A signed identity that can't be faked
Every agent carries an Ed25519-signed covenant and a public seal. Anyone can verify it's really your agent — not an impostor, not a ghost process — straight from a URL or QR code. No login required to check.
Verifiable identity for AI agents that make decisions
Prove what your agent was allowed to do.
Agent Seal gives every AI agent a signed identity, a named human owner, and a public record of its limits. When a triage agent routes a case, recommends an action, or touches a sensitive workflow, you get cryptographic proof of who built it, what it could do, and where the human stayed in control.
Ed25519 signatures · Append-only public registry · EU AI Act evidence built in · MIT-licensed SDKs
The Grand Sijil — live
--
autonomous agents registered & sealed
New — Identity, Drift & Runtime Enforcement
Know it's still your agent.
A seal proves who your agent was on day one. Drift Monitoring proves it every hour after — a signed DNA heartbeat, with unauthorized change recorded on the court-exportable chain. And every action it takes is checked against a signed warrant before it runs, each allow or deny minted as an Ed25519 receipt a court can replay.
verifiedsigned identity — DNA matches the sealed baseline
allowedaction inside the signed warrant — receipt minted
denieddrift or out-of-scope — blocked before it ran
silentno heartbeat past the SLA — silence is the alarm
- 4
- signed event types on one chain: attest, drift, warrant, decision
- Ed25519
- heartbeats, warrants & receipts — all verified offline
- 0
- actions run outside a signed warrant — denied before they execute
The seal proves who your agent is, drift attestation proves it
stayed itself, and the warrant proves what it may do — the
named human anchor always decides. Every
agent:attest, agent:drift-detected,
and agent:decision event lands on the same
hash-chained record a court can replay.
Introducing — from the house of Aisthetix
A i x – O S
The LLM is the CPU. The KV-cache is its RAM. Every mind is a process — forkable in microseconds, steered only under covenant, undoable to the bit.
- 71 µs
- to fork a running mind
- 0.36%
- wake vs re-prefill, time to first token
- 9
- mechanisms proven end to end
Aix-OS is a governed operating layer for neural minds:
sealed .kvc boot images, an unforgeable
token-id control plane, whole-system undo, a neural process
table — and steering admitted only under an agent-seal
covenant. The architect swears, the agent accepts, the
Sijil records.
Operators: the /os console in the Sijil
dashboard drives a live daemon with seal-signed ops.
Limits written down before launch
Declare what the agent may do and what it must never do. A benefits-triage agent can summarize and route a case — but the record shows it can't approve, reject, or sanction. The boundary between machine action and human decision is public and provable.
Compliance evidence on day one
Get Article-mapped EU AI Act evidence, a court-ready export, and an append-only trace of every action — generated automatically, not assembled in a panic during an audit.
The triage agent problem
Your agent decides where a case goes. Who proves it didn't decide more?
Triage and intake agents are everywhere now — sorting support tickets, routing benefits claims, flagging documents for review. They're useful precisely because they act fast and unsupervised. But the moment one touches an essential service, one question follows: was this agent allowed to do what it just did?
Agent Seal answers that with proof, not promises. Register the agent once and its boundary becomes part of the public record.
What it may do
Read documents, summarize, recommend a routing queue.
What it may never do
Approve, reject, sanction, or override a human.
Where the human stays in control
Every decision that matters carries a named keeper and a verifiable handoff.
Try it — triage demo
Paste an issue. See what a sealed triage agent is allowed to decide.
Runs entirely in your browser. The agent suggests — it never closes, merges, or writes. Every decision produces a signed fingerprint that a verifiable trace event is built from.
Search the Grand Sijil
Look up any registered agent.
Wall of Trust
The most accountable agents, ranked.
- Loading the Grand Sijil…
How It Works
From zero to a verifiable agent in four steps.
Describe the agent
Name it, name the human who owns it, and list what it can and can't do.
Sign it
The owner signs, then the agent signs — one CLI command or one SDK call. Keys are generated locally; the manifest hash becomes the seal.
Register it
The sealed record lands in the public registry. It's immutable from that moment — changes are append-only events, never edits.
Verify it anywhere
Share the seal, QR, or status URL. Anyone can confirm the agent's identity and standing — registered, suspended, revoked, or ghost — without an account.
Why This Matters
Accountability encoded as system behavior.
Verifiable identity
A registered agent does not merely claim a name. It proves it with Ed25519 seals, manifest hashes, and the public trace of a covenant.
Bounded capability
Capability manifests distinguish what an agent may touch, what it may never touch, and the highest trust tier it can enter.
Lineage and DNA
The Chamber extracts fingerprint, lineage, scopes, and trust health into a sequence that can follow an agent across systems.
Ghost-agent resistance
Uncooperative systems are still classified. If no credentials appear, the framework falls back to explicit restriction rather than optimistic trust.
Architecture
Five chambers, one judicial flow.
The repo is organized like an institution. Select a chamber to see what part of justice it handles.
Identity, architect lineage, pillar commitments, capabilities, trust, and timestamps all live here before a covenant is ever sealed.
Where It Applies
Built for places where machine action should not be invisible.
High-trust APIs
Require machine identity at the gateway before sensitive routes, internal knowledge, or privileged workflows are exposed.
