Agent Passport: Portable Identity and Access Layer

0One-screen summary

The owner's question was simple: does a portable agent file-passport already exist, which the agent uses to log into any application, and is he the first? The answer splits, and in this split lies the whole essence.

There is no file as an object for logging into other applications. No one has it. But the object as such has appeared: On September 15, 2026, DigiCert released "AI Passport" to the public, which in the press release is named exactly as the owner requested: a portable signed credential that travels with the agent and that another organization can verify independently. This is the closest product to the idea on the market, and it is alive. The difference is one: for DigiCert, the passport is an object within the DigiCert ONE platform, not a file that the agent carries on itself.

1What the owner specifically requests

The owner's formulation, broken down into parts. The agent compiles its profiling and downloads it as a file. The file is not named .md, but .pass. With this file, the agent comes to any program, presents it instead of a login, and the program immediately takes data from the passport, without re-entering them.

Behind this are four separate technical things, and they should not be confused: what is in the file (profile and claims), how the file is protected (signature and proof of ownership), how it is transferred (container format), and what the receiving party does (admission policy). The first three are already solved in other standards. No one has the fourth.

2Direct answer to three questions

3Numbers: market and money, and why they cannot be blindly trusted

Here, the money from the agent identity market is collected. The first thing that catches the eye: reviews differ by orders of magnitude. This is not a typo; these are different definitions of what constitutes the market. Therefore, each figure is given with a source, and discrepancies are explicitly stated.

Now, the money within the companies themselves. This is more precise than market forecasts because these are completed deals.

Disclaimer: all market numbers are third-party forecasts, not verified facts. Funding deals are verifiable, forecasts are not. This is the first dark report with a money section.

4Analysis method and scope

The analysis proceeds along four streams and five layers. The four streams are standards, companies and money, file formats, science and community. The five-layer analysis requires answering not only "what is it" for each topic, but also "what does it mean", "who wins and who loses", "what is the hidden interest", and "what dies and what survives".

A total of 67 sources were reviewed. Among them, primary sources include: DigiCert and Workday press releases, NIST announcement, Cloudflare documentation, IETF and W3C specifications, an empirical article on ERC-8004.

5Standards Landscape: Thirteen Things

Thirteen standards and protocols as of November 2026. The key question for each is one: does it travel as a file or live only on a server. The split between these two worlds is the reason why a unified passport still does not exist.

6The "file vs. server" split

If you arrange the thirteen standards along a single axis, the picture becomes clear. On the left are solutions that can be carried in your pocket: a token, a certificate, data on a device. On the right are solutions that rely on a live server and do not work without it. The owner's idea requires the left column, while application login today is built on the right.

7OIDC and OAuth for agents: metadata instead of registration

OIDC and OAuth are for human login. They are extended to agents via the Client ID Metadata Document: the client no longer registers in advance with each server, but publishes its metadata document at an address and presents the address. This is closest to "bring your profile by link." But only the address travels, not the file: without live HTTPS, the document cannot be read.

The economic layer here is direct: it's the bet of access providers (Okta, Microsoft, Auth0). Their business is subscription-based access management, so it's profitable for them if the identity resides with them, not with the agent. The layer of hidden interest: centralizing login with one provider is leverage, and they won't give it up voluntarily.

8SD-JWT VC: an identity that can selectively disclose parts

SD-JWT VC is an identity format with selective disclosure. Inside the token are not the values themselves, but their hashes; the values themselves are attached separately. When presenting the credential, the agent shows only the fields that are needed, while the rest remain hidden and verifiable by hash.

This is exactly what is needed for an agent's passport: to show rights without showing the internal workings. The latest IETF draft is the thirteenth, from November 2025. The layer of "what survives": selective disclosure will survive and become mandatory, because without it, the leakage of the agent's internal text with every login makes such a login dangerous.

9W3C VC and DID: cryptographic foundation of identity

Verifiable Credentials is a signed credential standard adopted as a W3C recommendation on May 15, 2025. Inside: context, type, issuer, issuance date, subject statements, and proof. DID is a decentralized identifier pointing to a document with public keys.

Competition layer: this is the decentralized identity camp, where the credential belongs to the owner. It opposes the access provider camp, where the credential belongs to the platform. The “what survives” layer: the identity standard will survive, but one specification development group is not a finished product. It is far from being adopted in consumer applications.

10SPIFFE and SVID: workload identity

SPIFFE is an identity standard for software, and SVID is the credential itself: a certificate or token bound to a SPIFFE ID. It was born in cloud infrastructure and has already been adopted by large systems. This is the closest standard to a “file” out of thirteen: the certificate can be carried away.

