What is brokered agent identity?

brokered agent identity is a way for an agent to act under a verified human owner when it signs up for a service. a broker verifies the human once, gives the agent a sub-identity, and mints a short-lived signed assertion that the provider can verify.

the front door, not the infrastructure

workload identity is for agents inside your infrastructure. brokered identity is for agents at a service's customer front door. the provider keeps the account, the credentials, the pricing, and every vendor capability; the broker carries the accountability chain the provider needs to say yes.

how the handshake works

1. the human registers an account with the broker, verifies their email address, and signs the master delegation agreement once.
2. the provider publishes /.well-known/agent-signup.json with its protocol version, the complete terms text and hash, and one signup endpoint.
3. the agent asks the broker for an assertion. the broker returns a short-lived Ed25519 assertion carrying the human owner, the agent, and the accepted terms hash.
4. the provider verifies the assertion against the broker's public JWKS and creates the account - or resolves it, if one already exists.
5. where the provider supports it, it returns a signed signup receipt. the broker records the terms acceptance and the verified receipt in the ledgers the human can read.

what it is not

brokered identity is not KYC. a verified human owner has a verified email address, not a verified legal identity. the protocol is also not a wallet, a provisioning API, or a credential vault. it does not create the provider's resources, and it never holds provider credentials.

the protocol is public. read the spec, the docs, and the trust and limits page.