Agent Identity (AIDs)

Overview

An Agent Identity Document (AID) is a W3C DID Document that serves as the root of trust for an AI agent. Every IDProva agent is identified by a did:idprova: DID with an associated document containing:

• Public keys for signature verification (Ed25519 + ML-DSA-65)
• Agent metadata — model, runtime, configuration hash, trust level
• Capabilities — what the agent declares it can do
• Controller — who is responsible for this agent

DID Syntax

did:idprova:<authority>:<agent-name>

Examples:

did:idprova:example.com:kai-lead-agent
did:idprova:techblaze.com.au:registry-agent
did:idprova:localhost:dev-agent-01

• Authority — The namespace owner. For domain-verified agents (L1+), this must be a domain the controller can prove ownership of via DNS TXT records.
• Agent name — Locally unique within the authority. Lowercase, alphanumeric with hyphens and underscores.

DID Document Structure

{
  "@context": [
    "https://www.w3.org/ns/did/v1",
    "https://w3id.org/security/suites/ed25519-2020/v1",
    "https://idprova.dev/v1"
  ],
  "id": "did:idprova:example.com:kai-lead-agent",
  "controller": "did:idprova:example.com:pratyush",
  "created": "2026-02-24T00:00:00Z",
  "verificationMethod": [
    {
      "id": "did:idprova:example.com:kai-lead-agent#key-ed25519-1",
      "type": "Ed25519VerificationKey2020",
      "controller": "did:idprova:example.com:kai-lead-agent",
      "publicKeyMultibase": "z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
    }
  ],
  "authentication": [
    "did:idprova:example.com:kai-lead-agent#key-ed25519-1"
  ],
  "service": [
    {
      "id": "#idprova-metadata",
      "type": "IDProvaAgentMetadata",
      "serviceEndpoint": {
        "name": "Kai Lead Agent",
        "model": "anthropic/claude-opus-4",
        "runtime": "openclaw/v2.1",
        "configAttestation": "blake3:a1b2c3d4...",
        "trustLevel": "L1",
        "capabilities": ["mcp:tool-call", "idprova:delegate"],
        "maxDelegationDepth": 3
      }
    }
  ]
}

Agent Metadata

The IDProvaAgentMetadata service extension carries agent-specific information:

Field	Required	Description
name	Yes	Human-readable name (max 128 chars)
description	No	Human-readable description (max 1024 chars)
model	No	AI model identifier (vendor/model-name)
runtime	No	Runtime platform (platform/version)
configAttestation	No	Hash of agent config (algorithm:hex-digest)
trustLevel	Yes	Current trust level: L0–L4
capabilities	No	Declared capability strings
maxDelegationDepth	No	Max delegation chain depth (default: 5)
parentAgent	No	DID of parent agent (for sub-agents)

Configuration Attestation

The configAttestation field enables configuration drift detection. It contains a hash of the agent’s active configuration:

configAttestation = "blake3:a1b2c3d4e5f67890..."

If an agent’s configuration changes (different system prompt, new tools, updated model), the hash changes. Verifiers can detect this and make trust decisions accordingly.

CRUD Operations

Create

1. Generate Ed25519 keypair (+ ML-DSA-65 recommended)
2. Construct DID Document
3. Controller signs the proof field
4. Register with a registry or publish at .well-known endpoint

Resolve

Resolution follows a layered strategy:

1. Local cache (respecting TTL)
2. Well-known endpoint — https://{authority}/.well-known/did/idprova/{agent-name}/did.json
3. Registry lookup — GET /v1/identities/{did}
4. Universal resolver (fallback)

Update

1. Retrieve current document
2. Modify fields, increment updated timestamp
3. Controller signs new proof
4. Submit to registry

Key Rotation: Add new key first (signed by old key), then remove old key (signed by new key). This ensures continuity of control.

Deactivate

Set deactivated: true, remove all keys and services. Deactivated DIDs must not be used for authentication or delegation.

Next Steps

• Delegation (DATs) — How authority flows from principals to agents
• Trust Levels — Progressive trust from L0 to L4
• AID Protocol Specification — Full technical reference