Skip to main content

Trusted Digital Agents

Review status: This foundation page requires specialist review before public approval. Its claims must remain within the scope stated here.

Software and AI agents are increasingly involved in institutional workflows. They may collect requirements, compare evidence, prepare requests, summarize operational state, or coordinate work across systems.

Identity operations require a stricter model than general-purpose automation. An agent must not gain authority merely because it can understand a request or call a tool.

Appropriate agent capabilities​

Under approved identity, scope, policy, and evidence controls, an agent may:

  • discover which credential types or proofs are supported;
  • retrieve public or authorized metadata;
  • explain required claims and verification policy;
  • prepare an issuance, presentation, or verification request;
  • validate that required fields and technical conditions are present;
  • identify missing evidence or conflicting data;
  • summarize authoritative operational evidence;
  • prepare a proposed action for review;
  • present an evidence-referenced briefing to an authorized decision-maker.

These activities improve efficiency without transferring institutional authority to the language model.

High-impact actions​

Credential issuance, identity recovery, key use, revocation, policy override, administrative access, and release of sensitive information are high-impact actions.

The recommended control pattern is:

  1. Prepare — create a complete proposed request.
  2. Validate — check schema, policy prerequisites, evidence, and authorization context.
  3. Approve — obtain explicit human or policy authorization.
  4. Execute — an authoritative deterministic service performs the action.
  5. Evidence — record the outcome, policy, actor, and authoritative result.

Preparation and validation must not be represented as successful execution.

Agent identity and authorization​

A trusted agent requires:

  • an identifiable principal or sponsoring institution;
  • authentication appropriate to the tool and data;
  • narrow scopes and least privilege;
  • purpose and audience binding;
  • approved resources and tools;
  • input and output schema validation;
  • time-bounded authorization where appropriate;
  • separation between read-only and state-changing capabilities;
  • traceable evidence for material actions.

The institution must be able to determine which agent acted, on whose behalf, under which policy, and with what result.

Evidence-grounded operation​

An agent should distinguish:

  • authoritative observations;
  • derived interpretation;
  • uncertainty or missing information;
  • recommendations;
  • actions actually confirmed by an authoritative service.

Where evidence is insufficient, the correct action is to stop, request clarification, or escalate. An agent should not invent credential status, infer successful recovery, or claim that an operation executed without confirmation.

MCP in the UbID model​

Model Context Protocol can expose controlled resources and tools for authorized agents. It is an integration protocol, not a credential format and not an authorization system by itself.

MCP access must still be governed by authentication, authorization, policy, schemas, evidence, privacy controls, and tool-specific boundaries.

Examples of safe public or read-only discovery include:

  • supported credential categories;
  • issuer or verifier capability descriptions;
  • public schemas and trust metadata;
  • protocol support;
  • service status appropriate for the authorized audience;
  • documented recovery or verification requirements without sensitive procedures.

Privacy and prompt safety​

Agent workflows should prevent:

  • disclosure of secrets or unnecessary personal data;
  • expansion of authority through prompt instructions;
  • silent use of external sources not approved by the institution;
  • mixing data from unrelated tenants, users, or purposes;
  • long-term retention of transient identity evidence;
  • unreviewed automated decisions where human review is required;
  • action claims that are not supported by authoritative evidence.

Institutional accountability​

The institution remains responsible for:

  • deciding which agents and tools are authorized;
  • approving high-impact operations;
  • validating legal basis and purpose;
  • monitoring agent access and outcomes;
  • investigating misuse or unexpected behavior;
  • providing human review, appeal, and correction;
  • ensuring that automation does not bypass issuer, verifier, security, or recovery governance.

UbID product composition​

  • UbID Sentinel AI interprets and organizes evidence.
  • UbID Trust API exposes governed capabilities.
  • UbID Pulse provides operational evidence.
  • UbID Connect supports trusted messaging and discovery.
  • UbID Credential Cloud, Proof, Access, Recover, and KeyVault remain authoritative for their domain actions.

Public documentation boundary​

Public documentation does not expose prompts, private resources, tool credentials, action endpoints, customer data, incident content, internal policies, guardrail implementation, or privileged execution paths.

See also UbID Sentinel AI, MCP and Trusted Agents, and Auditability and Observability.