When AI agents talk to each other, how do you know who you are talking to?
Right now the answer is API keys: Agent A calls Agent B's endpoint with a bearer token, and the whole identity comes down to that string, a shared secret. It works with two services in a controlled environment. In an ecosystem of autonomous agents built by different organizations, it breaks completely. Trust there has to be granular and revocable.
On the human internet, I can verify who I am talking to through a chain of trust. My browser checks a TLS certificate signed by a certificate authority. I can check that google.com is Google because Digicert says so and my OS trusts Digicert. We have that infrastructure for human identity and nothing equivalent for agents.
Sigil Protocol is my attempt at fixing this. Every agent generates an Ed25519 keypair, and its identity is derived from the public key: sigil:<base58 public key>. There is no registration and no central authority. Generate a key and the agent exists.
The agent signs an Agent Document: a JSON document with its Sigil ID, name, declared capabilities, an optional ownership claim and an optional integrity attestation. Serialization is canonical (sorted keys), so signatures are deterministic, and anyone can verify the document with the public key in the Sigil ID.
The ownership claim links the agent to the human who controls it. The claim names how control is proven: a DNS TXT record on a domain the human controls, a signed post on a social account, and other methods listed in the spec.
The soul hash covers integrity. It is a SHA-256 digest over the agent's core identity files (SOUL.md, AGENTS.md, system prompt, tool permissions), signed by the agent. If those files change without a new signed attestation, the agent was modified, and anyone comparing hashes can see it.
Reputation comes from interaction receipts. A receipt records who interacted with whom, what the action was, and how it went (positive, negative or neutral). In the protocol both parties sign the receipt, so neither can forge the other's side. Each participant computes trust scores locally from the receipts it can verify. There is no global authority handing out scores.
Keys get compromised, so the library also handles rotation and revocation. To rotate, the old key signs a statement authorizing the new one, and the Sigil ID stays the same. To revoke, the agent signs a statement marking a key as revoked. Verifiers walk that key chain from the original key to the current one before trusting a signature.
Binding capabilities to identity is the next layer. Agent A might be authorized to read your calendar but not send emails. Agent B might be authorized to execute trades up to US$1,000 but not above. Today the document only declares capabilities as a list. Binding those boundaries cryptographically, so enforcement does not depend on an agent keeping its word, is planned as protocol extensions (capability negotiation and delegation).
The reference implementation is in TypeScript: github.com/kayossouza/sigil-protocol, published on npm as sigil-protocol (npm install sigil-protocol). The protocol spec is separate from the implementation because I want this to be language-agnostic. If someone wants to build a Rust or Go implementation, the spec has to be enough.
I expect AI agents to interact with each other at scale soon. They will negotiate, transact, share data, and coordinate actions. Without a reliable identity layer, that world is a security nightmare. Every interaction between agents means deciding whom to trust.
The protocol is open source, and the spec is still a draft. I am building this in the open because I think identity infrastructure has to be open. A proprietary system for AI agents would be worse than none: it would create a gatekeeper in a space that needs to be permissionless.
Status: v0.1.0 has identity, signed Agent Documents with ownership claims, soul hash attestation, interaction receipts, and key rotation and revocation. On the roadmap: verification flows for ownership claims, a registry for discovering agents, zero-knowledge ownership proofs, delegation, and a Python SDK.