Agent Identity
You cannot govern an agent you cannot name. Identity is the durable, attributable record of who is acting.
Why identity comes first
The product rule — which agent is doing what, and should it be allowed — cannot be answered without a durable, attributable identity for every agent. Identity answers "which agent is acting?" and creates accountability: ownership, a session lineage, a trust score, and a capability profile. It works locally and offline, and it uploads nothing beyond metadata (ADR-RGOV-009).
The identity contract
AgentIdentity is a first-class contract with eight fields: agentId, agentType, owner, workspace, sessionId, capabilities, authorizationScope, and trustScore. Identity is the join point between what an agent can do (capabilities, from Review) and what it may do (authorization scope, consumed by Authorization).
interface AgentIdentity {
agentId: string; // "agent_<type>:<workspace-scoped>"
agentType: string; // "claude-code" | "cursor" | "copilot" | ...
owner: string; // who provisioned this agent
workspace: string; // workspace the agent operates within
sessionId: string; // current session
capabilities: Capability[]; // what Review detected it can do
authorizationScope: string[]; // what it is granted to do
trustScore: number; // integer [0, 100]; default 50
}Trust is earned, not assumed
Trust score is an integer from 0 to 100 and defaults to 50 — conservative on purpose. A newly seen agent is neither trusted nor distrusted; it earns or loses standing from observed behavior. Identity makes that score attributable to a specific agent, owner, and session instead of a faceless process.
The capability profile
Review populates the capabilities field: repository read and write, shell execution, MCP tool access, database access, secret access, deploy. The capability profile is the honest inventory of what an agent can reach. Authorization then compares it against what the agent was granted — and the difference is where governance begins.
Website install extension Agent Environment Review findings upgrade
Govern your own environment
Install the extension, run an Agent Environment Review, and act on the findings — upgrade when you want unlimited reviews.