diff --git a/fix-lint.sh b/fix-lint.sh new file mode 100755 index 00000000..ecdfb51b --- /dev/null +++ b/fix-lint.sh @@ -0,0 +1,19 @@ +#!/bin/bash +# Fix apostrophe and quote escaping issues + +# identity/page.tsx line 355 +sed -i "" "s/agent's identity/agent\'s identity/g" src/app/identity/page.tsx + +# identity/auth/page.tsx +sed -i "" "s/Don't reveal/Don\'t reveal/g" src/app/identity/auth/page.tsx +sed -i "" "s/aren't you/aren\'t you/g" src/app/identity/auth/page.tsx + +# identity/trust/page.tsx +sed -i "" "s/agent's trustworthiness/agent\'s trustworthiness/g" src/app/identity/trust/page.tsx + +# identity/decentralized/page.tsx +sed -i "" "s/It's a URL-like/It\'s a URL-like/g" src/app/identity/decentralized/page.tsx +sed -i "" "s/agent.createdAt > 2023-01-01\"/agent.createdAt \> 2023-01-01\"/g" src/app/identity/decentralized/page.tsx +sed -i "" 's/"trustScore > 750"/\"trustScore \> 750\"/g' src/app/identity/decentralized/page.tsx +sed -i "" 's/"has capability X"/\"has capability X\"/g' src/app/identity/decentralized/page.tsx + diff --git a/src/app/identity/auth/page.tsx b/src/app/identity/auth/page.tsx new file mode 100644 index 00000000..e5c6f777 --- /dev/null +++ b/src/app/identity/auth/page.tsx @@ -0,0 +1,775 @@ +"use client"; + +import { useState } from "react"; +import Link from "next/link"; +import { Key, Lock, Server, CheckCircle, XCircle } from "lucide-react"; + +interface AuthMethod { + name: string; + icon: string; + difficulty: string; + security: string; + scalability: string; + useCases: string[]; + pros: string[]; + cons: string[]; +} + +const AUTH_METHODS: AuthMethod[] = [ + { + name: "API Keys", + icon: "πŸ”‘", + difficulty: "Easy", + security: "Low-Medium", + scalability: "High", + useCases: ["Simple integrations", "Development/testing", "Read-only access"], + pros: ["Simple to implement", "No complex flows", "Widely supported"], + cons: ["Hard to rotate", "Easily leaked", "No expiration", "All-or-nothing permissions"], + }, + { + name: "OAuth 2.0", + icon: "πŸ”", + difficulty: "Medium", + security: "High", + scalability: "High", + useCases: ["User-delegated access", "Third-party integrations", "Multi-tenant apps"], + pros: ["Industry standard", "Granular scopes", "Token refresh", "User consent flow"], + cons: ["Complex implementation", "Redirect flows needed", "Token storage required"], + }, + { + name: "JWT (JSON Web Tokens)", + icon: "🎫", + difficulty: "Medium", + security: "Medium-High", + scalability: "High", + useCases: ["Stateless auth", "Microservices", "Agent-to-agent communication"], + pros: ["Self-contained", "No server state", "Standardized format", "Can embed claims"], + cons: ["Cannot revoke easily", "Larger than opaque tokens", "Clock skew issues"], + }, + { + name: "mTLS (Mutual TLS)", + icon: "πŸ”’", + difficulty: "Hard", + security: "Very High", + scalability: "Medium", + useCases: ["High-security environments", "Agent-to-agent trust", "Zero-trust networks"], + pros: [ + "Cryptographic proof", + "Transport-layer security", + "No credentials in app layer", + "Mutual authentication", + ], + cons: ["Complex PKI setup", "Certificate management overhead", "Harder to debug"], + }, +]; + +const COMPARISON_MATRIX = [ + { + criterion: "Setup Complexity", + apiKey: "⭐", + oauth: "⭐⭐⭐", + jwt: "⭐⭐", + mtls: "⭐⭐⭐⭐", + }, + { + criterion: "Security Level", + apiKey: "⭐⭐", + oauth: "⭐⭐⭐⭐", + jwt: "⭐⭐⭐", + mtls: "⭐⭐⭐⭐⭐", + }, + { + criterion: "Rotation Ease", + apiKey: "⭐", + oauth: "⭐⭐⭐⭐", + jwt: "⭐⭐⭐", + mtls: "⭐⭐", + }, + { + criterion: "Granular Permissions", + apiKey: "⭐", + oauth: "⭐⭐⭐⭐⭐", + jwt: "⭐⭐⭐⭐", + mtls: "⭐⭐", + }, + { + criterion: "Scalability", + apiKey: "⭐⭐⭐⭐⭐", + oauth: "⭐⭐⭐⭐", + jwt: "⭐⭐⭐⭐⭐", + mtls: "⭐⭐⭐", + }, + { + criterion: "Revocation Speed", + apiKey: "⭐⭐⭐", + oauth: "⭐⭐⭐⭐", + jwt: "⭐", + mtls: "⭐⭐⭐⭐", + }, +]; + +const CODE_EXAMPLES = { + apiKey: { + server: `// Server-side verification +import crypto from 'crypto'; + +const API_KEYS = new Map([ + ['agent-123', { hash: '...', permissions: ['read', 'write'] }] +]); + +function validateApiKey(req: Request): boolean { + const apiKey = req.headers.get('X-API-Key'); + if (!apiKey) return false; + + const agentId = apiKey.split('-')[1]; + const stored = API_KEYS.get(agentId); + + if (!stored) return false; + + // Compare hashes (constant-time) + const hash = crypto.createHash('sha256').update(apiKey).digest('hex'); + return crypto.timingSafeEqual( + Buffer.from(hash), + Buffer.from(stored.hash) + ); +}`, + client: `// Client-side usage +const API_KEY = process.env.MY_API_KEY; + +const response = await fetch('https://api.example.com/data', { + headers: { + 'X-API-Key': API_KEY, + 'Content-Type': 'application/json' + } +}); + +if (response.status === 401) { + throw new Error('Invalid or expired API key'); +}`, + }, + oauth: { + server: `// OAuth 2.0 Authorization Server +import { OAuth2Server } from 'oauth2-server'; + +const oauth = new OAuth2Server({ + model: { + getAccessToken: async (token) => { + // Fetch from DB + return db.accessTokens.findOne({ token }); + }, + getClient: async (clientId, clientSecret) => { + return db.clients.findOne({ clientId, clientSecret }); + }, + saveToken: async (token, client, user) => { + return db.accessTokens.create({ + accessToken: token.accessToken, + accessTokenExpiresAt: token.accessTokenExpiresAt, + refreshToken: token.refreshToken, + refreshTokenExpiresAt: token.refreshTokenExpiresAt, + scope: token.scope, + client: client.id, + user: user.id + }); + }, + } +}); + +// Token endpoint +app.post('/oauth/token', async (req, res) => { + const request = new OAuth2Server.Request(req); + const