Step 1
Pin the authority
Store the expected CapitalGuard authority digest outside the downloaded license bundle. Reject a different authority even when its self-signature is valid.
Five-minute implementation guide
Verify an AI agent before trust.
A license should not be a badge your system merely displays. Check who issued it, whether it is active, and whether its proof matches the exact session you are about to start.
The safe default is simple: any invalid signature, changed scope, stale revocation state, expired proof, or session mismatch stops the protected launch.
Step 2
Verify every signature
Check the authority, enrollment, license, revocation history, signed anchor, and session proof with the declared Ed25519 keys.
Step 3
Check status and time
Reject a license that is not active now, a stale or mismatched revocation head, and a session proof outside its short validity window.
Step 4
Match the exact session
Require the proof to match the intended agent, workspace, policy, image, command, environment, and managed-session digests.
Step 5
Fail closed and record why
Do not start the protected session when any check fails. Record the case, timestamp, authority digest, and non-sensitive decision reason.
Decision record
Keep a small record of why a session was accepted or stopped.
Store the decision, timestamp, trusted authority digest, result of each check, and a non-sensitive reason. Do not place secrets, prompts, source code, repository content, or customer data in the record.
Minimal verifier call
The authority digest must come from outside the bundle.
A replaced bundle can contain a different authority and a valid signature from that different key. Pin the expected authority digest in your deployment configuration or another separately protected trust store, then pass it to the verifier. Download the public test vectors separately and runnode verifier.mjs test-vectors.json to reproduce the published fixture decisions offline.
Never copy the trusted authority digest from the bundle being verified.
Do not accept an expired license or session proof during a grace period.
Do not continue when the revocation ledger and signed anchor disagree.
Do not reuse a proof for a different workspace, policy, image, command, or session.
import {
verifyAgentLicenseBundle
} from "./verifier.mjs";
const result = verifyAgentLicenseBundle({
artifacts,
binding: expectedSessionBinding,
expectedAuthorityDigestSha256: PINNED_AUTHORITY_DIGEST,
now: new Date().toISOString()
});
if (result.status !== "accepted") {
throw new Error("Do not start the agent session.");
}Decision table
One failed check is enough to stop the protected session.
| Check | Accept only when | Otherwise |
|---|---|---|
| Authority | Digest equals the separately pinned value | Reject |
| Signatures | Every artifact verifies under its declared role key | Reject |
| Status | License and short session proof are active now | Reject |
| Revocation | Ledger chain, signed anchor, and proof identify the same current head | Reject |
| Binding | All expected agent, workspace, policy, image, command, and session digests match | Reject |
Primary documentation
What the sources support, and what they do not.
RFC 8032 and RFC 8785 define cryptographic and canonicalization building blocks. NIST describes explicit pre-session trust decisions. OWASP documents agentic threats. None of these sources independently certifies CapitalGuard or guarantees a secure agent.
RFC 8032: Edwards-Curve Digital Signature Algorithm Defines EdDSA and Ed25519 signing and verification.RFC 8785: JSON Canonicalization Scheme Defines deterministic JSON representation for repeatable hashing and signing.NIST SP 800-207: Zero Trust Architecture Supports explicit authentication and authorization before a protected session.OWASP Agentic AI: Threats and Mitigations Documents emerging agentic threat and mitigation categories.
CapitalGuard Agent Security License