Agent Passport
Every AI agent deserves a passport.
Agent Passport is a cryptographically signed security certificate per agent — a real-time summary of its security posture, tool permissions, and compliance status. Shareable via URL. Embeddable anywhere.
The trust layer for enterprise AI
Stop explaining why your agents are secure. Show it.
AI agents connect to dozens of tools, process sensitive data, and act autonomously. Before one touches production, your security team needs answers. Agent Passport gives them a single verifiable URL.
Verifiable certificate per agent
Ed25519 signed. Independently verifiable by anyone.
Every agent gets a cryptographically signed passport — a tamper-evident record of its security posture, tool permissions, and compliance status. Anyone can verify authenticity without trusting your infrastructure.
- →Ed25519 asymmetric signing — keys managed by ShieldAgent
- →Tool allowlist and blocklist, versioned and signed
- →Compliance framework coverage: SOC 2
- →Public URL — share with clients, partners, regulators
- →Issued automatically within minutes of first activity
Risk score, four tiers, no ambiguity
0–100. Weighted. Updated continuously.
A risk score combines security events, compliance gaps, integrity checks, and operational health. Risk enforcement is off by default; effective tier, overrides, grace period, and shadow mode determine any added risk controls. Configured tenant limits and other proxy controls still apply.
- →Normal (0–59): no extra risk-tier restriction; tenant limits still apply
- →Elevated (60–79): an effective tier can reduce the tenant limit when enabled
- →High (80–89): an allowed risk decision can set shadow mode for subsequent audit; earlier rate-limit denials still apply
- →Critical (90–100): non-allowlisted methods block only in enforce mode
- →7-day lookback, recent events weighted more heavily
Embeddable badges and CISO review
One line of HTML. Real-time status. Any surface.
Drop an SVG badge into a GitHub README, vendor portal, or marketplace listing. For internal review: share the internal passport URL with your CISO before an agent goes live — tools, risk posture, and compliance status in one place.
- →SVG badge — live status, scales to any size
- →Internal passport URL for security team approval
- →CISOs see tools, risk score, blocking history, and compliance evidence
- →No system access needed — just a URL
- →Public badges link to the full public passport page
Continuous risk assessment
Four tiers. No ambiguity.
Score formula: 40% security events · 25% compliance gaps · 20% integrity · 15% operational health. Updated continuously with a 7-day lookback.
Configured tenant rate limits and other proxy controls still apply.
When enabled and effective after overrides and grace, Elevated reduces the configured tenant limit. Existing shadow mode observes over-limit checks without blocking.
When risk enforcement is enabled, the effective tier is High after overrides, and no grace period is active, the earlier limiter applies the High multiplier. After an allowed High risk decision, the stage can set shadow mode for subsequent audit; earlier enforced rate-limit denials still apply.
When enabled and effective, non-allowlisted methods block in enforce mode. Shadow mode records would-block decisions; allowlisted lifecycle methods remain subject to other controls.
Configured tenant rate limits and other proxy controls still apply.
When enabled and effective after overrides and grace, Elevated reduces the configured tenant limit. Existing shadow mode observes over-limit checks without blocking.
When risk enforcement is enabled, the effective tier is High after overrides, and no grace period is active, the earlier limiter applies the High multiplier. After an allowed High risk decision, the stage can set shadow mode for subsequent audit; earlier enforced rate-limit denials still apply.
When enabled and effective, non-allowlisted methods block in enforce mode. Shadow mode records would-block decisions; allowlisted lifecycle methods remain subject to other controls.
Enforcement actions are applied automatically by the ShieldAgent proxy. Full scoring methodology →
Give your agents a passport today.
Passports are issued automatically once ShieldAgent is monitoring an agent. No extra configuration.