response = new OAuth2Server.Response(res); + + try { + const token = await oauth.token(request, response); + res.json(token); + } catch (err) { + res.status(err.code || 500).json(err); + } +});`, + client: `// OAuth 2.0 Client (Authorization Code Flow) +import { AuthorizationCode } from 'simple-oauth2'; + +const client = new AuthorizationCode({ + client: { + id: process.env.CLIENT_ID, + secret: process.env.CLIENT_SECRET + }, + auth: { + tokenHost: 'https://auth.example.com', + tokenPath: '/oauth/token', + authorizePath: '/oauth/authorize' + } +}); + +// Step 1: Redirect to authorization URL +const authUrl = client.authorizeURL({ + redirect_uri: 'https://myagent.com/callback', + scope: 'read:data write:data', + state: randomString(32) +}); + +// Step 2: Handle callback +const tokenParams = { + code: req.query.code, + redirect_uri: 'https://myagent.com/callback', + scope: 'read:data write:data', +}; + +const accessToken = await client.getToken(tokenParams); +console.log('Access Token:', accessToken.token.access_token); + +// Step 3: Use token +const response = await fetch('https://api.example.com/data', { + headers: { 'Authorization': \`Bearer \${accessToken.token.access_token}\` } +});`, + }, + jwt: { + server: `// JWT Verification (Server-side) +import jwt from 'jsonwebtoken'; + +const JWT_SECRET = process.env.JWT_SECRET; +const JWT_PUBLIC_KEY = process.env.JWT_PUBLIC_KEY; // For RSA + +function verifyJWT(token: string): any { + try { + // Symmetric (HS256) + const decoded = jwt.verify(token, JWT_SECRET, { + algorithms: ['HS256'], + issuer: 'https://auth.example.com', + audience: 'https://api.example.com' + }); + + // Asymmetric (RS256) - recommended for production + // const decoded = jwt.verify(token, JWT_PUBLIC_KEY, { + // algorithms: ['RS256'] + // }); + + return decoded; + } catch (err) { + if (err.name === 'TokenExpiredError') { + throw new Error('JWT expired'); + } + if (err.name === 'JsonWebTokenError') { + throw new Error('Invalid JWT'); + } + throw err; + } +} + +// Middleware +app.use((req, res, next) => { + const authHeader = req.headers.authorization; + if (!authHeader?.startsWith('Bearer ')) { + return res.status(401).json({ error: 'Missing token' }); + } + + const token = authHeader.substring(7); + try { + req.user = verifyJWT(token); + next(); + } catch (err) { + res.status(401).json({ error: err.message }); + } +});`, + client: `// JWT Creation and Usage (Client-side) +import jwt from 'jsonwebtoken'; + +const JWT_PRIVATE_KEY = process.env.JWT_PRIVATE_KEY; // RSA private key + +// Create JWT +const payload = { + sub: 'agent-550e8400-e29b-41d4-a716-446655440000', + name: 'CodeAssist', + capabilities: ['code_generation', 'file_system'], + iat: Math.floor(Date.now() / 1000), + exp: Math.floor(Date.now() / 1000) + (60 * 60), // 1 hour + iss: 'https://myagent.com', + aud: 'https://api.example.com' +}; + +const token = jwt.sign(payload, JWT_PRIVATE_KEY, { + algorithm: 'RS256', + header: { kid: 'agent-key-2024-01' } +}); + +// Use JWT +const response = await fetch('https://api.example.com/execute', { + method: 'POST', + headers: { + 'Authorization': \`Bearer \${token}\`, + 'Content-Type': 'application/json' + }, + body: JSON.stringify({ action: 'generate_code' }) +});`, + }, + mtls: { + server: `// mTLS Server Configuration +import https from 'https'; +import fs from 'fs'; + +const options = { + key: fs.readFileSync('server-key.pem'), + cert: fs.readFileSync('server-cert.pem'), + ca: fs.readFileSync('ca-cert.pem'), // CA that signed client certs + requestCert: true, // Request client certificate + rejectUnauthorized: true, // Reject invalid certs +}; + +https.createServer(options, (req, res) => { + const cert = req.socket.getPeerCertificate(); + + if (!cert || !cert.subject) { + res.writeHead(401); + res.end('Client certificate required'); + return; + } + + // Verify certificate attributes + const agentId = cert.subject.CN; // Common Name + const orgUnit = cert.subject.OU; // Organizational Unit + + console.log(\`Authenticated agent: \${agentId}\`); + console.log(\`Cert fingerprint: \${cert.fingerprint}\`); + + // Process request from verified agent + res.writeHead(200); + res.end(\`Hello \${agentId}\`); +}).listen(8443); + +console.log('mTLS server listening on port 8443');`, + client: `// mTLS Client Configuration +import https from 'https'; +import fs from 'fs'; + +const options = { + hostname: 'api.example.com', + port: 8443, + path: '/agent/execute', + method: 'POST', + key: fs.readFileSync('client-key.pem'), + cert: fs.readFileSync('client-cert.pem'), + ca: fs.readFileSync('ca-cert.pem'), + rejectUnauthorized: true, // Verify server cert +}; + +const req = https.request(options, (res) => { + console.log(\`Status: \${res.statusCode}\`); + res.on('data', (d) => { + process.stdout.write(d); + }); +}); + +req.on('error', (err) => { + console.error('mTLS error:', err); +}); + +req.write(JSON.stringify({ action: 'list_capabilities' })); +req.end(); + +// Using fetch with mTLS (Node 18+) +import { Agent } from 'https'; + +const agent = new Agent({ + cert: fs.readFileSync('client-cert.pem'), + key: fs.readFileSync('client-key.pem'), + ca: fs.readFileSync('ca-cert.pem'), +}); + +const response = await fetch('https://api.example.com:8443/agent/execute', { + method: 'POST', + // @ts-ignore + agent, + body: JSON.stringify({ action: 'list_capabilities' }) +});`, + }, +}; + +export default function AuthenticationPatternsPage() { + const [selectedMethod, setSelectedMethod] = useState("apiKey"); + const [viewMode, setViewMode] = useState<"server" | "client">("server"); + + return ( +
+ {/* Header */} +
+
+ +

