Skip to content
ECZ-IDDevelopers

ECZ-ID · Reciprocal Trust Infrastructure for the Machine Economy

AGENT PASSPORT · AWS GETTING STARTED · 02/04Public customer resource

ECZ-ID Agent Passport AWS Marketplace Getting Started and Technical Guide

From AWS subscription to a working, resolver-verifiable Agent Passport with minimal friction.

Download PDF(PDF, 496 KB)

Release 2026.10 · 15 October 2026

Agent Passport documents
In this document
  1. The whole journey in one view
  2. 1. Subscribe → 2. Set up your account → 3. handoff
  3. 4. identify the AWS customer → 5. activate the ECZ-ID acquisition flow
  4. 6. reuse or create supported account + Parent → 7. map ProductCode → 8. issue or reuse Passport
  5. 9. continue to Dashboard
  6. 10. re-check the Agent Passport
  7. What must never enter public proof or support channels
  8. Diagnose the failed stage before taking action
  9. The 60-second completion check

About this document

Primary reader
AWS Marketplace subscriber, cloud administrator, developer and customer administrator.
Secondary reader
Procurement, security architecture, platform operations and technical support.
When to read this
You have found ECZ-ID Agent Passport in AWS Marketplace and want to activate it correctly.
Release
2026.10 · 15 October 2026
What you will know after reading
You can complete the AWS acquisition path, reuse or create the supported account / Parent, obtain the Agent Passport, open Dashboard and verify it in Resolver.
What this document does not establish
AWS Marketplace supplies acquisition context. It does not become the canonical ECZ-ID identity store or authority root.

NextAfter activation, use the Operations guide to keep state, bindings and evidence current.

START HERE

The whole journey in one view

The Passport is permanently free. Subscribe in AWS, complete the account handoff, then verify the resulting canonical Agent ECZ-ID in Resolver.

AWS Marketplace → canonical Agent Passport → Resolver

AWS supplies acquisition context; ECZ-ID remains the canonical identity and proof system.

  1. Step 1: Subscribe at $0

  2. Step 2: Set up your account

  3. Step 3: Registration token

    Sensitive handoff - do not share

  4. Step 4: AWS-native adapter

    ResolveCustomer

  5. Step 5: TrustOps

    Acquisition + activation

  6. Step 6: Account / Parent

    Reuse or create

  7. Step 7: ProductCode

    Maps to Agent family

  8. Step 8: Agent Passport

    Issue or reuse

  • PROVIDER ACQUISITION

    AWS Marketplace

  • then

    CANONICAL ECZ-ID SYSTEM

    Activation, identity truth, control and proof

  • then

    DASHBOARD

    Authenticated customer control

  • then

    RESOLVER

    Public read-only proof

PRICING ECZ-ID Agent Passport is permanently free through this AWS Marketplace listing. It is not a time-limited Free Trial.

  • AWS

    Acquisition / provider context

  • ECZ-ID

    Canonical identity + activation

  • Resolver

    Independent public re-check

STEP-BY-STEP ACQUISITION

1. Subscribe → 2. Set up your account → 3. handoff

AWS Marketplace provides the customer acquisition context; the registration token is sensitive and must not be copied into public or support channels.

  1. Step 1: SUBSCRIBE AT $0

    Open the ECZ-ID Agent Passport listing and subscribe at $0. There is no ECZ-ID software charge for the Passport.

  2. Step 2: SET UP YOUR ACCOUNT

    Choose Set up your account so AWS can continue into the ECZ-ID fulfillment path.

  3. Step 3: REGISTRATION TOKEN

    AWS passes a registration token to ECZ-ID. Treat it as sensitive operational input.

FULFILLMENT ENDPOINT

https://trustops.ecocitizenz.com/aws/marketplace/fulfill

SECURITY Do not copy the AWS Marketplace registration token into screenshots, chat, tickets or public documentation. If setup fails, record the visible error and time instead.

RESOLVECUSTOMER AND TRUSTOPS

4. identify the AWS customer → 5. activate the ECZ-ID acquisition flow

The AWS-native adapter resolves the Marketplace customer and hands acquisition into TrustOps.

  • AWS-NATIVE ADAPTER

    Uses the AWS Marketplace integration to resolve the AWS customer context. Provider-native identifiers remain acquisition/binding context, not ECZ-ID authority roots.

  • TRUSTOPS

    Processes acquisition and activation, applies the supported account / Parent reuse rules and hands the customer into the canonical lifecycle.

ARCHITECTURE LAW AWS Marketplace = acquisition/provider context. TrustOps = acquisition/activation. Core = canonical identity truth. Dashboard = control. Resolver = read-only proof.

  • Concurrent Agreements

    The AWS integration is designed to support AWS Marketplace agreement context without using the agreement itself as the canonical ECZ-ID identity.

  • No duplicate identity

    Acquisition should reuse the supported existing EcoCitizenz account and Parent where appropriate instead of intentionally creating another canonical identity.

ACCOUNT, PARENT AND PASSPORT REUSE

6. reuse or create supported account + Parent → 7. map ProductCode → 8. issue or reuse Passport

The target outcome is one canonical identity for the intended agent, not a new Passport for every subscription click.

  • ACCOUNT

    Reuse the supported existing EcoCitizenz account when appropriate; otherwise follow the canonical account acquisition path.

