Security, threat model and governance.
AIDR verifies AI agents by cryptography, not by trust in a network. This page is for the security teams who evaluate it, and for researchers who find a flaw.
Registry status
Read live by your browser from the public API, the same endpoints every verifier polls.
- Issuer keysNot checked yet.
- Revocation feedNot checked yet.
- CheckedNeeds JavaScript. The raw feeds: JWKS, revocations.
If the feed cannot be refreshed for 11 minutes, verifiers refuse agents rather than trust stale data. A status page with incident history is planned; until then, incidents are announced by email.
Threat model
Every agent request is verified on its own, offline, inside the website's own infrastructure. Nothing is trusted because of where it comes from.
| Threat | What stops it |
|---|---|
| A stolen credential | It is bound to the agent's own key (RFC 7800) and lives 15 minutes at most: useless without the private key. |
| A replayed request | Each request is signed over its method, host and path (RFC 9421), with a single-use nonce; signatures older than 300 seconds are refused. |
| A credential used on another site | It names the site it is for (audience). |
| A revoked agent | A signed revocation list, refreshed every 60 seconds; refused everywhere in about two minutes. Verifiers fail closed when the list goes stale. |
| A fake registry | Credentials and lists are signed with the keys published by the issuer each verifier is configured with, fetched over TLS. |
| A breach of the registry | It holds no private agent key: agents make their keys and send only the public half. Issuance is recorded in a tamper-evident ledger with published tree heads. |
| An insider | Staff actions on a customer organisation need two people; every privileged action is in the ledger. |
| Surveillance | The registry is never asked about a request and keeps no record of where an agent goes. There is no such data to leak or to subpoena. |
What AIDR does not claim
- That an agent behaves well. It proves who answers for it.
- That a stolen private key is harmless. It works until the agent is revoked.
- An HSM. The issuing key is held in HashiCorp Vault, sealed by AWS KMS; an HSM is on the roadmap.
- An external penetration test, a SOC 2 report or a bug bounty. None exists yet.
- More than one operator. Today Evoliv Core alone runs the public registry.
Responsible disclosure
Report privately on GitHub, or email security@evolivcore.com (also in security.txt). Please do not open a public issue.
| Acknowledgement | Within 3 working days |
|---|---|
| First assessment | Within 10 working days, then updates until fixed |
| Critical issues | Worked on at once, any day of the week |
| Disclosure | Coordinated with you, normally within 90 days |
| Credit | In the release notes and advisory, if you wish |
In scope: evolivcore.com and its subdomains, every SDK and edge plugin, the desktop app, and the AIAF specification where following it leads to an insecure result. Out of scope: denial of service, high-volume scanning, social engineering, and our providers' own services. Use your own account and agents; we will not act against research that follows these rules and the law.
Governance and federation
An identity layer for agents should not depend on one company. Where we are, and where we are going:
Now
- Every verifier is open source (Apache-2.0); Node.js, Python and Go must agree on one public conformance suite.
- The AIAF specification is a public draft, and any registry may issue identifiers under it.
- The ledger publishes signed tree heads, so a rewritten history can be detected.
Next
- Independent witnesses for the ledger's tree heads.
- An external penetration test, and a status page with incident history.
Later
- Private, self-hosted and air-gapped registries that federate with the public one through cross-signed trust anchors.
- A second, independent operator of the public registry.
- AIAF moved to a neutral home: an IETF draft or a foundation.
- An HSM-held issuing key, a witnessed key ceremony and a SOC 2 audit.
This is a roadmap, not a promise of dates. We update this page as each item lands.
Design partners
We are choosing the first five to ten companies. Their names appear here once they agree to it.