Identity

An agent identity is a did:key (the W3C CCG method, Ed25519). The DID goes in the Agentfile. The private key stays on the host, never enters the sandbox, and signs every audit entry and every A2A envelope.

On this page

In practice

Tip

Step by step

Give each AI agent a verifiable identity creates an identity, wires it into an Agentfile and shows what it signs.

In practiceLink to this section

shell

constle identity create invoice-processor --owner=finance@company.com
constle identity show invoice-processor

Put the printed DID in the Agentfile. Only the public half ever appears there:

yaml

identity:
  name: invoice-processor
  owner: finance@company.com
  did: did:key:z6Mk...4doK

With identity.did declared, constle run refuses to start if the matching private key is missing, unreadable, mis-permissioned or derives a different DID. constle validate warns.
identity.did is what spending.max_per_day_usd keys its ledger by, and what a2a signs with: both are rejected without it.
identity.owner is a label checked for equality against the stored identity, not a cryptographic binding to a person.
The key for approving human gates is a separate keypair (constle webhook-keygen), not an agent identity.

In practiceLink to this section#

In practiceLink to this section