Quilzomanual

AI agent identity: sponsors, principals and signed receipts

Every agent is a principal of its own, a person answers for it, and every run can be proved to somebody who does not trust you.

In the adminAgents

Each agent is a principal, agent/NAME. What it writes is authored by that name, the audit log records it as the actor, and the access policy can grant it a role like anybody else. A sponsor is the person who answers for it: told when it misbehaves, and without whom it stops.

  1. Name the person who answers for it

    quilzo agent sponsor returns-editor dana
    returns-editor is answered for by dana until 6 January 2027

    The sponsor must be somebody who can act in this installation. An identity lasts 90 days unless you say otherwise, and a year at most.

  2. See who answers for what

    The Answered for by column on Administration › Agents shows each sponsor and when the identity ends. An agent nobody answers for is marked nobody, with the command that fixes it.

    The agents table: returns-editor is answered for by dana until 6 January 2027; help-desk is answered for by nobody
    One agent with a sponsor, and one without.

  3. Renew it before it ends

    quilzo agent renew returns-editor --for 2160h

    Most agents nobody looks after are agents nobody needs. Renewal is when somebody decides which.

When an agent stops

What happenedWhat the agent does
Its sponsor's access ended, or the identity provider suspended or removed themDoes not run, and the Agents screen says the sponsor can no longer act here.
Its identity reached its end dateDoes not run until somebody renews it.
It was never given a sponsorRuns, and the security posture reports it (agent.no-sponsor) until somebody answers for it.
The shield paused itDoes not run until the pause ends or is lifted.

Evaluations still run in every case. They change nothing, and they are how a new sponsor finds out what they are taking on. Because the sponsor is checked against the same access the identity provider manages, deprovisioning a person through SCIM also stops the agents they answer for.

Prove what a run did

A receipt is every record of one run, taken from the hash-chained audit log, each with a proof that it is in the log, and a log head signed with Ed25519 and ML-DSA. Somebody holding only the receipt and your public keys can check it without access to your installation.

  1. Write the receipt

    quilzo agent receipt RUN -o receipt.json
    6 records of run run-20261008-f8cd3989, each with its proof, against a head of 52 signed by 0e667cb95d838091

  2. Publish your public keys

    The head's public keys are in head.pub.json, beside the audit log in the store. Put them somewhere the people who will check your receipts can fetch them independently, such as your own website.

  3. Check it anywhere

    quilzo agent verify-receipt receipt.json --keys head.pub.json
    verified  6 records of run run-20261008-f8cd3989 by returns-editor, steps [1 2 3 4]
  each is in the log under a head signed by 0e667cb95d838091

    Without --keys, the receipt is checked against the keys it carries, which proves only that it agrees with itself. Checking against keys you were given proves it came from that log.

A receipt includes what the run was asked, what it did, what it was refused, what it cost, whether it finished, and the memory it recalled and kept. Refusals are part of the outcome: a run that tried to publish four times and was stopped is a different product from one that did the work, and somebody paying per outcome is entitled to know which they got.

The same kind of receipt exists for an app's calls through one connection (quilzo apps receipt) and for what was forgotten about a person (quilzo memory receipt).

Give another vendor's agent a credential

An agent built elsewhere, such as Claude Code, Codex or a team's own program, can use one of your browser grants with a signed credential in place of a person's token. The credential is a W3C Verifiable Credential, signed with your store's own issuer key, naming the agent, its sponsor, the one grant, whether it may act or only read, and the agent's own public key. Without that key, a copy of the credential is worthless.

  1. Issue it

    The agent must be declared here and have a sponsor who can still act. Give its public key as a did:key, or let Quilzo make one and hand the key to the agent:

    quilzo agent credential issue buyer --grant browser:shop --act --holder did:key:z6Mk… --for 24h

    A credential lasts at most 30 days and never beyond the agent's next renewal.

  2. Present it

    The agent sends the credential as Authorization: Bearer … to /mcp/browser/NAME, with an Agent-Proof header on every request: a JWS signed by its key that names the method, the address, the time, a one-time identifier and the credential. Each proof is accepted once, within a minute.

  3. Check or withdraw it

    quilzo agent credential list
quilzo agent credential verify buyer.cred
quilzo agent credential revoke urn:uuid:…

    The issuer's public keys are published at /.well-known/agent-credentials.json on the admin, so anyone can check a credential with their own tools.

The agent acts within its sponsor's authority, on the one grant it carries. Everything it does is recorded under the agent's name on the sponsor's behalf, and a press that commits to something waits for a person, exactly as with a token.

Grant an agent a role

Because an agent is a principal, the access policy can bound it whoever starts it:

quilzo auth grant agent/returns-editor author --on /help

A run is then limited by three things at once: the declaration, the agent's own role, and the person who started it. See People and access.

Next