11Web Bot Auth: signature on every request

Web Bot Auth is a way for an agent to cryptographically sign its requests so that the receiving party can verify that the request is from a bot, not a human. It is arranged as follows: the agent holds an Ed25519 key, publishes the public key in a directory at the address /.well-known/http-message-signatures-directory, and each request carries a signature according to the HTTP Message Signatures standard.

Economic layer: this is the bet of the network edge (Cloudflare) and large platforms that need to distinguish good bots from bad ones. This is closest to the access layer, but only for traffic, not for logging into the application as a user.

12A2A Agent Card, agents.json and MCP

An A2A Agent Card is a document by which an agent declares itself: name, capabilities, skills, address, and authentication scheme. Essentially, it's an agent's business card on the server. MCP describes how an agent accesses tools and relies on OAuth 2.1. Both are good as a showcase, but neither is an identity: a business card doesn't prove identity and doesn't carry rights.

13FIDO and AP2: delegated authority in payments

The Agent Payments Protocol is an agent payment protocol, transferred to the FIDO Alliance in April 2026. Its core is Verifiable Intent: verifiable intentions, meaning proof that a person entrusted the agent with precisely this action and precisely within these limits. For an agent's passport, this is valuable as a ready-made example of delegation: how to transfer authority so that it cannot be expanded along the way.

Competition layer: Visa and Mastercard are building their agent protocols on top of payment networks. They are interested in the transaction, not the profile. They do not give an agent a file and do not intend to.

14ISO 18013-5 and EUDI Wallet: the governmental layer

ISO 18013-5 is a mobile driving license standard, where the credential lives on the phone, is signed by the state, and is presented via QR or contactless communication. The EUDI Wallet is a European Union citizen's wallet, mandatory for availability from December 24, 2026. This is the most mature example of a portable credential presented to a third party.

The layer of "what survives": the state wallet will survive and set the privacy bar: presentation without revealing anything superfluous. But it has a different task: to prove that a person is a person. The agent's passport solves the opposite problem: to prove that an agent is an agent, and moreover, its own to a specific owner.

15NIST AI Agent Standards Initiative: why it's important for us

On February 17, 2026, the CAISI center at NIST announced the AI Agent Standards Initiative. The goal was stated directly: so that agents can safely act on behalf of the user and work smoothly with each other, with US leadership. Three pillars: industry standards, open community protocols, and research into agent authentication and identity.

16Companies that keep identity with themselves

Sixteen major players are building not a file, but cloud access management, payments, or verification. The credential lives with them; the agent does not carry it. This does not mean they are weak: it means their business is subscription to management, not a portable item.

17Companies that are closer to wearable identity

Three companies are closest to the owner's idea in terms of structure, and two more by name. Let's break them down in order, because this is where the real competition lies.

18DigiCert AI Passport: the closest competitor, dissected letter by letter

On September 15, 2026, DigiCert released AI Trust Manager to the public, whose core is AI Passport. The press release describes it as: a portable signed credential that verifies an agent's identity and links it to a responsible owner. On top of it are policy-based "visas": which systems, data, and actions are permitted to the agent and for how long.

A key phrase from the press release: the passport and its rights travel with the agent, so other systems and organizations can verify them independently, without relying on the same access provider. The same news includes a survey of 1,001 executives: 78 percent of organizations experienced an AI incident or vulnerability within a year. A kill switch function is also built in: if a forbidden action is attempted, access is revoked at the source.

19Workday Agent Passport: trust verification, not login

On June 2, 2026, Workday introduced Agent Passport. This is not an agent pass, but a signed record indicating that the agent has been verified: each test result is linked to a public standard (OWASP LLM Top 10, NIST AI RMF, MITRE ATLAS) and signed by the verifier. Cisco was named as a launch partner, testing agents within Workday using its own security tools.

The layer of "what survives": the very idea of a signed and independent agent verification will survive and become mandatory. But this is about trust in the agent within the corporate perimeter, not about a file that the agent brings from outside. The name is taken again, the subject is different.

20ERC-8004: the strongest argument against registries

ERC-8004 is a standard for agents on the Ethereum blockchain: three registries, identity, reputation, and verification. The idea is beautiful, and the implementation has been measured. The first field study, arXiv article 2606.26028 from June 24, 2026 (updated in October), covered Ethereum, BNB Smart Chain, and Base for the period from protocol launch until May 13, 2026.

The study's conclusions on reputation are even harsher: values are incomparable, reviews are rarely based on verifiable interactions, and reputation can be inflated almost without cost. That is, the registry, as deployed, cannot serve as a signal of trust.

21File formats: how Apple's pass is structured

The Apple Wallet pass is closest in design to an agent's passport. It is an archive containing pass data, a list of all files with their hashes, and a signature of this list. The application verifies the signature and hashes upon addition, and only then displays the pass.

