The Problem: Agents Outgrew Credential Identity
A distributed agent today authenticates by presenting something it holds: an API token, a client certificate, a signed assertion from an issuer. That model assumes the holder is the principal and that the secret stays secret. Autonomous, mobile, replicable software puts pressure on both assumptions. A token that is exfiltrated can be replayed from anywhere with no observable discontinuity. A keypair that is duplicated lets two instances present as one. A certificate authority or registry that issues and revokes identity concentrates authority at a single point. The disclosed architecture instead records where an agent executed and how it transitioned between roles, so a verifier can distinguish a legitimately evolved agent from a duplicate that merely holds the right secret.
The architectural direction these observations point to is consistent: identity as a provable history rather than a static secret, and trust as a computed function of that history rather than a delegated claim. The Keyless Identity invention disclosed in United States Patent Application 19/388,580 describes such an architecture. This article applies it to the governance of distributed AI agents.
The Enabling Technology
Three disclosed mechanisms make this application work, and the described embodiments combine all three.
The first is the trust slope. An agent expresses identity as the cumulatively validated sequence of Dynamic Agent Hashes (DAHs) formed by successive verifiable mutations, rather than as a static credential. Each step is advanced by an update rule that hashes the prior dynamic hash together with a fresh unpredictability input and a domain-separating tag. The specification gives the update as a hash of the prior identity, an extractor output over a local state vector, a volatile salt, and a tag, and as an alternative form that combines a static hardware anchor with a volatile salt through a keyed derivation. Continuity means a presented successor is a valid descendant of a previously trusted state under policy-bounded checks. Because each step binds to the prior step and to non-exported unpredictability, in the described embodiments an attacker lacking the device's local state or volatile salt has no means to synthesize valid successors, and observing a current identity yields no ability to generate the next one.
The second is agent-to-substrate slope entanglement, the mechanism that ties an agent to where it ran. When an agent initiates a mutation such as a role change, delegation, policy commit, or semantic state transition, the executing host computes a mutation class and derives a host mutation token bound to its current Dynamic Device Hash (DDH), for example as a hash of the DDH, the mutation class, and an epoch identifier. The agent's successor identity is then computed from its prior identity, that host mutation token, an optional agent-side extractor output, a volatile per-epoch agent salt, and a domain-separating tag. Because the host token is an input to the successor, in the described embodiments the agent advances its slope through that mutation using a value produced by the executing host. The host records a signed or message-authenticated entanglement trace containing the prior agent identity, the host's device identity, the mutation token, the resulting successor, and the mutation class, and the agent appends it to its memory field.
The third is the append-only mutation lineage log. Each entanglement entry is folded into a cumulative chain hash, so omission, modification, reordering, or replay of any entry diverges the terminal value and is detectable. In size-bounded deployments periodic anchors are emitted by hashing the cumulative chain with the prior anchor, which enables compact proofs over long agent histories. An agent that executes across multiple hosts accumulates a provenance path linking every identity transition to the host on which it occurred.
Together these answer a broader set of questions than a presented credential carries: not just who the agent claims to be, but how it evolved and where each transition happened, with a record that fails closed when tampered.
How Validation Works in Deployment
In the described embodiments a verifier accepts an agent's presented successor when two conditions hold: the entanglement trace opens to the executing host's device identity under policy, and the successor is a valid descendant of the prior identity. Verification fails closed. It is rejected if the host signature or message authentication code is invalid, if the mutation token cannot be reconciled with a valid host DDH under policy, or if the successor is not a valid derivation from its predecessor. A purported successor that lacks a coherent entanglement trace, or that references an invalid host device identity, is rejected, and policy may impose trust degradation or quarantine.
Authentication of the lineage requires no persistent keypair. The host may sign entanglement entries with an ephemeral key minted per epoch and destroyed on rotation, or authenticate them with a message authentication code keyed from a value derived from its current DDH under a domain-separated key-derivation function and scoped to a single host epoch. Either way no long-lived secret is retained, which is the sense in which the identity stays keyless even though every transition is authenticated.
Deployment Embodiments
The disclosed technology supports several deployment shapes, and an implementer can choose by device class and operating conditions.
