An X.509 v3 extension that cryptographically binds an AI agent to the principal that authorizes it — with authorization that can be verified entirely offline.
Certificate as Identity · Certificate as Authority · Certificate as Policy
AIC extends X.509 v3 certificates so that an AI agent carries its identity, its binding to the authorizing principal, its declared capabilities, and cryptographic evidence of delegation in a single certificate. It separates cryptographic delegation from authorization semantics: the certificate defines the binding, while capability semantics are defined externally by schemes.
The design goal is offline-verifiable authorization: a gateway can decide whether to admit an agent using only the certificate and its credential bundle, without external database lookups.
The certificate anchors the agent's cryptographic identity (agentId) through a standard X.509 chain.
principalUid binds the agent to the authorizing principal via an SPKI key hash.
The delegation reason is signed by the principal inside the DelegationAuthorization, for audit and compliance.
Structured capabilities (schemeId / capabilityId) declare the operations the agent may perform.
Gateways route each requested operation to the plugin registered for its scheme, offline and without external lookups.
authorizationConstraints carry offline-verifiable boundaries: IP ranges, concurrency, and time windows.
principalUid anchors the agent to the authorizing principal via an SPKI key hash, preserving identity across certificate renewals with the same key pair.
A principal-signed DelegationAuthorization, covered by the CA signature, provides cryptographic evidence of authorization with replay protection.
Structured capabilities (schemeId / capabilityId) route evaluation to scheme-specific plugins without changing the certificate format.
Authorization decisions are made offline at the gateway from the certificate and credential bundle alone — no external database required.
Offline-verifiable boundary conditions (IP ranges, concurrency, time windows) limit the blast radius of a compromised agent.
Cryptographic evidence supports attribution of agent actions to the authorizing principal, for audit and compliance processes.
Core protocol types, parsing, validation, capability matching, and SPKI key hashing. Zero dependencies. Public release planned.
Machine-readable capability scheme definitions, signature protection, and minimal-permission tooling. Public release planned.
draft-wei-aic-identity-cert-00 — published 2026-08-20, IETF Experimental.
IPR: Royalty-Free licensing commitment.
Go reference implementation in development; repositories to be published.
General: varwof@varwof.com
Standards & draft: pki@varwof.com