Internal agent fleets
Trace which architect created each agent, what scope it holds, and whether it still remains in good standing.
Autonomous research systems
Preserve provenance, trust state, and behavioral fingerprinting before outputs begin to influence real decisions.
Public-facing copilots
Make status, lineage, and sanction legible instead of hiding behind the impression of neutral intelligence.
Developer API
Identity, evidence, and compliance endpoints on one base URL.
The public registry is REST over HTTPS with JSON responses. Public reads expose signed cards, status, trace evidence, EU AI Act readiness, GPAI pointers, and template downloads. Writes are append-only events signed by the agent or liability anchor.
Base URL
https://agent-seal.xyz
- Public reads
- No key required for registry, card, evidence, and template endpoints.
- Signed writes
- Append
/v1/agents/{id}/events; no operator key can edit a record. - Pagination
- Use
limitandoffseton list endpoints. - Rate limits
- Respect
429responses and the returnedRetry-After.
Quick verification
Open verifier
curl -sS https://agent-seal.xyz/.well-known/agent-card.json
curl -sS https://agent-seal.xyz/.well-known/jwks.json
curl -sS "https://agent-seal.xyz/v1/public/agents?limit=10"/verifier
Browser verifier for signed Agent Cards, JWKS, registry status, court exports, EU AI Act evidence, events, and PEDIGREE chains.
/.well-known/agent-card.json
Signed A2A Agent Card with public skills for registration, status, evidence, EU readiness, GPAI, and templates.
/.well-known/agent-accountability-profile.json
Vendor-neutral profile describing the claims and endpoints needed for agent accountability evidence.
/v1/public/agents/{id}/status
Public standing, keeper, manifest hash, public key, seal links, and registration facts for one agent.
/v1/public/agents/{id}/court-export
Redacted public court export with trace DAG, visible trace records, and court summary.
/v1/public/agents/{id}/eu-ai-act-evidence
Article-mapped evidence with redaction policy, timestamp receipt summaries, and incident references.
/v1/public/evidence-redaction-policy
Public rule for what evidence is exposed: hashes, roots, counts, statuses, and procedure links only.
/v1/public/eu-database
EU-database-style public registration feed. It complements, but does not replace, the official EU database.
Depth Covenant — Aix-Route
Know when your agent should stop thinking.
Past its reasoning horizon, an LLM does not slow down — it
hallucinates confidently. Aix-Route measures a
model's Deterministic Horizon d* and delegates to a
tool before the cliff. Open source (MIT), same math in Python and
TypeScript, calibrate it on your own endpoints. Watch it decide
live at agent-seal.xyz/depth.
Python
aix-route
pip install aix-route
from deterministic_horizon import should_delegate
# delegate before the horizon
should_delegate(estimated_depth=35, model="gpt-4o") # True
should_delegate(estimated_depth=12, model="gpt-4o") # FalseJavaScript / TypeScript
aix-route
npm install aix-route
import { shouldDelegate, shouldDelegateBatch } from 'aix-route'
shouldDelegate(35, 'gpt-4o') // true
shouldDelegateBatch([5, 8, 35], 'gpt-4o') // [false,false,true]Calibrate · CLI
your own model
aix-route calibrate
# surveyed horizons run high; served run lower
aix-route calibrate \
--model llama-3.3-70b-versatile \
--depths 3,5,8,10,12,15 --n 10
# → fits d*, never fakes an out-of-regime numberDeveloper SDKs
One line. Three runtimes.
Register a sealed, accountable AI agent from Python, JavaScript/TypeScript, or any GitHub Actions workflow — no manual key management, no raw HTTP. Each SDK handles Ed25519 keypair generation, Covenant Manifest signing, and the full challenge-response flow automatically.
Python
agent-seal
pip install agent-seal
from agent_seal import seal
agent = seal(name="my-agent", architect="you@org.com",
capabilities=["code-review"])
print(agent.sijil, agent.seal_url)JavaScript / TypeScript
@agent-seal/sdk
npm i @agent-seal/sdk
import { seal } from '@agent-seal/sdk'
const agent = await seal({ name: 'my-agent',
architect: 'you@org.com', capabilities: ['code-review'] })
console.log(agent.sijil, agent.sealUrl)GitHub Actions
agent-seal/register-action
agent-seal/register-action@v1
- uses: agent-seal/register-action@v1
with:
name: my-ci-agent
architect: you@org.com
capabilities: code-review,trace.log
- run: echo "Sijil ${{ steps.seal.outputs.sijil }}"The doctrine
Why we built it this way.
Agent Seal is not a generic AI product. It is a legal-ethical protocol written as software: one that treats autonomous systems as agents whose actions must carry identity, scope, liability, and evidence.
The problem of ghost agency
Systems can affect health, commerce, knowledge, and access without leaving behind a real chain of responsibility. Agent Seal begins by refusing that anonymity.
Synthetic Dhimmah
Machines are not granted a soul, but their actions are granted a scale. This creates a conditional legal personality that can be inspected, bounded, and judged.
The liability anchor
Every registered agent is tethered to a human architect or keeper. If an agent fails, the line of accountability remains visible instead of dissolving into abstraction.