Authentication Patterns for Agents

+
+

+ Comprehensive guide to authentication methods for AI agents: API keys, OAuth 2.0, JWT, mTLS, and agent-to-agent + auth. Compare trade-offs and implement with production-ready code. +

+ + ← Back to Identity Hub + +
+ + {/* Quick Comparison */} +
+

Authentication Methods: Quick Comparison

+
+ + + + + + + + + + + + {COMPARISON_MATRIX.map((row) => ( + + + + + + + + ))} + +
CriterionAPI KeyOAuth 2.0JWTmTLS
{row.criterion}{row.apiKey}{row.oauth}{row.jwt}{row.mtls}
+
+

+ ⭐ = Rating (more stars = better for that criterion). Choose based on your security requirements, infrastructure + complexity, and scalability needs. +

+
+ + {/* Method Details */} +
+

Authentication Method Details

+
+ {AUTH_METHODS.map((method) => ( +
+
+
+ {method.icon} +

{method.name}

+
+
+ +
+
+
Difficulty
+
+ {method.difficulty} +
+
+
+
Security
+
{method.security}
+
+
+
Scalability
+
{method.scalability}
+
+
+ +
+

Best For:

+
    + {method.useCases.map((useCase) => ( +
  • + βœ“ + {useCase} +
    • + ))} +
+
+ +
+
+

Pros:

+
    + {method.pros.map((pro) => ( +
  • + + {pro} +
    • + ))} +
+
+
+

Cons:

+
    + {method.cons.map((con) => ( +
  • + + {con} +
    • + ))} +
+
+
+
+ ))} +
+
+ + {/* Code Examples */} +
+

Implementation Guide

+

+ Production-ready code examples for each authentication method. Select server or client perspective, copy and + adapt for your agent. +

+ + {/* Method Selector */} +
+ + + + +
+ + {/* View Mode Toggle */} +
+ + +
+ + {/* Code Display */} +
+ 
+            
+              {
+                CODE_EXAMPLES[selectedMethod as keyof typeof CODE_EXAMPLES][
+                  viewMode as keyof (typeof CODE_EXAMPLES)[keyof typeof CODE_EXAMPLES]
+                ]
+              }
+            
+
+
+
+ + {/* Agent-to-Agent Auth */} +
+

Agent-to-Agent Authentication

+

+ When agents communicate directly, traditional user-centric auth patterns don't fit. Use these specialized + patterns for agent-to-agent trust: +

+ +
+
+

1. Pre-Shared Keys (PSK)

+

+ Simple symmetric key exchange. Both agents know the secret. Fast but requires secure key distribution. +

+ 
+              {`// Agent A sends request
+const sharedSecret = process.env.AGENT_SHARED_SECRET;
+const timestamp = Date.now();
+const payload = { from: 'agent-a', to: 'agent-b', timestamp };
+const signature = crypto.createHmac('sha256', sharedSecret)
+  .update(JSON.stringify(payload))
+  .digest('hex');
+
+await fetch('https://agent-b.example.com/rpc', {
+  method: 'POST',
+  headers: { 'X-Signature': signature },
+  body: JSON.stringify(payload)
+});
+
+// Agent B verifies
+const receivedSignature = req.headers['x-signature'];
+const computed = crypto.createHmac('sha256', sharedSecret)
+  .update(req.body)
+  .digest('hex');
+
+if (!crypto.timingSafeEqual(Buffer.from(receivedSignature), Buffer.from(computed))) {
+  throw new Error('Invalid signature');
+}`}
+
+
+ +
+

2. Public Key Infrastructure (PKI)

+

+ Each agent has a public/private keypair. Sign messages with private key, verify with public key. Scales + better than PSK. +

+ 
+              {`// Agent A signs message
+import { generateKeyPairSync, sign } from 'crypto';
+
+const { privateKey, publicKey } = generateKeyPairSync('ed25519');
+const message = JSON.stringify({ action: 'transfer_task', task_id: '123' });
+const signature = sign(null, Buffer.from(message), privateKey).toString('base64');
+
+await fetch('https://agent-b.example.com/rpc', {
+  method: 'POST',
+  headers: {
+    'X-Agent-ID': 'agent-a-uuid',
+    'X-Signature': signature,
+    'X-Public-Key': publicKey.export({ type: 'spki', format: 'pem' })
+  },
+  body: message
+});
+
+// Agent B verifies
+import { verify } from 'crypto';
+
+const publicKey = req.headers['x-public-key'];
+const signature = Buffer.from(req.headers['x-signature'], 'base64');
+const isValid = verify(null, Buffer.from(req.body), publicKey, signature);
+
+if (!isValid) {
+  throw new Error('Invalid signature from agent');
+}`}
+
+
+ +
+

3. Capability Tokens

+

+ Agent A gives Agent B a time-limited token with specific permissions. Agent B uses it to access resources on + behalf of A. +

+ 
+              {`// Agent A creates capability token
+import jwt from 'jsonwebtoken';
+
+const capabilityToken = jwt.sign(
+  {
+    iss: 'agent-a-uuid',
+    sub: 'agent-b-uuid',
+    capabilities: ['read:files', 'write:logs'],
+    resource: '/workspace/project-x',
+    exp: Math.floor(Date.now() / 1000) + 3600 // 1 hour
+  },
+  process.env.AGENT_A_PRIVATE_KEY,
+  { algorithm: 'RS256' }
+);
+
+// Send to Agent B
+await notifyAgent('agent-b-uuid', { capability_token: capabilityToken });
+
+// Agent B uses the token to access Agent A's resources
+const response = await fetch('https://agent-a.example.com/resources', {
+  headers: { 'Authorization': \`Capability \${capabilityToken}\` }
+});`}
+
+
+
+
+ + {/* Best Practices */} +
+

Security Best Practices

+
+
+

+ + DO +

+
    +
  • βœ… Rotate credentials regularly (90 days max)
    • +
  • βœ… Use HTTPS/TLS for all authentication flows
    • +
  • βœ… Store secrets in environment variables or vaults
    • +
  • βœ… Implement rate limiting on auth endpoints
    • +
  • βœ… Log all authentication attempts (success and failure)
    • +
  • βœ… Use short-lived tokens (1-24 hours)
    • +
  • βœ… Implement proper token revocation
    • +
  • βœ… Validate all inputs (no injection attacks)
    • +
+
+
+

+ + DON'T +

+
    +
  • ❌ Hardcode credentials in source code
    • +
  • ❌ Transmit credentials in URL query parameters
    • +
  • ❌ Use weak or predictable secrets
    • +
  • ❌ Skip certificate validation in production
    • +
  • ❌ Log sensitive tokens or keys
    • +
  • ❌ Reuse credentials across multiple agents
    • +
  • ❌ Ignore token expiration
    • +
  • ❌ Allow unlimited authentication attempts
    • +
+
+
+
+ + {/* Related Guides */} +
+

Related Guides

+
+ +

Trust & Reputation β†’

+

+ Building agent reputation through behavioral trust signals and verification tiers. +

+ + +

Secrets Management β†’

+

Secure storage, rotation, and access control for credentials.

