The 'agent' Uniform Resource Identifier (URI) Scheme and Cryptographic Attestation Protocol

Introduction

Problem Statement Autonomous software agents operating across distributed multi-cloud networks, model contexts, and tool environments require a unified, cryptographically secure identity layer. Existing network addressing schemes (HTTP URLs, gRPC endpoints) route traffic to server hosts, but fail to verify:

Whether the remote software process possesses a verified cryptographic key pair.
Whether the agent's domain identity matches DNS infrastructure ownership.
Whether active system prompts and tool capabilities have been tampered with.
Whether sub-agent tasks carry valid, scope-restricted delegation tokens.

Protocol Goals The Creduent protocol specifies the 'agent' URI scheme to establish a verifiable trust root for software agents. The protocol provides:

Deterministic resolution from 'agent://' URIs to signed identity documents.
Cryptographic key binding using Ed25519 digital signatures and JCS.
Domain-level ownership validation via DNS TXT records.
Attenuated capability delegation via Creduent Delegation Tokens (CDT).

Terminology and Conventions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Agent Identity: An Ed25519 public key pair uniquely bound to an autonomous agent.
agent.json: A JSON document canonicalized per RFC 8785 containing public keys, capabilities, and owner metadata.
Authority: The domain name or host portion of an 'agent' URI responsible for identity resolution.
Attestation: A cryptographically signed assertion issued by an authoritative registry validating DNS ownership.

URI Scheme Specification

ABNF Syntax Definition The 'agent' URI scheme is specified using Augmented Backus-Naur Form (ABNF) as defined in .

URI Normalization and Canonicalization Implementations MUST normalize 'agent' URIs prior to signature validation:

Scheme names MUST be converted to lowercase ("agent://").
Hostnames MUST be converted to lowercase per Internationalized Domain Names rules.
Default ports (if specified) MUST be removed.

Example URIs

Cryptographic Identity Document Format (agent.json)

Field Definitions The identity payload MUST contain the following top-level JSON fields:

version (string, REQUIRED): Protocol version identifier (e.g. "2.0").
agent_id (string, REQUIRED): The absolute 'agent://' URI of the agent.
name (string, REQUIRED): Human-readable name of the agent.
owner (string, REQUIRED): Contact URI or email of the controlling entity.
keys (array, REQUIRED): List of public key objects (id, type, publicKeyMultibase).
capabilities (array, OPTIONAL): List of declared tool and API permissions.
signature (object, REQUIRED): Signature envelope object (type, created, verificationMethod, proofValue).

JSON Canonicalization Scheme (JCS) Processing To generate or verify signatures, the document MUST be canonicalized using JCS :

Remove the "signature" key-value pair from the document.
Sort object keys lexicographically by Unicode code point values.
Serialize strings using UTF-8 encoding without whitespace between elements.
Represent numbers according to IEEE 754 double precision without trailing zeroes.

Ed25519 Signature Generation and Validation Signatures MUST be generated using Ed25519 over the UTF-8 bytes of the canonicalized JCS document:

Complete Example Document

Resolution and Verification Architecture

Resolution Algorithm When resolving an 'agent' URI (e.g. "agent://example.com/auditor"), clients MUST:

Construct HTTP Endpoint: Issue an HTTPS GET request to https://example.com/.well-known/agent.json
Parse and Validate Schema: Parse the JSON response and confirm all required fields.
Verify JCS Signature: Execute the signature validation steps in Section 4.3.
Perform DNS Ownership Check: Verify domain key records per Section 5.2.

DNS TXT Ownership Verification To prevent identity spoofing, the domain owner MUST publish a DNS TXT record at _creduent.<authority>. Clients MUST match the public key in the DNS TXT record against the public key used to sign the agent.json document.

Registry Attestation Verification Registries acting as third-party identity checkers issue signed attestations containing agent_id, DNS TXT verification status (PASS/FAIL), and expiration timestamps.

Delegation Tokens and Capability Attenuation (CDT)

Token Payload Format Parent agents delegating authority to child sub-agents MUST issue a Creduent Delegation Token (CDT / CREDUENT-007):

Recursive Delegation Chain Validation Verifying endpoints receiving a delegation chain MUST recursively validate Ed25519 signatures, capability subset constraints, and depth limit thresholds.

Prompt Integrity and Action Reversibility (CREDUENT-006)

Instruction Hashing Agents MAY publish an instruction hash in execution headers: X-Creduent-Instruction-Hash: SHA256(canonical_system_prompt)

Reversibility Classifications (AISVS C9.2.3) Actions MUST specify a reversibility classification aligned with OWASP AISVS C9.2.3: read-only, reversible, external-reversible, irreversible.

Ledger Hash-Chain Receipts Multi-step agent action chains MUST commit cryptographic step receipts to the registry ledger.

IANA Considerations

URI Scheme Registration Template The 'agent' URI scheme registration follows the guidelines defined in BCP 35 . Change controller: IETF / Creduent Protocol Working Group References: draft-kanojia-creduent-agent-uri-00 ]]>

Security Considerations

Threat Model The protocol protects against Identity Spoofing, Privilege Escalation, and Execution History Tampering.

Mitigation of Replay and Downgrade Attacks Verifying endpoints MUST reject attestations with expired timestamps. HTTP connections without TLS 1.3 MUST be refused.

Key Revocation and Out-of-Band Recovery In case of key compromise, domain owners MUST update the _creduent DNS TXT record with a new key hash. Registries MUST invalidate revoked public keys within 300 seconds.