Verify
Checks which agent is calling, who built it, and whose behalf it is acting on, before your systems act on its request.
The problem
An agent's description of itself is just text. A2A lets providers sign their Agent Cards (a JWS signature over a canonicalized card), which proves the card came from whoever holds the key.
A business receiving a request still needs to know whether that key belongs to a reputable provider, and whether this request comes from a real customer's agent or from an automated abuse campaign.
How it works
- Validate the Agent Card signature and the signing key.
- Match the key to a known provider record.
- Assess the request: history, rate, and reported abuse.
- Return a verdict your policy uses: allow, ask for more proof, or refuse.
Open standards
A2A defines how Agent Cards are signed and verified. Verify adds provider identity and reputation on top of that signature.
Availability
In development.
Questions
- Does Verify authenticate our customer?
- No. Verify is about the agent. Proof that the customer authorized an action comes from Mandate.
Next module: Mandate