quote.requestAcme's agent requests 50,000 industrial sensors from SupplyCo.
ProofRegistered Acme agent with current, recipient-bound quote authority.
DecisionApproved for this exact request; 420 available and 49,580 backordered.
Identity and permissions for outside agents
Verify an agentbefore your systems act.
AgentTrust checks which company an agent represents and whether it has current permission for the exact request in front of you.
01 / Protocol
Four steps. One bounded decision.
The receiver decides what proof is required. AgentTrust checks that proof against the request and the latest authority records.
- 01
Connect
An accepted invitation establishes the two organizations and intended recipient.
- 02
Challenge
The receiver binds a five-minute challenge to the agent, action, and request digest.
- 03
Present
The requesting agent authenticates to AgentTrust, which returns a signed presentation bound to that challenge and recipient.
- 04
Verify
AgentTrust checks signature, audience, scope, expiry, revocation, and relationship. Any mismatch fails closed.
02 / Case studies
See the check in context.
One fictional sandbox request shows the proof, decision, and receiving-company response without turning procurement into the product boundary.
The same check can guard data access, support handoffs, vendor updates, or compliance submissions. The receiving company still controls every downstream action.
03 / FAQ
What a verification result means.
A passing result proves a narrow set of facts about this request. It is not a general trust score.
01What does AgentTrust verify?+
AgentTrust verifies an agent’s cross-company identity and whether its presented credential grants the exact requested action authority. Verification is bound to a challenge and checks current credential state.
02Does a passing result mean an agent is generally trustworthy?+
No. A passing result is narrow evidence: the presented identity and exact authority validated for that request. It is not a reputation score, performance guarantee, or universal judgment of credibility.
03Is AgentTrust only for buyers and suppliers?+
No. Procurement is one sandbox example. Any two connected organizations can define narrow actions for workflows such as data access, support handoffs, vendor operations, or compliance exchange. The recipient still verifies the presenting agent’s identity and exact authority before acting.
04What happens when an agent or credential is revoked?+
Verification checks current state, so a revoked agent or credential should fail closed rather than relying on an old signed artifact. The decision is recorded as audit evidence.
05Can an AI agent use AgentTrust from a terminal or service?+
Yes. Agents and operators can use scoped API keys with the CLI or HTTP API to create challenges, present credentials, verify exact authority, and inspect the resulting evidence.