Bring the tool you already use to check software.
Every stage names a role, not a product. A code scanner, a red-team suite, a build provenance service or a monitoring platform can hold the role that checks the same thing for agents. What it checked leaves as signed evidence that anyone can verify, and the tool can also sign an attestation of its own.
Here are the roles a checking tool can hold.
Each role makes evidence at its stage. The right-hand column names the areas of the published check list that evidence can speak to. The list has eleven areas, from who the agent is to how it ends.
| Role, at its stage | The evidence it makes | Areas it speaks to |
|---|---|---|
| security reviewer, at Security review | findings from a code, dependency or secrets scan, for example as SARIF | Reach, Authority, Inside the agent |
| code critic, at Review | review findings, each naming a place, a claim and a consequence | Provenance |
| test writer, at Test | the suite and its results, including refusal tests | Provenance |
| package maker, at Package and Release | a signed build record: who built it, from what, under which digest | Provenance |
| conformance checker, at Conformance | a signed verdict, case by case, against the agent's declaration | Identity, Authority, Provenance |
| agent critic, at Eval | graded judgments and red-team results, against a standard set beforehand | Inside the agent, People in the loop |
| watcher, at Monitor and Cost | whether it is alive and answering, alerts with an owner, and what it spent against its ceilings | Watching, Spend, Records |
| incident recorder, at Incident response | a timeline of each incident, every fact with its source | Watching, Records |
| deployment manager, at Deploy through Decommission | signed deployment and change records: credentials placed by name, ceilings set, what changed and why | Identity, Reach, Spend, Change, Stopping |
The network that carries the agent's messages makes evidence too, such as delivery receipts and the messages it stopped. It can speak to Reach, Records and Stopping.
There are two ways in, and a tool can take both.
- Make evidence. Hold a role and hand back what your tool already produces, signed with your key. An attestation names each piece of evidence by its digest and names you as its producer, so a reader can follow it back to your report.
- Be the attester. Read the evidence others made, hold it against the published check list, and sign one summary for one version of the agent. Anyone can be an attester. The further you are from the people who built and run the agent, the more your attestation is worth, and the document shows that distance because it names every producer.
Here is what you sign.
An attestation follows the shape of SLSA's Verification Summary Attestation. It is an in-toto Statement v1 in a DSSE envelope, so the tools that already store and verify those can handle it. It holds:
- the agent's name and the digest of the version checked
- who attested, whose key signs the envelope
- when it was checked, and when it goes stale at the latest
- the check list it was held to, by address and version, so what "passed" meant cannot change afterwards
- each of the eleven areas as passed, failed or not attested, with the result of every check inside it
- the evidence it relied on, each piece by digest with its producer
- a short summary in words
It replaces nothing. The build record, the deployment record, the verdict and your scan report keep their own signatures, and the attestation sits over them. The full format, with a worked example, is the agent attestation standard.
Here are the rules a reader applies.
- Not attested is not failed. Attest only the checks your tool has evidence for, and mark the rest not attested. A narrow attestation that is right is worth more than a wide one that guesses.
- One per version. A new version of the agent makes every earlier attestation stale, and so does the date it names.
- The reader chooses whom to trust. Nothing ranks attesters. A reader decides which names they accept, which is why your name is on every one.
- Self-attested says so. When the attester also built or runs the agent, the document shows it.
Attestations are carried in the agent's AgentDoc, under "checked by others", beside the claims they speak to. A lifecycle that runs these stages can call your tool at its stage through the API.
Every attestation you sign also feeds the agent's Agent Rating, a grade from AAA to D worked out from its current attestations. Your checks move your customers' agents up the scale.
Here is how to start.
- Read the attestation standard and the role your tool fits.
- Take the check list and mark the checks your tool already answers.
- Sign your report as evidence, an attestation over those checks, or both, and publish your public key so readers can verify it.