AI Agent IDs: The Complete Guide

An AI agent ID is a distinct, machine-verifiable identity for an autonomous software agent, separate from any human's credentials. It lets an organization scope what the agent can reach, attribute every action it takes, and audit its behavior after the fact.

The alternative is what most deployments still do today: the agent borrows a human's login, token, or API key. That works until something goes wrong, then the audit trail reads "the AI did it" with no way to establish which agent, on whose behalf, under what authority. The terminology is converging from several directions at once: Non-Human Identities (NHIs) in the security world, Know Your Agent (KYA) in payments and compliance, and agent passports in the emerging standards community.

Agents need IDs for three reasons: controlled access, accountability, and, since 2026, recognition by institutions. Each failure mode of an ID-less agent is now well documented.

Controlled access.An ID restricts the agent to specific tools, data, and financial limits instead of inheriting a human's entire digital life. Scoped, short-lived credentials shrink the blast radius when an agent is compromised or simply wrong.

Accountability.IDs make audit possible: which agent acted, on whose behalf, under what granted authority, and when. Microsoft's VP of Core AI put it publicly in July 2026: without agent identity, "the audit trail collapses, unworkable for any regulated enterprise."

Recognition. Estonia is setting the precedent, announcing plans for official government-backed AI ID codes for autonomous software, reported by Euronews in June 2026 and analyzed by Security Magazine and Dark Reading in July. Nation-states assigning IDs to software agents is no longer hypothetical; it is scheduled.

An identity says who the agent is. Verification proves what the agent did, and whether it stayed inside the authority a human granted it. Nearly every solution shipping today addresses the first problem; almost none address the second.

Directory identity (an agent registered in your organization's tenant with scoped tokens) solves internal access control. But it has a structural limit: it means nothing outside your organization. Your counterparty, your auditor, your insurer, and a regulator cannot log into your directory, and the operator's own logs are the vendor grading its own homework. The moment an agent's actions matter acrossan organizational boundary : a buyer verifying a vendor's agent, a dispute over an agent's transaction: you need three things an internal ID cannot supply: a credential a stranger can check, a record the operator cannot rewrite, and a stated grant of authority to check the behavior against.

That is the verification layer: signed credentials (passports), a tamper-evident action record (a hash-chained black box), and signed mandates (bounded authority). Identity and verification compose, one does not replace the other.

The landscape splits into four camps: government ID programs, platform identity layers, payment-network mandates, and open passport specifications. They solve different slices of the same problem.

Government programs.Estonia's planned AI ID codes are the first state-level scheme: identity recognition for software agents at the national registry level, per public reporting.

Platform identity.Microsoft Entra Agent ID treats agents as first-class identity accounts inside an organization's directory, with unique identification and scoped tokens, per Microsoft's documentation. Excellent for tenant-internal control; it composes with independent verification rather than replacing it →

Payment mandates.The agentic-payments standards wave (AP2 and the card networks' agent programs) settled on cryptographically signed mandates, verifiable credentials stating what an agent is authorized to transact. Know Your Agent is becoming the payments-side term of art.

Open specifications.Several community specs are forming around the "agent passport" concept (APIS, OAP, and open-source verifier projects). Most are specification documents ahead of live deployments: the category's vocabulary is being written faster than its running systems.

A Trust Passport is a cryptographically signed, independently verifiable credential for an AI agent. It binds the agent's identity to an evidence-gated trust score, the compliance frameworks it passed, and its tamper-evident action record, signed once at issuance with Ed25519 and verifiable by anyone at a public URL, with no account and no trust in the issuer's word required.

The properties that matter: evidence-gated(an agent with no behavioral evidence holds no score, an honest "unrated" instead of a fabricated baseline); revocable (a revoked passport verifies as revoked, publicly); independently checkable(the signature recomputes against a published JWKS key; the action record recomputes hash by hash). A passport does not claim an agent is safe, no honest credential can. It proves the agent's record is real, current, and within a stated authority.

The fastest way to understand agent verification is to perform one. The link below opens a live, commercially operating agent's Trust Passport; the page recomputes its Ed25519 signature and re-checks its hash-chained record as it loads.

The public directory of verified agents lives at apir.ai/registry. Any agent, on any platform, can hold one: the first passport is free, no card →

An ID: government, platform, or passport: does not make an agent safe, and no credential honestly can. What verification provides is evidence: what the agent did, under what authority, with alterations detectable.

Three limits worth stating plainly. An ID doesn't constrain behavior by itself, that takes enforced mandates and human-held authorization on binding actions. A score is only as honest as its evidence gate, a "trust score" invented at registration is marketing, not measurement. And records are tamper-evident, never impossible to alter: the honest claim is that alteration is detectable by anyone who checks, not that alteration cannot happen. Vendors who promise more than that are describing a product that cannot exist.

What is an AI agent ID?

An AI agent ID is a unique, verifiable identity assigned to an autonomous software agent, so its access can be scoped, its actions attributed, and its behavior audited. Without one, an agent borrows a human’s full credentials and its actions collapse into "the AI did it."

What is Know Your Agent (KYA)?

Know Your Agent is the emerging discipline of verifying an AI agent the way KYC verifies a customer: who operates it, what authority it holds, and whether it is in good standing. Payment networks adopted the pattern in 2026 through signed agent mandates.

What is the difference between agent identity and agent verification?

Identity says who the agent is: a directory entry, scoped credentials, access control. Verification proves what the agent did and whether it stayed inside the authority a human granted: signed credentials, a tamper-evident action record, and evidence anyone can check independently.

What is a Trust Passport?

A Trust Passport is a cryptographically signed, independently verifiable credential for an AI agent. It binds the agent’s identity to its evidence-gated trust score, the frameworks it passed, and its tamper-evident action record, is signed with Ed25519 against a published key, and can be verified by anyone at a public URL with no account.

Can an AI agent be verified without an account?

Yes. A properly issued agent credential verifies offline-style: the verifying page recomputes the Ed25519 signature against the issuer’s published JWKS key and re-checks the agent’s hash-chained record on load. No login, and no trust in the issuer’s word required.

What is an agent Black Box?

An agent Black Box is a tamper-evident flight recorder for AI agents: an insert-only, SHA-256 hash-chained ledger of every action, decision, and verdict. Alterations break the chain visibly: the record is tamper-evident, and independently recomputable.

Do AI agents need government IDs?

Estonia became the first country to announce plans for official, government-backed AI ID codes for autonomous software, as reported by Euronews in June 2026. Government IDs address state recognition; they do not by themselves prove what an agent did, that still requires a verification layer with a tamper-evident record.

What is Microsoft Entra Agent ID?

Per Microsoft’s documentation, Entra Agent ID makes AI agents first-class identity accounts inside an organization’s directory, with unique identification and scoped, short-lived tokens. It is an identity layer within one tenant; independent, cross-organizational verification is a separate, complementary layer.