy_version",
        "max_context_ttl_seconds", "receipt_keys",
    } or policy["schema_version"] != "aidefend.identity_context_policy.v1":
        raise ValueError("identity context policy schema differs")
    max_ttl = int(policy["max_context_ttl_seconds"])
    if max_ttl <= 0:
        raise ValueError("context TTL policy is invalid")
    expected_key_kinds = {
        "workload", "token", "delegation",
        "action", "authority_envelope",
    }
    if set(policy["receipt_keys"]) != expected_key_kinds:
        raise ValueError("receipt-key policy differs")

    paths = {
        "workload": Path("identity/workload-receipt.json"),
        "token": Path("identity/token-receipt.json"),
        "delegation": Path("identity/delegation-chain.json"),
        "action": Path("identity/action-manifest.json"),
        "authority_envelope": Path("identity/authority-envelope.json"),
    }
    values = {
        kind: load_signed(path, Path(policy["receipt_keys"][kind]))
        for kind, path in paths.items()
    }
    input_digests = {kind: digest(path) for kind, path in paths.items()}
    workload = values["workload"]
    token = values["token"]
    delegation = values["delegation"]
    action = values["action"]
    envelope = values["authority_envelope"]

    schemas = {
        "workload": "aidefend.workload_identity_receipt.v1",
        "token": "aidefend.delegated_token_receipt.v1",
        "delegation": "aidefend.delegation_chain_receipt.v1",
        "action": "aidefend.agent_action_manifest.v1",
        "authority_envelope": "aidefend.authority_envelope.v1",
    }
    exact_fields = {
        "workload": {"schema_version", "receipt_nonce", "workload_id",
            "workload_instance_id", "svid_serial_sha256", "audiences",
            "issued_at", "expires_at", "verified_checks"},
        "token": {"schema_version", "receipt_nonce", "issuer", "subject",
            "actor_workload_id", "audience", "scopes", "token_id_sha256",
            "sender_binding", "issued_at", "expires_at", "verified_checks"},
        "delegation": {"schema_version", "receipt_nonce", "root_subject",
            "task_id", "action_digest", "issued_at", "expires_at",
            "verified_checks", "hops"},
        "action": {"schema_version", "receipt_nonce", "action_id", "task_id",
            "actor_workload_id", "target_audience", "tool_name",
            "requested_scopes", "action_digest", "issued_at", "expires_at"},
        "authority_envelope": {"schema_version", "envelope_id",
            "envelope_version", "agent_workload_id"},
    }
    for kind, schema in schemas.items():
        if (set(values[kind]) != exact_fields[kind]
                or values[kind].get("schema_version") != schema):
            raise ValueError(f"{kind} top-level schema differs")
    required_strings = {
        "workload": {"receipt_nonce", "workload_id", "workload_instance_id",
            "svid_serial_sha256", "issued_at", "expires_at"},
        "token": {"receipt_nonce", "issuer", "subject", "actor_workload_id",
            "audience", "token_id_sha256", "sender_binding", "issued_at", "expires_at"},
        "delegation": {"receipt_nonce", "root_subject", "task_id",
            "action_digest", "issued_at", "expires_at"},
        "action": {"receipt_nonce", "action_id", "task_id", "actor_workload_id",
            "target_audience", "tool_name", "action_digest", "issued_at", "expires_at"},
        "authority_envelope": {"envelope_id", "envelope_version", "agent_workload_id"},
    }
    for kind, fields in required_strings.items():
        if any(not isinstance(values[kind][field], str) or not values[kind][field]
               for field in fields):
            raise ValueError(f"{kind} contains an empty or untyped identity field")
    required_checks = {
        "workload": {
            "certificate_signature", "time_validity",
            "trust_bundle", "workload_attestation",
        },
        "token": {
            "actor", "audience", "issuer", "revocation",
            "sender_constraint", "signature", "time_validity",
        },
        "delegation": {"freshness", "hop_signatures", "sequence"},
    }
    for kind, checks in required_checks.items():
        if set(string_population(values[kind].get("verified_checks"), kind + " verified_checks")) != checks:
            raise ValueError(f"{kind} verified-check population differs")

    expiring = [workload, token, delegation, action]
    for value in expiring:
        issued, expires = when(value["issued_at"]), when(value["expires_at"])
        if not issued <= now < expires:
            raise InsufficientData("identity evidence is stale or not yet valid")
        if (expires - issued).total_seconds() > max_ttl:
            raise ValueError("identity evidence exceeds policy TTL")
    if not SHA.fullmatch(workload["svid_serial_sha256"]):
        raise ValueError("workload SVID serial digest is invalid")
    if not SHA.fullmatch(token["token_id_sha256"]):
        raise ValueError("token ID digest is invalid")
    if not SHA.fullmatch(action["action_digest"]):
        raise ValueError("action digest is invalid")

