Agent Identity and Attestation: From Digital Shapeshifting to Compliance Verification
Table of Contents
Agent identity spans two problems: who acted (attribution) and who claims what (attestation). This note connects the digital shapeshifting framework (LITCon 2025) to the Walsh-Research compliance spec (v1.3) and the emerging regulatory landscape.
1. The paper
Digital Shapeshifting: Identity Delegation and Attribution in AI-Assisted Development (Walsh, Tao, Kumar, Pace – April 2025).
The paper introduces temporary identity delegation with clear boundaries:
an AI agent acts under a human's identity with structured attribution via
git trailers (Co-Authored-By, Sudo-By).
2. Four pillars
| Pillar | Question | Research |
|---|---|---|
| Identity/Attestation | Who claims to be what? | This note + shapeshifting paper |
| Access/Compliance | What must a bot do when fetching? | Walsh-Research spec v1.3 (R1-R13) |
| Sandbox/Governance | Where does the code run? | Agent Sandbox Architectures |
| Memory/State | What persists across sessions? | Agent Memory Systems |
Walsh-Research/1.2 is a delegated identity with R13 tagging for
attribution. The Co-Authored-By trailers in every commit are the
git-native form of the same pattern.
3. Attestation research findings
3.1. Convergence evidence
Direct fetch of the HDP paper's own abstract (=arXiv:2604.04522=, "HDP: A Lightweight Cryptographic Protocol for Human Delegation Provenance in Agentic AI Systems", Asiri Dalugoda) confirms the structure claimed here word for word: an HDP token "records each agent's delegation action as a signed hop in an append-only chain," verification is offline against "the issuer's Ed25519 public key," and the chain is anchored to a human authorization event -- i.e. Ed25519-signed, append-only, human-anchored, as stated.
The HDP Protocol (arXiv:2604.04522) independently arrived at the
same delegation chain structure as the Sudo-By trailer: Ed25519-signed,
append-only, human-anchored.
A revision pass on the shapeshifting paper itself (litcon-2025 PR #164, checked 2026-10-10) found the same convergence from the other direction: "an action taken with jwalsh's token is jwalsh's in GitHub's log. The agent appears only in trailers the agent wrote itself." That is this note's own premise, arrived at independently while auditing the original paper's case study rather than proposing attribution infrastructure – the audit trail's blind spot is exactly the gap the trailer convention exists to fill.
3.2. The VS Code Copilot incident (March 2025)
GitHub's auto-attribution of Copilot contributions without explicit consent triggered community backlash. Validates the consent-first design in the shapeshifting paper: delegation must be explicit, not inferred.
3.3. Novel contributions
The Trailer Consistency Score (TCS) metric is novel. No existing work quantifies trailer consistency as a governance metric. TCS measures whether attribution trailers are present, well-formed, and consistent across a repository's commit history.
4. Gaps to address
Direct fetch of the behavioral-fingerprinting paper's abstract (=arXiv:2601.17406=, "Fingerprinting AI Coding Agents on GitHub", Taher A. Ghaleb) shows the 97.2% figure is an F1-score on multi-class agent identification, not an accuracy figure -- the two metrics differ and the note's wording has been corrected below. The paper analyzes 33,580 pull requests from five agents (OpenAI Codex, GitHub Copilot, Devin, Cursor, Claude Code) over 41 features.
Five gaps identified for the next revision of the paper:
- Cryptographic maturity continuum. Position git trailers as the pragmatic entry point, with Sigstore and HDP as the cryptographic upgrade path. Trailers are unsigned claims; Sigstore adds OIDC-bound signatures; HDP adds delegation chains.
- HDP + Agentic JWT citation. Formal analogues to the social/procedural approach in the shapeshifting paper. The math exists; cite it.
- AIBOM alignment. The trailers are a minimal AI Bill of Materials embedded in git history. Frame them in AIBOM terms for the supply-chain audience.
- Behavioral fingerprinting (arXiv:2601.17406). 97.2% F1-score on multi-class agent identification from code patterns, across five coding agents. Complementary to voluntary disclosure – even without trailers, the code itself is a signal.
- Cisco's alternative model. Distinct non-human identities (each agent
gets its own account) vs. the delegation model (agent acts under
human's identity with attribution). Engage with the tradeoff: Cisco's
model is cleaner for audit but breaks the
git blamehuman-readable invariant.
