Quickstart · ECZ-ID Agent Passport™

Agent quickstart

Give an AI agent you operate a free ECZ-ID Agent Passport, declare it where agents are discovered, and let counterparties check it before they rely on it.

Live · public

The free Agent Passport journey, the public record and the relying-party check are live. Commands were measured read-only on 2026-10-10. Availability is read live in TrustOps.

This quickstart gets the machine its identity. To carry it through the whole Accountability Chain (authority, Intent, decision, Receipt and re-verify), follow the Agent guided flow.

01Know what one Passport covers

You operate an AI agent that acts for your organisation. One Passport is one logical AI agent operated by the Parent.

Law: one agent -> one Passport; many agents -> many Passports.

Never a new Passport: version, deployment, replica, region, platform.

02Get the free Passport

Open the Agent door in TrustOps and sign in once. If your organisation has no Business Passport, a free DECLARED one is created. No payment is taken. Have one of these identifiers ready:

a2a_card_url: the agent's A2A card URL
well_known_origin: the origin publishing the agent's .well-known manifest
repository: host/owner/repo of the source repository
package: ecosystem:name of the published package (no version)

Start the Agent Passport in TrustOps (opens in a new tab)

03Declare it where your ecosystem looks

The families contract names the place: .well-known/ecz-agent.json pointer; ecz_id + resolver_backlink in the agent card. A declaration is a pointer, not proof.

jsonIllustrative declaration in the agent card. Use the values your TrustOps console shows.

{
  "name": "Example Support Agent",
  "ecz_id": "ECZ-GB-EXAMPL::AGENT_PASSPORT-AB12CD",
  "resolver_backlink": "https://resolver.ecocitizenz.org/p/ECZ-GB-EXAMPL::AGENT_PASSPORT-AB12CD"
}

04Prove a binding

A binding attaches the Passport to a native identity you control. The binding classes this family defines are: deployment_binding, well_known_manifest, a2a_card, provider_registration.

Proof is established through TrustOps and ECZ-ID Core, never on this site. Until a binding is proven, the public record reads binding.state: NO_PUBLIC_PROOF, which is the normal state of a new record. A class being defined is not a claim of a live integration with that provider.

05Let relying parties check it

Anyone can check before relying, with no account. This exact command was run on 2026-10-10:

bashMeasured 2026-10-10: NO_PUBLIC_RESOLVER_PROOF_FOUND, exit 0

npx -y @ecocitizenz/ecz-id-mcp-verifier check --target https://developers.ecocitizenz.com/.well-known/ecz-agent.json --target-type agent_manifest

This site’s own discovery document deliberately declares that the site is not an agent, so it has no Agent Passport proof. Absence, reported as absence.

06Next: Intent, decision, Receipt

Live · signed inModel what this machine is authorised to do as an ECZ-ID Intent. Carry Intent
Release-gatedAsk IntentControl for a decision before consequential actions. Request a decision
No public retrievalPlan for Receipts in your records. Verify a Receipt

Go deeper

A free Passport gives a machine a persistent identity. It never means verified, assured, safe, secure, compliant, approved, certified or endorsed. Family facts come from the TrustOps families contract; current state is only ever the live Resolver record.