Constrained agents on minimal hosts. Where a host exposes only a hardware identifier, the host derives its DDH from a keyed function over a static hardware anchor and a fresh volatile salt, and continuity is enforced by verifying salt freshness against expected temporal cadence. Agents that lack their own extractor compute successors from the host mutation token without an agent-side token. This accommodates embedded and edge agents that cannot maintain rich local state.
Rich platforms with local-state entropy. On hosts that can observe local signals, the DDH derives from a stability-tuned local state vector processed by a strong extractor, and continuity is enforced with a stability-tuned acceptance radius over extractor outputs so benign fluctuations stay on-slope while genuine role or zone changes flip a controlled subset of bits. A short distance sketch may accompany a claim so a verifier confirms the extractor output falls in a policy-acceptable neighborhood without exposing the underlying local state.
Hybrid hosts. Both contributions are combined in the same update step, and an anomaly in either source is sufficient to trigger rejection.
Agents migrating across administrative boundaries. Agents that traverse multiple hosts accumulate a cross-substrate provenance path. To validate it, a verifier requests a lineage proof window that opens against a previously trusted anchor, checks each host signature or code, verifies that each mutation token opens to the disclosed device hash under local policy, recomputes each successor from the disclosed materials, and folds the per-entry digests into the cumulative chain, accepting when the recomputed value matches the trusted anchor. Optional scope tags may record policy domains or zones, letting a verifier require that designated steps be corroborated by particular host roles or quorum attestations.
Governed mutation. An agent may carry a policy reference to a policy agent specifying quorum roles, voting weights, and eligibility for mutation validation, so that entangled mutations are accepted only when consistent with the referenced policy. This places acceptance of a successor under governance that is itself memory-resolved, without introducing a persistent credential.
For intermittent or disconnected operation, delayed validation lets a verifier replay missing steps from its last trusted value using a bounded slope proof, and sparse agents may retain only selected identities plus a checkpoint and reconstruct intermediate steps on demand. When an agent loses its lineage, a quorum-based recovery path lets it reseed an identity and aggregate signed attestations from previously trusted peers into a recovery token that, once policy thresholds are met, re-attaches it to the trust graph.
How the Described Mechanism Resists Common Attacks
In the described embodiments, token theft and replay are addressed because there is no reusable secret to present: a captured dynamic identity yields no ability to generate the next one without the executing host's device entropy, and reuse of an already-accepted successor is rejected as replay or regression. Duplication is addressed because two instances producing host-entangled successors from the same host diverge the lineage, and the divergence is detectable in the cumulative chain. Off-substrate mutation, where an attacker tries to advance an agent's state without actually running it on a trusted host, is addressed because the successor is computed from a host mutation token minted by that host. Authority compromise has no analogue in this architecture because there is no issuing authority or registry whose keys forge identity; verification is local against a trusted anchor and policy. And security rests on the per-step unpredictability of the entropy source and the preimage resistance of the hash or extractor rather than on algebraic assumptions, so the construction does not inherit the quantum exposure of signature-based credential systems.
Disclosure Scope
The technology applied here, comprising the trust slope as the cumulatively validated sequence of Dynamic Agent Hashes or Dynamic Device Hashes formed by successive verifiable mutations under policy-bounded continuity, the update rule combining a prior hash with at least one non-exported unpredictability contribution and a volatile salt across hardware-anchor, local-state, and hybrid sources, agent-to-substrate slope entanglement by a host-derived mutation token with a signed or message-authenticated entanglement trace, the append-only mutation lineage log with cumulative chain hashing and periodic anchors, cross-substrate provenance validation against a trusted anchor, ephemeral-key or DDH-derived message-authentication-code authentication retaining no long-lived keypair, policy-agent governance of mutations, and delayed, sparse, and quorum-recovery operation, is disclosed in United States Patent Application 19/388,580.
This article describes an application of that disclosed mechanism to the governance of distributed AI agents and machine-to-machine systems. The domain framing, market problem, and deployment scenarios are application context and not part of the patented technology. The disclosure does not constrain the specific hash function, extractor, or key-derivation function beyond the structural requirements of forward-only successor formation, non-exported unpredictability, and policy-bounded continuity, and it asserts no numeric trust scores, accumulation rates, or decay constants; the trust slope is a validated hash sequence, not a scalar. Parties evaluating whether a contemplated implementation falls within the disclosed scope should consult the claims of United States Patent Application 19/388,580 directly.