    actor = workload["workload_id"]
    if token["actor_workload_id"] != actor or token["sender_binding"] != actor:
        raise SecurityFailure("token actor or sender binding differs from workload")
    if action["actor_workload_id"] != actor or envelope["agent_workload_id"] != actor:
        raise SecurityFailure("action or authority envelope actor differs")
    workload_audiences = set(string_population(workload.get("audiences"), "workload audiences"))
    if action["target_audience"] != token["audience"] or action["target_audience"] not in workload_audiences:
        raise SecurityFailure("target audience is not identity- and token-bound")
    if delegation["root_subject"] != token["subject"]:
        raise SecurityFailure("delegation root differs from token subject")
    if delegation["task_id"] != action["task_id"] or delegation["action_digest"] != action["action_digest"]:
        raise SecurityFailure("delegation task or action binding differs")

    hops = delegation.get("hops")
    if not isinstance(hops, list) or not hops:
        raise InsufficientData("delegation chain is empty")
    effective_scopes = set(string_population(token.get("scopes"), "token scopes"))
    effective_tools: set[str] | None = None
    previous = delegation["root_subject"]
    for sequence, hop in enumerate(hops):
        required = {
            "sequence", "delegator", "delegate", "scopes",
            "allowed_tools", "raw_receipt_sha256",
        }
        if set(hop) != required or hop["sequence"] != sequence:
            raise ValueError("delegation hop schema or sequence differs")
        if hop["delegator"] != previous:
            raise SecurityFailure("delegation custody chain is broken")
        if not SHA.fullmatch(hop["raw_receipt_sha256"]):
            raise ValueError("delegation receipt digest is invalid")
        hop_scopes = set(string_population(hop.get("scopes"), f"hop {sequence} scopes"))
        if not hop_scopes.issubset(effective_scopes):
            raise SecurityFailure("delegation widened scope")
        effective_scopes = hop_scopes
        hop_tools = set(string_population(hop.get("allowed_tools"), f"hop {sequence} allowed_tools"))
        effective_tools = hop_tools if effective_tools is None else effective_tools.intersection(hop_tools)
        previous = hop["delegate"]
    if previous != actor:
        raise SecurityFailure("delegation final actor differs from workload")
    requested_scopes = set(string_population(action.get("requested_scopes"), "requested scopes"))
    if not requested_scopes or not requested_scopes.issubset(effective_scopes):
        raise SecurityFailure("action requested scope exceeds delegation")
    if effective_tools is None or action["tool_name"] not in effective_tools:
        raise SecurityFailure("action tool exceeds delegation")

    nonce_records = []
    nonces = []
    for kind in ("workload", "token", "delegation", "action"):
        nonce = values[kind].get("receipt_nonce")
        if not isinstance(nonce, str) or not nonce:
            raise ValueError(f"{kind} receipt nonce is missing")
        nonces.append(nonce)
        nonce_records.append((nonce, input_digests[kind], when(values[kind]["expires_at"])))
    if len(nonces) != len(set(nonces)):
        raise SecurityFailure("duplicate receipt nonce in context")
    with psycopg.connect(os.environ["NONCE_DATABASE_DSN"]) as connection:
        with connection.cursor() as cursor:
            for nonce, receipt_sha, expires_at in nonce_records:
                cursor.execute(
                    """
                    INSERT INTO agent_identity_evidence_nonce
                      (receipt_nonce, receipt_sha256, expires_at)
                    VALUES (%s, %s, %s)
                    ON CONFLICT (receipt_nonce) DO NOTHING
                    RETURNING receipt_nonce
                    """,
                    (nonce, receipt_sha, expires_at),
                )
                if cursor.fetchone() is None:
                    raise SecurityFailure("identity evidence nonce was replayed")
        connection.commit()