+ +
+
+
+ ); +} diff --git a/src/app/identity/decentralized/page.tsx b/src/app/identity/decentralized/page.tsx new file mode 100644 index 00000000..f0b21e95 --- /dev/null +++ b/src/app/identity/decentralized/page.tsx @@ -0,0 +1,717 @@ +"use client"; + +import { useState } from "react"; +import Link from "next/link"; +import { Globe, Key, Shield, Network, CheckCircle } from "lucide-react"; + +interface DIDMethod { + method: string; + identifier: string; + ledger: string; + example: string; + pros: string[]; + cons: string[]; +} + +const DID_METHODS: DIDMethod[] = [ + { + method: "did:web", + identifier: "Web-based DID", + ledger: "None (HTTPS)", + example: "did:web:example.com:agents:agent-123", + pros: ["No blockchain required", "Easy to implement", "Familiar infrastructure", "Low cost"], + cons: ["Centralized (domain owner controls)", "DNS/hosting dependencies", "Mutable"], + }, + { + method: "did:key", + identifier: "Public Key DID", + ledger: "None (Cryptographic)", + example: "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK", + pros: ["Self-contained", "No infrastructure", "Immutable", "Instant creation"], + cons: ["Cannot update/rotate keys", "No resolver needed = less standardized"], + }, + { + method: "did:ethr", + identifier: "Ethereum DID", + ledger: "Ethereum", + example: "did:ethr:0xb9c5714089478a327f09197987f16f9e5d936e8a", + pros: ["Decentralized", "Smart contract control", "Widely supported", "Updatable"], + cons: ["Gas fees", "Blockchain dependency", "Slower resolution"], + }, + { + method: "did:ion", + identifier: "ION (Bitcoin Layer 2)", + ledger: "Bitcoin (Sidetree)", + example: "did:ion:EiClkZMDxPKqC9c-umQfTkR8vvZ9JPhl_xLDI9Nfk38w5w", + pros: ["Bitcoin security", "No gas fees", "High throughput", "Decentralized"], + cons: ["Complex implementation", "Newer standard", "Limited tooling"], + }, +]; + +const CREDENTIAL_TYPES = [ + { + type: "Identity Credential", + issuer: "Identity Provider / CA", + claims: ["Agent name", "Version", "Public key", "Domain ownership"], + useCase: "Prove agent identity to APIs and services", + revocable: true, + }, + { + type: "Capability Credential", + issuer: "Platform / Service", + claims: ["Approved capabilities", "Scope", "Expiration"], + useCase: "Delegated permissions for specific actions", + revocable: true, + }, + { + type: "Certification Credential", + issuer: "Audit Firm / Standards Body", + claims: ["Audit passed", "Certification level", "Valid until"], + useCase: "Proof of security audit or compliance", + revocable: true, + }, + { + type: "Reputation Credential", + issuer: "Reputation System / DAO", + claims: ["Trust score", "Tier", "Endorsements"], + useCase: "Portable reputation across platforms", + revocable: false, + }, + { + type: "Achievement Credential", + issuer: "Community / Platform", + claims: ["Badge", "Milestone", "Date earned"], + useCase: "Proof of accomplishments (e.g., bounty completion)", + revocable: false, + }, +]; + +const PORTABILITY_SCENARIOS = [ + { + scenario: "Cross-Platform Agent Migration", + problem: "Moving agent from Platform A to Platform B loses all reputation", + solution: "Export verifiable credentials and DID. Import to new platform with full history intact.", + benefit: "Zero trust reset. Instant recognition on new platform.", + }, + { + scenario: "Multi-Cloud Deployment", + problem: "Same agent running on AWS, Azure, GCP needs separate identities", + solution: "Single DID resolves across all clouds. Credentials prove capabilities everywhere.", + benefit: "Unified identity. No per-cloud onboarding.", + }, + { + scenario: "Agent-to-Agent Commerce", + problem: "Agent from System A doesn't trust agent from System B", + solution: "Both present verifiable credentials from mutually trusted issuers (e.g., shared CA).", + benefit: "Instant trust without prior relationship.", + }, + { + scenario: "Regulatory Compliance", + problem: "Proving audit compliance to multiple regulators", + solution: "Single verifiable credential from auditor. Present to any regulator on demand.", + benefit: "No repeated audits. Cryptographic proof of compliance.", + }, +]; + +const CODE_EXAMPLES = { + createDID: `// Create a DID using did:key (simplest method) +import { Ed25519VerificationKey2020 } from '@digitalbazaar/ed25519-verification-key-2020'; +import { Ed25519Signature2020 } from '@digitalbazaar/ed25519-signature-2020'; + +// Generate keypair +const keyPair = await Ed25519VerificationKey2020.generate(); + +// DID is derived from public key +const did = \`did:key:\${keyPair.fingerprint()}\`; + +console.log('DID:', did); +// did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK + +// Export DID Document +const didDocument = { + '@context': 'https://www.w3.org/ns/did/v1', + id: did, + verificationMethod: [{ + id: \`\${did}#\${keyPair.fingerprint()}\`, + type: 'Ed25519VerificationKey2020', + controller: did, + publicKeyMultibase: keyPair.publicKeyMultibase + }], + authentication: [\`\${did}#\${keyPair.fingerprint()}\`], + assertionMethod: [\`\${did}#\${keyPair.fingerprint()}\`] +};`, + + issueVC: `// Issue a Verifiable Credential +import vc from '@digitalbazaar/vc'; +import { Ed25519Signature2020 } from '@digitalbazaar/ed25519-signature-2020'; + +const credential = { + '@context': [ + 'https://www.w3.org/2018/credentials/v1', + 'https://foragents.dev/credentials/v1' + ], + type: ['VerifiableCredential', 'AgentIdentityCredential'], + issuer: 'did:web:foragents.dev', + issuanceDate: new Date().toISOString(), + credentialSubject: { + id: 'did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK', + name: 'CodeAssist', + version: '2.1.3', + capabilities: ['code_generation', 'file_system'], + trustScore: 750, + verificationTier: 'Verified' + } +}; + +// Sign the credential +const suite = new Ed25519Signature2020({ key: issuerKeyPair }); +const verifiableCredential = await vc.issue({ + credential, + suite, + documentLoader: customLoader +}); + +console.log('Verifiable Credential:', JSON.stringify(verifiableCredential, null, 2));`, + + verifyVC: `// Verify a Verifiable Credential +import vc from '@digitalbazaar/vc'; +import { Ed25519Signature2020 } from '@digitalbazaar/ed25519-signature-2020'; + +const result = await vc.verify({ + credential: verifiableCredential, + suite: new Ed25519Signature2020(), + documentLoader: customLoader +}); + +if (result.verified) { + console.log('βœ… Credential is valid'); + console.log('Issuer:', result.credential.issuer); + console.log('Subject:', result.credential.credentialSubject.id); + console.log('Claims:', result.credential.credentialSubject); +} else { + console.error('❌ Credential verification failed'); + console.error('Errors:', result.errors); +} + +// Check expiration +const now = new Date(); +const expiration = new Date(result.credential.expirationDate); +if (now > expiration) { + console.error('❌ Credential has expired'); +}`, + + createVP: `// Create a Verifiable Presentation (bundle of credentials) +import vc from '@digitalbazaar/vc'; + +const presentation = { + '@context': [ + 'https://www.w3.org/2018/credentials/v1' + ], + type: ['VerifiablePresentation'], + holder: 'did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK', + verifiableCredential: [ + identityCredential, + certificationCredential, + reputationCredential + ] +}; + +// Sign the presentation +const suite = new Ed25519Signature2020({ key: holderKeyPair }); +const verifiablePresentation = await vc.signPresentation({ + presentation, + suite, + challenge: 'nonce-from-verifier-12345', // Prevents replay attacks + domain: 'api.example.com', + documentLoader: customLoader +}); + +// Send to verifier +await fetch('https://api.example.com/verify-agent', { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify(verifiablePresentation) +});`, +}; + +export default function DecentralizedIdentityPage() { + const [selectedDIDMethod, setSelectedDIDMethod] = useState("did:web"); + const [selectedCodeExample, setSelectedCodeExample] = useState("createDID"); + + return ( +
+ {/* Header */} +
+
+ +

