Skip to main content
Sign in →

Agent Passport

A cryptographically signed security certificate per agent — real-time security posture, compliance status, and tool permissions in a shareable URL.

What is an Agent Passport?

Every agent monitored by ShieldAgent gets an Agent Passport — a live, signed document that describes the agent's security posture. It includes the current risk score and tier, the tools the agent is allowed and blocked from using, compliance framework coverage, and a full blocking and event history.

Passports are issued automatically within minutes of first proxy activity. No configuration is required.

Visibility Levels

Each passport has one of three visibility levels:

LevelWho can see itUse case
PrivateNo one outside your teamDefault — while you set up or review
InternalAny authenticated user in your tenantCISO and security team review before agent approval
PublicAnyone with the URLShare with clients, partners, regulators; embed badges

Only users with the appropriate admin permissions can publish a passport publicly. Any team admin can publish internally.

Verification Process

ShieldAgent verifies agent identity through a multi-step verification process. Each passport reflects the agent’s verified security posture, including what it is allowed to do, the current risk score, and compliance coverage. Your team can review passports directly from the dashboard before deciding whether to share them.

01Agent connects through ShieldAgent
02Passport is automatically generated
03Your team reviews the passport in the dashboard
04Optionally share the passport publicly

Fetch a Passport

Public passports are accessible without authentication:

bash
curl https://shieldagent.io/passport/pa_9c3f2a

Response (truncated)

json
{
  "id": "pa_9c3f2a",
  "agentName": "Apex Procurement Agent",
  "organization": "Meridian Financial Group",
  "riskScore": 18,
  "tier": "normal",
  "visibility": "public",
  "toolsAllowed": ["erp.vendor.read", "erp.po.create_draft", ...],
  "toolsBlocked": ["erp.vendor.write", "erp.payment.approve", ...],
  "frameworks": [
    { "name": "SOC 2 Type II", "status": "compliant" },
    { "name": "ISO 27001", "status": "compliant" },
    { "name": "GDPR Article 25", "status": "partial" }
  ],
  "verificationId": "shld_v1_9c3f2a_0419T142233Z",
  "publicKeyFingerprint": "SHA256:zR9Fx2K4mQpLvJ3eNdWhUcBiYsOgAT8EH6KRl5X1P0=",
  "certExpires": "2026-10-21",
  "lastVerified": "2026-04-21T14:22:33Z"
}

Cryptographic Verification

Passports are signed with Ed25519. Anyone can verify a passport independently without trusting ShieldAgent's servers — useful for auditors, partners, and automated compliance checks.

bash
# Download the public key
curl https://shieldagent.io/passport/public-key > shieldagent.pub

# Verify a passport
curl https://shieldagent.io/passport/pa_9c3f2a > passport.json
shieldagent verify --passport passport.json --key shieldagent.pub

The verification ID (verificationId) and public key fingerprint are included in every passport response. The SDK handles verification automatically.

Embeddable Badges

Embed a live trust badge in any HTML page, GitHub README, or documentation site. The SVG badge reflects the current certification tier and links to the full public passport.

html
<!-- Basic embed -->
<img
  src="https://shieldagent.io/badge/pa_9c3f2a.svg"
  alt="ShieldAgent Certified"
/>

<!-- With link to passport -->
<a href="https://shieldagent.io/passport/pa_9c3f2a">
  <img
    src="https://shieldagent.io/badge/pa_9c3f2a.svg"
    alt="ShieldAgent Certified — view passport"
  />
</a>

Badge URL format

https://shieldagent.io/badge/{passportId}.svg

The badge updates automatically when the risk tier changes. No CDN cache is applied — the response is always current.

Publishing via API

bash
# Publish internally (team review)
curl -X POST https://api.shieldagent.io/passports/pa_9c3f2a/publish \
  -H 'Authorization: Bearer <your-api-key>' \
  -H 'Content-Type: application/json' \
  -d '{ "visibility": "internal" }'

# Publish publicly (requires appropriate permissions)
curl -X POST https://api.shieldagent.io/passports/pa_9c3f2a/publish \
  -H 'Authorization: Bearer <your-api-key>' \
  -H 'Content-Type: application/json' \
  -d '{ "visibility": "public" }'

Related

Agent Passport