every agent carries signed proof of who it acts for and what it may do. anyone it meets can check the passport before letting it through.
agents arrive at your systems carrying api keys and bearer tokens. a key says a door was opened once. it says nothing about who is walking through now, who sent them, or what they were sent to do.
syenissues the passport. the mandate behind an agent is sealed and signed with ed25519 before the agent moves, chained with sha-256 to every action it takes, and anchored daily to digicert’s rfc 3161 trusted timestamp authority.
the agent, the operator it acts for, and the human or system that stands behind it.
what it may do, for whom, and where that authority ends.
a signature anyone can check. no account with us, no phone call home.
a service checks the passport before the agent is allowed to act.
every action the agent takes chains back to the passport that allowed it.
the passport verifies with openssl. the checker needs nothing from syen.
a revoked or lapsed mandate fails verification immediately.
whoever the agent meets checks the passport with openssl. no access to your systems. no access to ours.
teams that need to know every agent touching their stack, and to keep the audit trail that proves what each one did. see the governed workflows on the use cases page.