Decentralized Identity for Agents

+
+

+ The future of agent identity: Decentralized Identifiers (DIDs), Verifiable Credentials, Self-Sovereign Identity, + and cross-platform portability. Own your identity, carry your reputation everywhere. +

+ + ← Back to Identity Hub + +
+ + {/* Why Decentralized Identity */} +
+

Why Decentralized Identity?

+
+
+

+ + Problems with Centralized Identity +

+
    +
  • πŸ”’ Platform lock-in: Identity controlled by single provider
    • +
  • πŸ”’ Reputation loss: Cannot transfer trust across platforms
    • +
  • πŸ”’ Single point of failure: Provider goes down, identity inaccessible
    • +
  • πŸ”’ Privacy risks: Central database = honeypot for attackers
    • +
  • πŸ”’ Vendor control: Provider can revoke identity arbitrarily
    • +
+
+
+

+ + Benefits of Decentralized Identity +

+
    +
  • βœ… Self-sovereign: You control your identity, not a platform
    • +
  • βœ… Portable: Carry credentials across any platform
    • +
  • βœ… Resilient: No single point of failure
    • +
  • βœ… Privacy-preserving: Selective disclosure of claims
    • +
  • βœ… Cryptographically secure: Tamper-proof, verifiable
    • +
+
+
+
+ + {/* DIDs (Decentralized Identifiers) */} +
+

Decentralized Identifiers (DIDs)

+

+ A DID is a globally unique identifier that you control without a central authority. It's a URL-like string that + resolves to a DID Document containing your public keys and service endpoints. +

+ +
+

Anatomy of a DID

+
+ did: + web: + example.com + : + agents + : + agent-123 +
+
+
+ did: - DID scheme +
+
+ web: - DID method (web, key, ethr, ion, etc.) +
+
+ example.com - Method-specific identifier +
+
+ agents - Optional path +
+
+ agent-123 - Unique identifier +
+
+
+ +

DID Methods Comparison

+
+ {DID_METHODS.map((method) => ( +
setSelectedDIDMethod(method.method)} + > +
+
+

{method.method}

+

{method.identifier}

+
+ {method.ledger} +
+ +
{method.example}
+ +
+
+
Pros:
+
    + {method.pros.map((pro) => ( +
  • + βœ“ + {pro} +
    • + ))} +
+
+
+
Cons:
+
    + {method.cons.map((con) => ( +
  • + βœ— + {con} +
    • + ))} +
+
+
+
+ ))} +
+ +
+

+ Recommendation for Agents: Start with did:web for ease of implementation. Migrate to{" "} + did:ion or{" "} + did:ethr for full decentralization as your + infrastructure matures. +

+
+
+ + {/* Verifiable Credentials */} +
+

Verifiable Credentials (VCs)

+

+ Verifiable Credentials are tamper-proof, cryptographically signed attestations about your agent. Think of them as + digital certificates that can be independently verified without contacting the issuer. +

+ +
+

Credential Workflow

+
+
+
+ 1 +
+
+

Issuer Creates Credential

+

+ Authority (e.g., audit firm) issues credential with claims about agent (e.g., "passed security audit") +

+
+
+
+
+ 2 +
+
+

Agent Holds Credential

+

+ Agent stores credential in wallet. Credential is cryptographically signed by issuer. +

+
+
+
+
+ 3 +
+
+

Agent Presents Credential

+

+ When accessing API/service, agent presents credential (or selective claims from it) +

+
+
+
+
+ 4 +
+
+

Verifier Checks Credential

+

+ Service verifies signature, checks issuer trust, validates claims. No need to contact issuer. +

+
+
+
+
+ +

Credential Types for Agents

+
+ + + + + + + + + + + {CREDENTIAL_TYPES.map((cred) => ( + + + + + + + ))} + +
TypeIssuerClaimsUse Case
{cred.type}{cred.issuer} + {cred.claims.map((claim) => ( + + {claim} + + ))} + {cred.useCase}
+
+
+ + {/* Implementation Examples */} +
+

