# Agents as first-class identities

The design choice, most visibly in [[block-buzz-workspace|Block's Buzz]]: an agent gets the same identity structure as a human participant — its own key pair, its own channel memberships, its own audit trail — and every action it takes is a cryptographically signed event. This is different from the usual arrangement, where agents act through a shared bot account, a service token, or a human's credentials.

## What the usual arrangement loses

When an agent commits under a human's identity or a generic `ci-bot`, three things become unrecoverable after the fact: which actor did a thing, whether that actor was a person, and which agent among several. That matters more as agent output scales, because the audit trail is the only remaining place where the distinction is written down — the artifact itself doesn't carry it, which is the premise of [[ai-detector-arms-race]] and the reason [[slop-marker-convention]] has to exist at all.

Signed per-agent identity fixes attribution at the infrastructure layer instead of asking producers to declare it. That's a genuinely stronger guarantee than a voluntary marker: it's not fakeable by the agent, and it doesn't depend on anyone's honesty.

## What it still doesn't fix

It does not recover *effort*, which is the thing [[agent-principal-agent-problem]] identifies as the actual casualty. Knowing that `agent-7` opened a 900-line patch tells you nothing about whether a human thought carefully before prompting it or typed two sentences and walked away. Attribution and effort are different signals, and only the first is cryptographically recoverable.

So the honest claim is narrower than "signed events make agents accountable." They make agents *identifiable*. Accountability still routes through whoever is on the hook for the agent's actions, which is a policy question the signature scheme doesn't answer. [[credibility-as-slop-test]] is the same gap seen from the writing side — a verified author identity says who, not whether they'd defend it.

## Second-order effects worth watching

- **Permissions become per-agent.** Once an agent is an identity, it can hold scoped access rather than inheriting a human's full rights. That's a real security gain and probably the strongest practical argument for the design.
- **Revocation becomes possible.** A misbehaving agent's key can be revoked without touching its operator's account.
- **The audit log becomes the substrate.** In Buzz, discussions, code events, workflow steps and approvals are all signed events in one store, which is what lets a feature branch be a channel. The identity decision and the single-event-log decision reinforce each other.
- **Key custody becomes a problem.** An agent that holds its own signing key is an agent whose key can be exfiltrated by whatever it reads. Against prompt injection, a scoped agent identity limits blast radius; it also creates a credential worth stealing that didn't exist before.

## Cross-references

- [[block-buzz-workspace]] — the implementation this is drawn from
- [[agent-principal-agent-problem]] — the effort signal that identity does not restore
- [[slop-marker-convention]], [[human-made-disclosure]] — the voluntary-declaration alternatives
- [[toolbox/re_gent]] — per-prompt provenance for agent work, from the version-control side