Identity at creation, not discovered after the incident. Every agent is born with a named owner, scoped tools, an expiry, and a kill switch.
A team proposes an agent: its name, a named owner, the tools and scopes it needs, and an expiry.
No named owner, no identity — provisioning refuses. Scopes are checked against the request before anything is minted.
The identity record is issued as JSON + Markdown: owner, scopes, expiry and rotation, provenance hash — and it enters the Identity Graph every other product reads.
Orphans and over-scope are detected against the registry; expiry and rotation are enforced; revocation — the kill switch — never waits for a gate.
The Birth Certificate flow, walked stage by stage: a spec goes in, an identity comes out.
Owner check — a named human owns this agent — provisioning is fail-closed without one
Scope check — two read scopes requested; no write or delete scope to justify
Expiry check — a 1-hour expiry with rotation — no standing credential
Per agent