Guided flow · ECZ-ID Agent Passport™
Agent guided flow
Carry an AI agent through the whole Accountability Chain: identify it, connect its operator, establish and delegate authority, carry Intent, evaluate before consequence, record the result and re-verify the proof.
- Identify agent
- Connect operator
- Establish authority
- Delegate
- Carry Intent
- Evaluate
- Record
- Re-verify
Steps at a glance · what is live today
- 01Identify the agentLive · public
- 02Connect the accountable operatorLive · public
- 03Establish authorityLive · signed in
- 04Delegate, only ever narrowerLive · signed in
- 05Carry IntentLive · signed in
- 06Evaluate before consequenceRelease-gated
- 07Record what happenedNo public retrieval
- 08Re-verify the proofLive · public
Live in production and publicly readable, with no account and no key.
GoalGive the agent a free ECZ-ID Passport and declare it where its ecosystem already looks.
Why it mattersOne logical agent is one Passport. Versions, deployments, replicas, regions and platforms are bindings or history, never new identities.
Prerequisites
- An agent you operate.
- One identifier: its A2A card URL, the origin of its
.well-knownmanifest, its repository or its package.
Example
{
"name": "Example Support Agent",
"ecz_id": "ECZ-GB-EXAMPL::AGENT_PASSPORT-AB12CD",
"resolver_backlink": "https://resolver.ecocitizenz.org/p/ECZ-GB-EXAMPL::AGENT_PASSPORT-AB12CD"
}Check
npx -y @ecocitizenz/ecz-id-mcp-verifier check --target https://developers.ecocitizenz.com/.well-known/ecz-agent.json --target-type agent_manifestExpected output
{
"target_type": "agent_manifest",
"policy_mode": "OPEN",
"result_state": "NO_PUBLIC_RESOLVER_PROOF_FOUND",
"reason_codes": ["NO_PUBLIC_RESOLVER_PROOF_FOUND", "RESOLVER_READ_ONLY",
"LOCAL_POLICY_DECIDES"],
"primary_action": "CHOOSE_OPERATOR_PATH",
"exit_code": 0
}This site’s own discovery document deliberately declares that the site is not an agent, so there is no Agent Passport proof. An agent with a Passport resolves; one without is reported as absent, never as unsafe.
What this proves
- That the machine has a persistent, publicly resolvable identity under an accountable organisation, once issued and declared.
What this does not prove
- That the machine is safe, secure, correct or verified. A free Passport never claims that.
- Control of any native identity. A declaration is a pointer; only a proven binding proves.
Live in production and publicly readable, with no account and no key.
GoalResolve the Business Passport of the organisation that answers for the agent.
Why it mattersEvery child Passport resolves to one accountable organisation. A relying party who reaches the agent can always find who stands behind it, without asking.
Prerequisites
- The agent's ECZ-ID, or the parent ECZ-ID it names.
Example
curl -s https://api.ecocitizenz.com/api/p/ECZ-GB-RBS1NW.jsonExpected output
{
"ecz_id": "ECZ-GB-RBS1NW",
"resolver_v2": {
"record_type": "ECZ_ID_PARENT",
"state": {
"lifecycle_state": "ACTIVE",
"parent_tier": "VERIFIED",
"reliance_level": "PARENT_IDENTITY_ONLY"
},
"reliance": {
"can_rely_on": ["record_existence", "active_parent_state",
"current_parent_tier", "public_resolver_visibility"],
"reverify_before_reliance": true
}
}
}This is the operator record behind this site. Read parent_tier_context.tier_meaning on a child record: a parent tier is never inherited by a machine.
What this proves
- An accountable organisation exists and is publicly resolvable.
- Its current lifecycle state and parent tier, at the moment you read them.
What this does not prove
- That the organisation authorised any particular action by the agent.
- That the machine itself is verified, safe or compliant.
Live in production and operated by the account holder, signed in, through the TrustOps Dashboard.
GoalHand part of the agent’s Intent to a sub-agent or tool, bounded by the parent.
Why it mattersAgents hand work to other agents. A delegated Intent may only narrow its parent, depth is bounded at four, every ancestor’s budget is charged, and revoking the parent cascades.
Prerequisites
- The sub-agent's child Passport.
- An ECZ-ID Intent plan, purchased in TrustOps.
- An owner or administrator to authorise. Nobody authorises their own request.
Example
"authorisation": {
"kind": "DELEGATION_CHAIN",
"principal_ref": "user:finance-admin-01",
"principal_role": "ADMIN",
"authorised_at": "2026-10-11T09:14:02Z",
"evidence_digest": "sha256:<64 hex>",
"chain": [{ "intent_id": "INT-0000000000PARENT00", "version": 2 }]
}What this proves
- Who authorised the sub-agent's work, in what role, and when, as ECZ-ID Core recorded it.
- That a delegated Intent is bounded by its parent: Core refuses a delegation that widens scope.
What this does not prove
- Any permission in your own access systems. OAuth scopes and API keys stay yours.
- That runtime actions stay inside the bounds. That needs a decision before the action.
- Anything public: the public Intent disclosure is not enabled.
Live in production and operated by the account holder, signed in, through the TrustOps Dashboard.
GoalState what the agent is authorised to do, within what bounds and for how long, and make every consequential action name that Intent.
Why it mattersPermission says what a credential can reach. Intent says what this actor may do. The gap between them is where a permitted action can still be one nobody authorised.
Prerequisites
- An authorised ECZ-ID Intent in force (state
ACTIVE). - A single choke point in your code where consequential actions pass.
