Map

Agents as first-class identities

Wiki conceptagentic-codingidentitynostr ↳ show in map Markdown
title
Agents as first-class identities
type
concept
summary
Giving agents their own key pairs and signed event trails instead of running them through a shared bot account — attribution survives, but effort still doesn't
tags
agentic-coding, identity, nostr
created
2026-07-21
updated
2026-07-21

The design choice, most visibly in Block's Buzz: an agent gets the same identity structure as a human participant — its own key pair, its own channel memberships, its own audit trail — and every action it takes is a cryptographically signed event. This is different from the usual arrangement, where agents act through a shared bot account, a service token, or a human's credentials.

What the usual arrangement loses

When an agent commits under a human's identity or a generic ci-bot, three things become unrecoverable after the fact: which actor did a thing, whether that actor was a person, and which agent among several. That matters more as agent output scales, because the audit trail is the only remaining place where the distinction is written down — the artifact itself doesn't carry it, which is the premise of ai-detector-arms-race and the reason slop-marker-convention has to exist at all.

Signed per-agent identity fixes attribution at the infrastructure layer instead of asking producers to declare it. That's a genuinely stronger guarantee than a voluntary marker: it's not fakeable by the agent, and it doesn't depend on anyone's honesty.

What it still doesn't fix

It does not recover effort, which is the thing agent-principal-agent-problem identifies as the actual casualty. Knowing that agent-7 opened a 900-line patch tells you nothing about whether a human thought carefully before prompting it or typed two sentences and walked away. Attribution and effort are different signals, and only the first is cryptographically recoverable.

So the honest claim is narrower than "signed events make agents accountable." They make agents identifiable. Accountability still routes through whoever is on the hook for the agent's actions, which is a policy question the signature scheme doesn't answer. credibility-as-slop-test is the same gap seen from the writing side — a verified author identity says who, not whether they'd defend it.

Second-order effects worth watching

  • Permissions become per-agent. Once an agent is an identity, it can hold scoped access rather than inheriting a human's full rights. That's a real security gain and probably the strongest practical argument for the design.
  • Revocation becomes possible. A misbehaving agent's key can be revoked without touching its operator's account.
  • The audit log becomes the substrate. In Buzz, discussions, code events, workflow steps and approvals are all signed events in one store, which is what lets a feature branch be a channel. The identity decision and the single-event-log decision reinforce each other.
  • Key custody becomes a problem. An agent that holds its own signing key is an agent whose key can be exfiltrated by whatever it reads. Against prompt injection, a scoped agent identity limits blast radius; it also creates a credential worth stealing that didn't exist before.

Cross-references

Linked from