    context_id = hashlib.sha256(
        (RUNTIME_PROFILE_SHA256 + "".join(
            input_digests[kind] for kind in sorted(input_digests)
        )).encode("ascii")
    ).hexdigest()
    expires_at = min(when(value["expires_at"]) for value in expiring)
    context = {
        "schema_version": "aidefend.agent_identity_context.v2",
        "control": "AID-M-009.003",
        "context_id": context_id,
        "runtime_profile_version": RUNTIME_PROFILE_VERSION,
        "runtime_profile_sha256": RUNTIME_PROFILE_SHA256,
        "root_subject": token["subject"],
        "actor_workload_id": actor,
        "workload_instance_id": workload["workload_instance_id"],
        "token_id_sha256": token["token_id_sha256"],
        "task_id": action["task_id"],
        "action_id": action["action_id"],
        "action_digest": action["action_digest"],
        "target_audience": action["target_audience"],
        "tool_name": action["tool_name"],
        "requested_scopes": sorted(requested_scopes),
        "effective_scopes": sorted(effective_scopes),
        "effective_tools": sorted(effective_tools),
        "authority_envelope_id": envelope["envelope_id"],
        "authority_envelope_version": envelope["envelope_version"],
        "authority_envelope_sha256": input_digests["authority_envelope"],
        "input_receipt_sha256": input_digests,
        "issued_at": now.isoformat(),
        "expires_at": expires_at.isoformat(),
    }
    outcome = "PASS"
except InsufficientData as error:
    outcome = "INSUFFICIENT_DATA"
    reasons.append(str(error))
except SecurityFailure as error:
    outcome = "FAIL"
    reasons.append(str(error))
except (OSError, subprocess.SubprocessError, KeyError, TypeError, ValueError, json.JSONDecodeError, psycopg.Error) as error:
    outcome = "ERROR"
    reasons.append(str(error))

result = {
    "schema_version": "aidefend.agent_identity_context_verification.v2",
    "control": "AID-M-009.003",
    "runtime_profile_version": RUNTIME_PROFILE_VERSION,
    "runtime_profile_sha256": RUNTIME_PROFILE_SHA256,
    "policy_sha256": digest(POLICY) if POLICY.is_file() else None,
    "input_receipt_sha256": input_digests,
    "context": context,
    "outcome": outcome,
    "reasons": reasons,
    "generated_at": now.isoformat(),
}
OUTPUT.parent.mkdir(parents=True, exist_ok=True)
OUTPUT.write_text(
    json.dumps(result, sort_keys=True, separators=(",", ":"), allow_nan=False) + "\n",
    encoding="utf-8",
)
if outcome != "PASS":
    raise SystemExit(f"agent identity context did not pass: {outcome}")
python identity/build_identity_context.py
cosign sign-blob --yes --key env://IDENTITY_CONTEXT_SIGNING_KEY --bundle evidence/agent-identity-context.sig evidence/agent-identity-context.json
cosign verify-blob --key keys/identity-context.pub --bundle evidence/agent-identity-context.sig evidence/agent-identity-context.json
Verify the handoff and retain evidence

An independent verifier uses a read-only replay mode against the retained inputs, re-verifies every signature and derivation without reserving the same nonces again, and reproduces the context fields. The Harden action gate must then re-verify the signed context, current token/revocation state, exact action digest, authority envelope, expiry, and atomically reserve context_id before enforcement. Action: Hand off only a fresh signed PASS context with no caller-supplied allow/deny field; retain policy, receipts, nonce reservation, result, signature, identities, and replay receipt.

AID-M-009.003-G002

Preserve and independently verify the complete delegation lineage, attenuated scope, and action binding across every agent-to-agent handoff.
Carry an append-only delegation chain

Each handoff adds a signed link containing the root requester, delegating workload identity, receiving workload identity, task and action IDs, exact action digest, intended audience, requested and effective scopes, allowed tools, parent-link digest, issue and expiry times, and a unique nonce. Derive effective authority by intersection with the parent scope; a child may attenuate but never expand it. Reject missing links, loops, duplicate nonces, broken predecessor hashes, audience changes, or an expiry beyond the parent.

Reconstruct the authorization context without deciding

A verifier walks from the registered root identity to the current actor, validates every workload and token signature plus revocation state, recomputes each scope intersection, and proves that the final action and credential are bound to the same chain. Emit a signed normalized context and complete link population for AID-H-018.002, AID-H-018.003, and AID-H-018.006. This modeling step never returns allow or deny; missing lineage produces insufficient evidence and never authorizes the action.

Verify safely

A read-only identity that cannot alter the controlled asset must obtain independently verified workload and token evidence; validate the effective asset, policy, input, and scope versions or digests; then re-verify every receipt and nonce.

Open-source tools

Commercial / hosted tools

Threat mappings

MITRE ATLAS

MAESTRO

OWASP LLM Top 10 2026

OWASP ML Top 10 2023

OWASP Top 10 for Agentic Applications 2026

NIST Adversarial Machine Learning 2025

Cisco Integrated AI Security and Safety Framework

Google Secure AI Framework 2.0 - Risks

Databricks AI Security Framework 3.0

AID-M-009.003: Agent Identity, Delegation Lineage & Authorization Context | AIDEFEND

Loading interactive view…

AIDEFEND™

A Practical Knowledge Base for AI Security Defenses

Version

GitHub MCP Service