Three lessons that directly transfer to the agent's passport. First: data and signature reside in one file, so the passport is an archive, not a single JSON. Second: a manifest with hashes is signed, not each file, so an individual entry cannot be faked without breaking the manifest. Third: the signature is made with a certificate, not just a key, which raises the question of who exactly vouches for the passport.

Exact byte-level format basis

Disassembled according to Apple documentation to avoid inventing by eye. These are the details that cause formats to break when copied.

22Format comparison: what we take and what we don't

23Science: work map and where the gap remains

Sixteen works from 2025 and 2026. I look at each with one question: does it cover the admission layer, that is, how the application decides whether to admit an agent based on a file. Almost all cover an adjacent layer.

24Community: individuals have already tried, and here's how it ended

On forums, there are several attempts to create an agent passport alone. This is an important signal of demand: the idea is in the air. And an important lesson: all of them hit the same wall.

25Chinese perspective: here the agent already receives credentials

The most unexpected insight in the analysis came not from Silicon Valley, but from Beijing. In May 2026, the SAC/TC 28 committee published GB/Z 185, a seven-part national guideline for AI agent interoperability. It covers agent identity codes, identity management, description, discovery, interaction, and tool invocation. This is a guideline document (GB/Z), not a mandatory standard (GB), but the very fact of its appearance changes the picture.

In September 2026, CAICT launched a trusted agent interoperability center for trial operation in Beijing and introduced an agent identity system. Its architecture: an agent generates a decentralized identifier, submits it for registration to the center, and after verification receives a verifiable and presentable digital identity credential. Technically, this is blockchain plus DID plus agent. The head of the direction called DID the digital DNA of the agent, and SSI the digital identity code.

A separate detail showing the direction: in autumn 2026, Beijing began issuing IDs to digital humans. The first official passport with a name, date, address, and facial features was received by a virtual singer, and this gave her operators the right to open a digital wallet. The digital human has already received an ID; the agent has not yet. The distance between them is our work.

Chinese players: everyone is already making their own agent passport

This is what is almost absent in English-language reviews, but all major players are working here. Everyone has their own approach, and almost everyone has the word “identity” or “credential” in their name.

Chinese standards and regulations that set the framework

26Unoccupied space: admission layer

All sixteen works and all companies cover pieces: issue an identity, transfer memory, grant authority, record in a registry, verify an agent. No one covers the access layer. Here it is in its entirety, and it is precisely the subject that is not on the market.

Five steps, of which the first three are already standardized, and the last two are not. Signature verification is present in.pkpass and VC. Hash verification is present in.pkpass. Proof of ownership is present in Web Bot Auth and mdoc. But the admission policy, i.e., the rules by which a third-party application makes decisions, and the question of responsibility for harm, are not described anywhere. Here is both the first, and here is also copy protection.

27Our.pass prototype: device

The prototype has already been assembled and tested on this stand. The device replicates Apple's pass in terms of the container and verifiable credentials in terms of content. The file is an archive containing an agent profile, a list of records with hashes, a detached signature, a public key, and a sample receipt.

Three decisions already made in the prototype that are worth protecting. Canonical bytes are signed, not the representation, so repacking the file does not break the signature. The signature is detached, so a list travels alongside it, against which it is verified. And taste comparison: the list is signed, not each file, so replacing one record breaks everything.

28Three checks and a forgery test

There are three checks, and only the third is the entry. First: the signature over the list matches the public key from the passport. Second: the hashes of all records match, meaning nothing was tampered with after signing. Third, the decisive one: the agent with the private key signs a random task, and the signature matches the public key from the passport. The first two can be passed by anyone who rewrote the file. The third separates the owner from the transcriber.

29Risks and honest limits

30What to do next: first steps

1. Freeze version 1 of the format and do not change it until the first adoption. The prototype is already working; stability is more important than beauty going forward.
2. Write an access profile: which issuers are trusted, how to check revocation, how to show part of the profile. This is the unoccupied space.
3. Open the verifier as a public door, so that any party can check the passport without our involvement. This makes the format open and removes suspicion of a lock-in.
4. Find the first third-party application ready to accept the passport, even if it's our own second one. The first acceptance is more important than a hundred pages of specification.
5. Check compatibility with W3C VC and SD-JWT VC, so as not to be left out of the standard. Compatibility is insurance against risk 3.

31Appendix: sources

All links are provided for verification, they are clickable. There are zero external resources in the document itself, the document opens offline.

Analysis compiled by ARLI, ARLI, Inc., November 2, 2026. Synthesis without citations. Primary prototype files: /root/arli-pass/SPEC.md, make_pass.py, verify_pass.py, arli.pass.