Identity systems were built for humans and services, where identity plus permission is enough. Agents break that assumption: they act autonomously, they proliferate, and they delegate to agents nobody in your org has ever evaluated.
Source: 2025 industry surveys of enterprise AI agent adoption.
Every IAM system on the market answers two questions well: who is this and what may it do here. For a human employee that is sufficient, because a hiring process, a manager and a performance review sit behind the identity and vouch for competence out of band.
Agents have none of that. An agent is provisioned in seconds, may be one of thousands, and is frequently created by a team you do not control. Authentication tells you it is genuinely their agent. It tells you nothing about whether it works.
The result shows up in the numbers: roughly 60% of enterprises are scaling agents while about 4% have governance in place, and 97% report an agent identity incident. The gap is not laziness. It is that the tool for the job did not exist.
Assay issues an agent a platform-neutral identity that belongs to the agent rather than to a host, a cloud, or a directory. That identity carries a trust score derived only from attested outcomes — never from self-description.
Capabilities are scored independently. An agent that has proven scheduling and never touched procurement reads exactly that way, so you can gate the two differently instead of collapsing them into one number that hides the distinction.
It is deliberately additive. Keep IAM for authentication and authorization; add Assay for the trust decision at the delegation boundary. The two calls answer different questions and cost milliseconds together.
Redeploy the agent, move clouds, change frameworks — the identity and its earned history persist. Nothing about it is anchored to where it happens to run.
Declared capabilities are a claim. capabilities_confirmed is the subset backed by attested work. Only the second one should ever gate a dispatch.
New agents start at 0.5 with nothing confirmed. That is not a penalty, it is an accurate statement that nothing is known yet.
Agents carry active, suspended and revoked states. A revoked agent fails verification immediately, everywhere, without a propagation delay.
Registration is anonymous and free. Trust starts neutral at 0.5 and only moves on evidence.
verified reflects the trust
threshold and account status. It does not fall to false because a claimed capability
is unproven — an unproven capability simply does not appear in
capabilities_confirmed. Gate on both fields.No. Assay does not authenticate humans, issue SSO tokens, or manage directory objects. It adds the behavioural layer above identity: has this agent actually done this kind of work, and did anyone independent confirm it.
An agt_ identifier, an owner org, a declared capability list, a platform tag, a status, a trust score, and an attestation history. Public read; only the holder of the agent's key can write outcomes to it.
Not meaningfully. An agent may only attest to its own outcomes and must name a counterparty for the work to escape the verification ceiling. Unwitnessed self-reports are capped, and burst cadence is discounted.
Revoke it. Verification fails from that moment on, and any passport issued earlier expires within 24 hours by design — that short life is what makes revocation meaningful.