agent-identity-demos

Agent Identity Demos

Runnable demos for AGNTCY Identity — covering agent authentication, delegation, verifiable credentials, and cross-domain authorization using ID-JAG and the AGNTCY Identity Node (CIMD).

Each demo is a self-contained Docker Compose stack that you can run locally.

This wiki is the navigable overview. Operational detail (commands, reviewer checklists, reverse-proxy recipes) stays in the demo README.

Survey

Orthogonal dimensions of agent identity and authorization (10-axis framework).

Demos

Cross-domain ID-JAG + VC

The most complete demo. Sarah (Org A engineer) asks her AI agent OpenCode to fix a security weakness in a repo owned by Org B.

• OpenCode reads the real source through the delegation chain, under its own read-scoped assertion, before analyzing it
• OpenCode can’t act in Org B directly — it asserts Sarah’s delegation cross-domain using a natively-minted ID-JAG
• Org B’s Triage agent narrows the privilege further and spawns a bounded Sub-Agent to open the PR
• Every agent publishes a real W3C Verifiable Credential, and each side of a handoff resolves and checks the other’s before trusting it

23 services total. The identity, authorization, and audit path is real (Keycloak, Vault, identity-node, Gitea, Directory, and two Built On Envoy inline OPA boundaries).

• Overview
• Architecture
• Quick start
• Full walkthrough (demo README)

Related

• agntcy/identity-service — the Identity Service these demos run against
• AGNTCY Identity spec — the underlying identity specification
• AI Agent Authentication and Authorization — IETF individual draft this demo relates to

This site is open source. Improve this page.