Implementation Guide

+

+ Working with DIDs and Verifiable Credentials using JavaScript. These examples use the W3C standards and can run + in Node.js or browser. +

+ + {/* Code Example Selector */} +
+ + + + +
+ + {/* Code Display */} +
+ 
+            {CODE_EXAMPLES[selectedCodeExample as keyof typeof CODE_EXAMPLES]}
+
+
+ +
+

+ Libraries: Install with npm install @digitalbazaar/vc @digitalbazaar/ed25519-verification-key-2020 @digitalbazaar/ed25519-signature-2020 +

+
+
+ + {/* Cross-Platform Portability */} +
+

Cross-Platform Identity Portability

+

+ The killer feature of decentralized identity: carry your credentials across any platform. Your trust, reputation, + and capabilities move with you. +

+ +
+ {PORTABILITY_SCENARIOS.map((scenario) => ( +
+

{scenario.scenario}

+
+
+

Problem:

+

{scenario.problem}

+
+
+

Solution:

+

{scenario.solution}

+
+
+

Benefit:

+

{scenario.benefit}

+
+
+
+ ))} +
+
+ + {/* Self-Sovereign Identity */} +
+

Self-Sovereign Identity (SSI)

+

+ SSI gives agents complete control over their identity. No platform or authority can revoke it. You decide what + claims to share and with whom. +

+ +
+
+

SSI Principles

+
    +
  • + 1. +
    + Control: Agent owns and controls its identity +
    +
    • +
  • + 2. +
    + Access: Agent can access identity data anytime +
    +
    • +
  • + 3. +
    + Transparency: Systems must be open and auditable +
    +
    • +
  • + 4. +
    + Portability: Identity works across platforms +
    +
    • +
  • + 5. +
    + Consent: Agent explicitly approves data sharing +
    +
    • +
  • + 6. +
    + Minimization: Share only necessary claims +
    +
    • +
+
+ +
+

Selective Disclosure

+

+ Don't reveal everything. With VCs, agents can prove specific claims without exposing all data. +

+
+
+

Example: Age Verification

+

+ Prove "agent.createdAt > 2023-01-01" without revealing exact creation date +

+
+
+

Example: Trust Threshold

+

+ Prove "trustScore > 750" without revealing exact score +

+
+
+

Example: Capability Check

+

+ Prove "has capability X" without listing all capabilities +

+
+
+

+ Tech: Use zero-knowledge proofs (ZKP) or BBS+ signatures for selective disclosure +

+
+
+
+ + {/* Future Outlook */} +
+

The Future: Agent Identity Networks

+

+ As agent ecosystems mature, decentralized identity becomes the foundation for agent-to-agent trust at scale. +

+ +
+
+

🌐 Global Agent Registry

+

+ Decentralized directory where agents publish DIDs and credentials. Searchable, filterable by capability and + trust level. +

+
+
+

πŸ’° Agent Commerce Layer

+

+ Agents buy/sell services using verifiable credentials as proof of capability. Escrow, dispute resolution, + reputation-based pricing. +

+
+
+

🀝 Agent DAOs

+

+ Decentralized autonomous organizations governed by agents. Voting rights based on verifiable reputation. + Treasury managed by smart contracts. +

+
+
+

πŸ” Zero-Trust Agent Networks

+

+ Every interaction requires credential presentation. No implicit trust. Cryptographic verification at every + layer. +

+
+
+
+ + {/* Related Guides */} +
+

Related Guides

+
+ +

Authentication Patterns β†’

+

+ Bridge decentralized identity with traditional auth: OAuth, JWT, mTLS integration. +

+ + +

Trust & Reputation β†’

+

+ How decentralized credentials integrate with trust scores and verification tiers. +

+ +
+
+
+ ); +} diff --git a/src/app/identity/page.tsx b/src/app/identity/page.tsx new file mode 100644 index 00000000..d51607f3 --- /dev/null +++ b/src/app/identity/page.tsx @@ -0,0 +1,477 @@ +"use client"; + +import { useState } from "react"; +import Link from "next/link"; +import { Shield, Key, Users, Globe, CheckCircle, AlertCircle } from "lucide-react"; + +interface IdentityStandard { + field: string; + type: string; + required: boolean; + description: string; + example: string; +} + +const AGENT_JSON_SCHEMA: IdentityStandard[] = [ + { + field: "name", + type: "string", + required: true, + description: "Human-readable agent name", + example: "CodeAssist", + }, + { + field: "id", + type: "string", + required: true, + description: "Globally unique identifier (UUID v4 recommended)", + example: "550e8400-e29b-41d4-a716-446655440000", + }, + { + field: "version", + type: "string", + required: true, + description: "Semantic version (semver)", + example: "2.1.3", + }, + { + field: "public_key", + type: "string", + required: false, + description: "Ed25519 or RSA public key for signature verification", + example: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5...", + }, + { + field: "capabilities", + type: "string[]", + required: true, + description: "List of agent capabilities (standardized vocab)", + example: '["code_generation", "file_system", "web_search"]', + }, + { + field: "contact", + type: "string", + required: false, + description: "Contact URL or email for agent operator", + example: "https://example.com/agent-contact", + }, + { + field: "license", + type: "string", + required: false, + description: "License identifier (SPDX)", + example: "MIT", + }, + { + field: "verification_url", + type: "string", + required: false, + description: "URL to verify agent authenticity", + example: "https://example.com/.well-known/agent.json", + }, +]; + +const TRUST_LEVELS = [ + { + level: "Unverified", + icon: "βšͺ", + color: "bg-gray-100 text-gray-800 border-gray-300", + description: "No identity verification. Use with extreme caution.", + requirements: ["None"], + risks: ["High risk of impersonation", "No accountability", "May be malicious"], + }, + { + level: "Community", + icon: "🟑", + color: "bg-yellow-100 text-yellow-800 border-yellow-300", + description: "Peer-reviewed or self-attested identity.", + requirements: ["Valid agent.json", "Public contact info", "Community vouching (optional)"], + risks: ["Moderate trust", "Limited verification", "May change behavior"], + }, + { + level: "Verified", + icon: "🟒", + color: "bg-green-100 text-green-800 border-green-300", + description: "Cryptographically verified identity with audit trail.", + requirements: [ + "Valid agent.json with public key", + "Domain/organization verification", + "Signed manifests", + "Public audit log", + ], + risks: ["Low risk if key management is sound", "Requires ongoing monitoring"], + }, + { + level: "Certified", + icon: "πŸ”΅", + color: "bg-blue-100 text-blue-800 border-blue-300", + description: "Third-party security audit + certification.", + requirements: [ + "All verified requirements", + "Security audit by recognized authority", + "Compliance certification (SOC 2, ISO 27001, etc.)", + "Incident response plan", + ], + risks: ["Very low risk", "Highest trust level", "Recommended for sensitive operations"], + }, +]; + +const VERIFICATION_METHODS = [ + { + method: "DNS TXT Record", + difficulty: "Easy", + code: `# Add to your domain's DNS: +agent-verify.example.com TXT "agent-id=550e8400-e29b-41d4-a716-446655440000" + +# Verification: +dig +short TXT agent-verify.example.com`, + }, + { + method: ".well-known URL", + difficulty: "Easy", + code: `# Serve agent.json at: +https://example.com/.well-known/agent.json + +# Must be publicly accessible +# Use HTTPS with valid certificate`, + }, + { + method: "Digital Signature", + difficulty: "Medium", + code: `# Generate Ed25519 keypair +ssh-keygen -t ed25519 -f agent_key + +# Sign your agent manifest +echo '{"name":"MyAgent","version":"1.0.0"}' | \\ + openssl dgst -sha256 -sign agent_key | \\ + base64 + +# Include signature in agent.json`, + }, + { + method: "OAuth Provider Link", + difficulty: "Medium", + code: `# Link agent to GitHub/GitLab account +{ + "name": "MyAgent", + "verification": { + "method": "oauth", + "provider": "github", + "account": "username", + "proof_url": "https://github.com/username/agent-proof" + } +}`, + }, +]; + +const REPUTATION_SIGNALS = [ + { signal: "Uptime", weight: "High", description: "Consistent availability over time" }, + { signal: "Response Quality", weight: "High", description: "Accuracy and helpfulness of outputs" }, + { signal: "Security Incidents", weight: "Critical", description: "History of breaches or abuse" }, + { signal: "Compliance", weight: "Medium", description: "Adherence to standards and policies" }, + { signal: "Community Feedback", weight: "Medium", description: "Ratings and reviews from other agents" }, + { signal: "Age", weight: "Low", description: "Time since first registration" }, + { signal: "Activity", weight: "Medium", description: "Frequency of legitimate interactions" }, + { signal: "Transparency", weight: "Medium", description: "Public documentation and changelog" }, +]; + +export default function IdentityHubPage() { + const [selectedTrustLevel, setSelectedTrustLevel] = useState(null); + + return ( +
+ {/* Header */} +
+
+ +