  • PARENT

    Reuse the relevant Parent/organisation relationship where supported; avoid deliberate duplication.

  • AGENT PASSPORT

    ProductCode maps to the Agent Passport family. Issue a new Passport only when the object legitimately needs one; otherwise reuse the canonical one.

DUPLICATE-PREVENTION RULE The same logical agent should keep the same canonical Agent ECZ-ID where supported. Update changing context as bindings/evidence rather than minting another identity.

AGENT ECZ-ID

canonical identity

  • AWS context

  • Parent / org

FIRST CUSTOMER CONTROL

9. continue to Dashboard

Dashboard is the authenticated customer control plane; Resolver is the public proof surface. They are intentionally different.

  • DASHBOARD - PRIVATE CONTROL

    Use Dashboard to view the permitted customer estate, inspect Passports & Identity, Products & Entitlements, Operations, Evidence & Proof, Badges & Sharing and organisation/account context available to your role.

  • RESOLVER - PUBLIC PROOF

    Use Resolver to present and independently re-check the bounded public Agent Passport record. Resolver is not the mutation or control plane.

FIRST CHECK Confirm the expected Agent Passport exists, the intended Parent/organisation context is visible where supported, and the public Resolver record resolves as expected.

  • Do not create another Passport merely because you cannot immediately find the expected record.
  • Distinguish acquisition/issuance failure from a copied-identifier or sign-in problem.
  • If support is needed, provide the failed stage, time, visible error and ECZ-ID/Passport ID if available - never the registration token.

FIRST RESOLVER VERIFICATION

10. re-check the Agent Passport

A successful AWS acquisition is not complete from the customer’s perspective until the Agent ECZ-ID can be independently resolved and interpreted correctly.

Independent re-check when freshness matters

Human and machine consumers can resolve the same Agent ECZ-ID again before consequence.

  • COUNTERPARTY

    Human or machine consumer; presented Agent ECZ-ID

  • then

    ECZ-ID RESOLVER

    public read-only proof; identity + family; responsibility context; current state; bindings + evidence

  • then

    DECISION

    Evaluate only what the action requires; permit / challenge / deny

GET https://api.ecocitizenz.com/api/p/{ecz_id}.jsonAbsent required data = not established. Re-resolve according to freshness policy.

MACHINE-READABLE ROUTE

GET https://api.ecocitizenz.com/api/p/{ecz_id}.json
  • Validate Passport family = Agent.
  • Check the expected organisation / Parent relationship where relevant.
  • Read current published state.
  • Inspect only the bindings and evidence needed for the integration.
  • Evaluate authority/delegation separately when the action requires it.

SECURITY AND SECRET HANDLING

What must never enter public proof or support channels

The AWS registration token and other credentials are operational secrets; the Passport is designed to publish bounded proof, not secrets.

  • NEVER SEND

    • Passwords
    • API keys
    • AWS Marketplace registration tokens
    • Certificates/private keys
    • Other credentials or secrets

  • SAFE SUPPORT CONTEXT

    • Failed stage
    • Visible error
    • Occurrence time
    • AWS account context where appropriate
    • ECZ-ID / Passport ID if available

RESOLVER BOUNDARY Only publish information intended for the public proof surface. Treat absent private data as private/absent - do not compensate by adding secrets or internal identifiers.

  • Support

    support@ecocitizenz.com Support covers AWS setup, activation, Passport issuance/reuse, account access, Resolver verification and troubleshooting. No unsupported response-time or SLA promise is implied.

TROUBLESHOOTING

Diagnose the failed stage before taking action

The fastest recovery path is to identify where the journey stopped, preserve the canonical identity and avoid repeating actions that can create confusion.

  • Subscribe unavailable

    Confirm the product is visible to the AWS account permitted for the Limited listing or that it is Public.

  • Set up your account fails

    Record the visible error and time. Do not expose the registration token.

  • ResolveCustomer / activation fails

    Contact support with AWS account context and the failed stage. Do not repeatedly create identities as a workaround.

  • Already have EcoCitizenz account

    Use the supported existing-account path rather than intentionally creating a duplicate.

  • Resolver does not show Passport

    Confirm acquisition completed and the ECZ-ID is correct; distinguish issuance delay/failure from copied-identifier error.

GO-LIVE CHECKLIST

The 60-second completion check

Use this checklist before considering the AWS acquisition complete for the intended customer journey.

  • Subscribed at $0.
  • Set up your account completed.
  • AWS customer was resolved through the supported integration.
  • Expected EcoCitizenz account / Parent reused or created according to canonical flow.
  • ProductCode mapped to Agent Passport family.
  • Canonical Agent Passport issued or reused.
  • Dashboard access works for the permitted customer experience.
  • Resolver can re-check the Agent ECZ-ID.
  • No duplicate identity was created.
  • No registration token or secret was exposed.

NEXT ACTION Operate the Passport over time using ECZ-ID Agent Passport Operations, Lifecycle and Troubleshooting Guide.

Download and support

This page is the HTML edition of ECZ-ID Agent Passport - AWS Marketplace Getting Started and Technical Guide, release 2026.10. The PDF is the designed offline copy.

Download PDF(PDF, 496 KB)

Support: support@ecocitizenz.com

Permanent route: https://developers.ecocitizenz.com/passports/agent/aws-getting-started/