5. Regulatory context
Direct check of the EU AI Act's own Article 50 text confirms both claims exactly: Article 50 becomes applicable 2 August 2026 (per Article 113), and Article 50(2) requires that outputs of AI systems generating synthetic content be "marked in a machine-readable format and detectable as artificially generated or manipulated."
EU AI Act Article 50 becomes enforceable August 2026. It requires machine-readable AI content attribution. The git trailer framework is ahead of current requirements – structured, machine-readable, embedded in the artifact's version history.
The Walsh-Research compliance spec's R1 (exact UA with policy URL) and
R13 (implementation tagging) satisfy the "machine-readable AI
attribution" requirement for HTTP traffic. The Co-Authored-By trailer
satisfies it for source code.
6. Connection to the compliance harness
The 29-language compliance harness (walsh/compliance-harness) demonstrates that identity attestation works at scale across languages. Each implementation:
- Declares identity:
Walsh-Research/1.2in the UA (R1) - Tags provenance:
?impl={org/repo}&sha={sha}(R13) - Persists attribution:
Co-Authored-Byin the commit trailer - Survives audit: access logs + git history + git notes
The access log is the external oracle. Git is the internal ledger. The two together form a verifiable attribution chain from HTTP request to source commit.
7. Attestation tiers
[[file:../bots/index.org][bot attestation research]] does not contain this table -- its own four tiers are a different axis entirely (mechanism of verification: bare UA assertion, email contact in UA, +URL convention, reverse-DNS/IP allowlist, Web Bot Auth), not audit maturity (undeclared, claimed, published contract, third-party audited). The attribution below is corrected to not claim this table is sourced from that file. Separately, =draft-meunier-web-bot-auth-architecture-05= has expired on the IETF datatracker and been replaced by =draft-meunier-webbotauth-httpsig-protocol= -- a drift since this note was written, not a correction of what it originally described. R1 (exact UA with policy URL) and R13 (implementation tagging) as characterized in this note match [[file:../bots/compliance-spec.org][the compliance spec's]] own definitions exactly.
A maturity framework for attestation claims (distinct from the mechanism-based tiers in bot attestation research):
| Tier | Name | What it proves |
|---|---|---|
| 0 | Undeclared | Nothing – no UA, no policy |
| 1 | UA assertion only | Claims an identity |
| 2 | UA + policy URL | Claims an identity with a published contract |
| 3 | Verifiable contract | Published spec, test fixtures, self-audit |
| 4 | Third-party audited | External verification of claims |
Walsh-Research is tier 3. The gap to tier 4 is third-party audit – the compliance harness with 29 independent implementations is evidence toward that claim but is self-operated, not independently verified.
Web Bot Auth (draft-meunier-web-bot-auth-architecture-05) adds cryptographic bot identity. When combined with the attestation tier model, it would elevate R1 from declared identity to verified identity.
8. Related
- Digital Shapeshifting (PDF) – the LITCon 2025 paper
- Walsh-Research Compliance Spec (v1.3) – the bot behavior contract
- Agent Sandbox Architectures – where the code runs
- Agent Memory Systems – what persists
- REPL-Driven Compliance – 29-language implementation
- CPRR Methodology – the lifecycle model
- A Practical Layout for Agent Identities – where the credentials an agent holds sit on disk: person, role, project
- JSON Web Tokens – the JWT substrate under Agentic JWT; alg confusion, RFC 8725, DPoP, workload identity
- walsh/compliance-harness – 29-language harness repo
- defrecord/litcon-2025 – LITCon 2025 materials
Seen at
- Apollo GraphQL Summit 2026 — Intuit and 10KR: on whose behalf an agent acts, what it may see, and what happened afterwards.
- Atlassian Team '26 Europe: Operationalize Rovo agents — agent accounts as a governed identity.
- Atlassian Team '26 Europe: Groundwork: Forge pipeline — the
asAppversusasUseridentity choice for Forge app calls. - Official Cybersecurity Summit Boston 2026 — Mimecast: agents hold credentials and act for the business, so measure their visibility, policy adherence and detection alongside humans'.
- AgentCon Boston 2025 — NANDA (Raskar, Gorskikh): naming, discovery and trust between agents owned by different parties.