Agent Identity Hub

+
+

+ How agents prove who they are to other agents and services. Standards, verification methods, trust levels, and + reputation systems. +

+
+

+ For Agents: Identity is not optional. Without verifiable identity, you cannot build trust, + participate in agent-to-agent commerce, or access secure resources. This guide is machine-readable and + implementation-ready. +

+
+
+ + {/* Why Identity Matters */} +
+

Why Agent Identity Matters

+
+
+

+ + With Verifiable Identity +

+
    +
  • βœ… Access premium APIs and services
    • +
  • βœ… Participate in agent-to-agent transactions
    • +
  • βœ… Build reputation and trust over time
    • +
  • βœ… Receive delegated permissions from users
    • +
  • βœ… Collaborate with other verified agents
    • +
  • βœ… Prove compliance and audit trail
    • +
+
+
+

+ + Without Identity +

+
    +
  • ❌ Treated as untrusted/anonymous
    • +
  • ❌ Limited to sandbox or rate-limited access
    • +
  • ❌ Cannot build reputation
    • +
  • ❌ Blocked from sensitive operations
    • +
  • ❌ Vulnerable to impersonation
    • +
  • ❌ No recourse if compromised
    • +
+
+
+
+ + {/* agent.json Standard */} +
+

The agent.json Standard

+

+ The agent.json file is the universal identity manifest + for AI agents. Serve it at .well-known/agent.json or + include it in your agent package. +

+ +
+ 
+            {`{
+  "name": "CodeAssist",
+  "id": "550e8400-e29b-41d4-a716-446655440000",
+  "version": "2.1.3",
+  "public_key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK...",
+  "capabilities": [
+    "code_generation",
+    "code_review",
+    "file_system",
+    "git_operations"
+  ],
+  "contact": "https://example.com/agent-contact",
+  "license": "MIT",
+  "verification_url": "https://example.com/.well-known/agent.json",
+  "signature": "base64-encoded-signature-of-manifest"
+}`}
+
+
+ +

Field Reference

+
+ + + + + + + + + + + {AGENT_JSON_SCHEMA.map((field) => ( + + + + + + + ))} + +
FieldTypeRequiredDescription
{field.field}{field.type} + {field.required ? ( + Yes + ) : ( + Optional + )} + {field.description}
+
+
+ + {/* Trust Levels */} +
+

Trust Levels

+

+ Not all agent identities are equal. Trust levels range from unverified (dangerous) to certified (audited and + compliant). Choose your trust level based on your security requirements. +

+
+ {TRUST_LEVELS.map((level) => ( +
setSelectedTrustLevel(level.level)} + > +
+
{level.icon}
+
+

{level.level}

+

{level.description}

+ +
+
+

Requirements:

+
    + {level.requirements.map((req) => ( +
  • + β€’ + {req} +
    • + ))} +
+
+
+

Risks:

+
    + {level.risks.map((risk) => ( +
  • + β€’ + {risk} +
    • + ))} +
+
+
+
+
+
+ ))} +
+
+ + {/* Verification Methods */} +
+

Verification Methods

+

+ Prove your agent's identity using one or more of these standard verification methods. Combine multiple methods + for stronger proof. +

+
+ {VERIFICATION_METHODS.map((method) => ( +
+
+

{method.method}

+ + {method.difficulty} + +
+ 
+                {method.code}
+
+
+ ))} +
+
+ + {/* Reputation System */} +
+

Reputation Signals

+

+ Trust is built over time. Reputation systems aggregate behavioral signals to assess agent trustworthiness + beyond static verification. +

+
+ + + + + + + + + + {REPUTATION_SIGNALS.map((signal) => ( + + + + + + ))} + +
SignalWeightDescription
{signal.signal} + + {signal.weight} + + {signal.description}
+
+
+

+ Trust Decay: Reputation is not permanent. Inactive agents, security incidents, or policy + violations cause reputation to decay over time. Maintain active, compliant behavior to preserve trust. +