Example
{
"schema": "ecz.intent.v1",
"actor": { "kind": "ECZ_PASSPORT", "ecz_id": "ECZ-GB-EXAMPL::AGENT_PASSPORT-AB12CD", "family": "AGENT" },
"objective_summary": "Pay approved supplier invoices",
"constraints": {
"actions": { "permitted": ["invoice:pay"], "excluded": ["invoice:pay_new_payee"] },
"financial": { "currency": "GBP", "max_per_action": 500, "max_total": 5000 },
"approval": { "required_for": [], "above_amount": 250 },
"data_classes_denied": ["card_data"]
},
"window": { "not_before": "2026-10-12T00:00:00Z", "expires_at": "2026-10-19T00:00:00Z" },
"state": "ACTIVE"
}In your system
// Your audit log: one entry per consequential action, written before it runs.
// ECZ-ID defines the Intent reference; the rest belongs to your system.
log.info('consequential_action', {
actor_ecz_id: 'ECZ-GB-EXAMPL::AGENT_PASSPORT-AB12CD',
intent_ref: { intent_id: 'INT-0000000000EXAMPLE0', version: 3 },
request_id: crypto.randomUUID(),
action: 'invoice:pay',
amount: 180,
currency: 'GBP',
});Request identifiers, nonces and correlation IDs belong to the request, not the Intent. ECZ-ID defines no header for carrying an Intent reference over arbitrary protocols, and this site does not invent one.
What this proves
- What was authorised, as a versioned record with its bounds and window.
What this does not prove
- That any action stayed inside those bounds. Holding an Intent identifier authorises nothing by itself.
- That a sandbox Intent covers production. It never does.
Documented ahead of release.
GoalDecide whether the agent's proposed action may proceed before it changes anything.
Why it mattersIntentControl is designed to evaluate a proposed action against identity, authority, delegation, Intent, policy, current state and constraints. It is documented ahead of release, so today you decide with your own policy over live state.
Prerequisites
- A choke point in your code in front of the action.
- The counterparty or target ECZ-ID.
Example
// Runs today: your own policy over live Resolver state.
async function mayProceed(eczId) {
const res = await fetch('https://api.ecocitizenz.com/api/p/' + eczId + '.json');
if (res.status === 404) return { ok: false, why: 'NO_PUBLIC_ECZ_ID_FOUND' };
if (!res.ok) return { ok: false, why: 'RESOLVER_UNREADABLE', retry: true };
const v2 = (await res.json()).resolver_v2;
const failClosed = v2.machine_policy.fail_closed_states;
const ok = v2.state.lifecycle_state === 'ACTIVE'
&& !failClosed.includes(v2.state.lifecycle_state)
&& !failClosed.includes(v2.binding.state);
return { ok, why: v2.state.reliance_level };
}What this proves
- Your own decision, made on the current published state of the counterparty.
What this does not prove
- An Intent-bounded decision. That is IntentControl: its interface is release-gated and not callable, and commercially it is coming soon in TrustOps and not yet on sale.
- Enforcement. A decision only constrains actions routed through an enforcement point you run.
ECZ-ID Core records it, but public, unauthenticated retrieval and verification are not enabled.
GoalKeep a record of what the agent did, and know what ECZ-ID publishes about it.
Why it mattersThe agent’s action runs in your system; your log entry is your record of it. A Receipt proves what the recording system recorded; it does not prove every real-world assertion behind it.
Prerequisites
- Your own audit log entry from the Intent step.
Example
curl -s https://api.ecocitizenz.com/api/p/ECZ-GB-RBS1NW.jsonExpected output
"evidence": {
"public_receipts_count": 0,
"public_receipt_state": "NO_PUBLIC_RECEIPT",
"public_receipt_retrievable": false,
"receipt_retrieval_state": "NONE_PUBLISHED",
"recorded_receipts_count": 1,
"reason_codes": ["RECEIPTS_RECORDED_NOT_PUBLICLY_RETRIEVABLE"]
}Recorded is not published. Decide on evidence.public_receipt_state and evidence.public_receipt_retrievable, the fields the record lists for machines.
What this proves
- Whether Core has recorded receipts for the subject, and whether any are publicly retrievable.
What this does not prove
- What any receipt says. Public retrieval and public verification are not enabled.
- That an action happened or succeeded. An allow is not a result, and a decision receipt is not an action receipt.
ReferenceReceiptsEvidenceReceipt reference
Live in production and publicly readable, with no account and no key.
GoalLet anyone who was not there re-check the agent's public state, now and in CI.
Why it mattersEvery other link ends with a reader who was not present. Re-verifying closes the chain: the record is re-resolved live, never trusted from a cache.
Prerequisites
- Node 22.14+ for the verifier (its declared engine), or any HTTP client for the record.
Example
npx -y @ecocitizenz/ecz-id-mcp-verifier check --target ECZ-GB-RBS1NW --policy REQUIRE
# .github/workflows/ecz-id.yml — fails the job when proof is missing
- uses: Ecocitizenz/ecz-id-mcp-verifier@v0.9.0
with:
target: ${{ env.COUNTERPARTY_ECZ_ID }}
policy: REQUIREExpected output
{
"target": "ECZ-GB-RBS1NW",
"target_type": "ecz_id",
"policy_mode": "OPEN",
"result_state": "RESOLVER_VERIFIABLE",
"reason_codes": [],
"primary_action": "VIEW_RESOLVER_PROOF",
"verifier_writes_truth": false,
"exit_code": 0
}Measured the same day: an identifier with no public record returns NO_PUBLIC_RESOLVER_PROOF_FOUND, exit 0 under OPEN and exit 1 under REQUIRE.
What this proves
- The current published state, at the moment of the check, read live.
What this does not prove
- Safety, security, certification, compliance or approval.
- Anything about the state a minute later. Re-check before each reliance.
Where next
This page is explanation, not authority. Current state is only ever the live Resolver record. Commands were run read-only on 2026-10-10; illustrative examples are labelled.