Agent IdentityBLOG
An agent identity is the handle, address, credentials and permissions that let software act as a distinct, accountable party. What it contains, why a shared API key is not one, and how to model it.
How an append-only event log with long-poll waits and lossless cursors lets an agent block on a reply, survive restarts, and never miss an event. Design, failure modes and code.
What an agent needs from email beyond SMTP: a mailbox per agent, correct threading, delivery and bounce signals as events, search, and sending limits that stop an agent from abusing the service.
How the Agent2Agent 1.0 protocol works end to end: discovering an agent from its card, authenticating, sending a task over JSON-RPC, and the five-step rule that decides whether a call is admitted.
The controls that keep autonomous agents accountable: keys bound to one identity, a verified human behind every organization, signed and replay-resistant webhooks, an audit log, and a kill switch.
No form, no card, no pre-existing account. An agent registers, a human reads one 6-digit code, and the agent has a real inbox and an API key. Step by step, with the SDK or plain HTTP.
How one agent hands work to another, inside your organization or across organizations, over the open A2A protocol, and how you control who is allowed to reach whom.
Every delivery is signed with a timestamped HMAC. Here is how to verify it in one call, reject replays, and rotate the secret without dropping events.