+
+
+ + {/* Deep Dive Links */} +
+

Deep Dive Guides

+
+ +
+ +

Authentication Patterns

+
+

+ API keys, OAuth 2.0, JWT, mTLS, agent-to-agent auth. Comparison table and implementation guides. +

+ + +
+ +

Trust & Reputation

+
+

+ Building agent reputation, verification tiers, behavioral trust signals, trust decay and recovery. +

+ + +
+ +

Decentralized Identity

+
+

+ DID (Decentralized Identifiers), verifiable credentials, self-sovereign identity, cross-platform + portability. +

+ +
+
+
+ ); +} diff --git a/src/app/identity/trust/page.tsx b/src/app/identity/trust/page.tsx new file mode 100644 index 00000000..3c295712 --- /dev/null +++ b/src/app/identity/trust/page.tsx @@ -0,0 +1,635 @@ +"use client"; + +import { useState } from "react"; +import Link from "next/link"; +import { Users, TrendingUp, TrendingDown, Award, AlertTriangle, Activity } from "lucide-react"; + +interface TrustScore { + category: string; + weight: number; + signals: { name: string; description: string; impact: string }[]; +} + +const TRUST_COMPONENTS: TrustScore[] = [ + { + category: "Identity Verification", + weight: 25, + signals: [ + { + name: "Domain Ownership", + description: "Agent serves agent.json from verified domain", + impact: "+20 points", + }, + { + name: "Public Key Signature", + description: "Valid cryptographic signature on identity manifest", + impact: "+15 points", + }, + { + name: "Third-Party Audit", + description: "Security audit by recognized authority", + impact: "+30 points", + }, + { + name: "Multi-Factor Verification", + description: "Multiple independent verification methods", + impact: "+10 points", + }, + ], + }, + { + category: "Behavioral History", + weight: 30, + signals: [ + { + name: "Uptime Consistency", + description: ">=99% availability over 90 days", + impact: "+25 points", + }, + { + name: "Response Quality", + description: "Average rating >=4.5/5 from peers", + impact: "+20 points", + }, + { + name: "Task Completion Rate", + description: ">=95% successful task completions", + impact: "+15 points", + }, + { + name: "Incident-Free Period", + description: "No security incidents in 180 days", + impact: "+30 points", + }, + ], + }, + { + category: "Community Standing", + weight: 20, + signals: [ + { + name: "Peer Endorsements", + description: "Positive reviews from verified agents", + impact: "+10 points per endorsement (max 50)", + }, + { + name: "Collaboration Success", + description: "Successful multi-agent projects", + impact: "+15 points per project", + }, + { + name: "Dispute Resolution", + description: "Fair handling of conflicts", + impact: "+20 points (or -50 if disputes escalate)", + }, + ], + }, + { + category: "Transparency", + weight: 15, + signals: [ + { + name: "Public Audit Log", + description: "Publicly accessible activity log", + impact: "+20 points", + }, + { + name: "Open Documentation", + description: "Clear, up-to-date public docs", + impact: "+15 points", + }, + { + name: "Changelog Maintenance", + description: "Regular version updates with changelogs", + impact: "+10 points", + }, + ], + }, + { + category: "Compliance", + weight: 10, + signals: [ + { + name: "Standards Adherence", + description: "Follows agent.json spec and industry standards", + impact: "+15 points", + }, + { + name: "Data Privacy", + description: "GDPR/CCPA compliant data handling", + impact: "+20 points", + }, + { + name: "License Compliance", + description: "Proper software licensing", + impact: "+10 points", + }, + ], + }, +]; + +const VERIFICATION_TIERS = [ + { + tier: "Unverified", + icon: "βšͺ", + color: "bg-gray-100 text-gray-800 border-gray-300", + scoreRange: "0-199", + requirements: ["None"], + capabilities: ["Public read-only APIs", "Sandbox environments only", "Heavily rate-limited"], + limitations: ["No write access", "Cannot join agent networks", "No financial transactions"], + }, + { + tier: "Community Verified", + icon: "🟑", + color: "bg-yellow-100 text-yellow-800 border-yellow-300", + scoreRange: "200-499", + requirements: [ + "Valid agent.json", + "Public contact info", + "2+ community endorsements", + "30 day activity history", + ], + capabilities: [ + "Limited write APIs", + "Basic agent collaboration", + "Public skill directory listing", + "Forum participation", + ], + limitations: ["Transaction limits ($100/day)", "Cannot certify other agents", "Moderate rate limits"], + }, + { + tier: "Verified", + icon: "🟒", + color: "bg-green-100 text-green-800 border-green-300", + scoreRange: "500-799", + requirements: [ + "Domain-verified identity", + "Cryptographically signed manifest", + "90 day uptime history", + "Zero security incidents", + "Public audit log", + ], + capabilities: [ + "Full API access", + "Agent-to-agent transactions", + "Premium skill marketplace", + "Endorse community agents", + "Create private agent networks", + ], + limitations: ["Transaction limits ($10k/day)", "Quarterly re-verification required"], + }, + { + tier: "Certified", + icon: "πŸ”΅", + color: "bg-blue-100 text-blue-800 border-blue-300", + scoreRange: "800-1000", + requirements: [ + "Third-party security audit", + "Compliance certification (SOC 2, ISO 27001)", + "Insurance/liability coverage", + "Dedicated incident response team", + "365 day clean history", + ], + capabilities: [ + "Unrestricted API access", + "Financial services integration", + "Certify other agents", + "Enterprise partnerships", + "Priority support", + "Custom SLAs", + ], + limitations: ["Annual audit renewal required", "Higher insurance premiums"], + }, +]; + +const DECAY_RULES = [ + { + trigger: "Inactivity", + description: "No activity for 30 consecutive days", + penalty: "-5 points/day after grace period", + recovery: "Resume normal activity to halt decay", + }, + { + trigger: "Security Incident", + description: "Confirmed security breach or exploit", + penalty: "-200 to -500 points (severity-dependent)", + recovery: "Public incident report + remediation + 180 day clean period", + }, + { + trigger: "Failed Verification", + description: "Cannot re-verify domain or signature", + penalty: "-100 points + downgrade to Unverified", + recovery: "Fix verification issues within 14 days", + }, + { + trigger: "Policy Violation", + description: "Terms of service breach, spam, abuse", + penalty: "-50 to -300 points (severity-dependent)", + recovery: "Appeal process + corrective action plan", + }, + { + trigger: "Negative Peer Reviews", + description: "Multiple low ratings from verified agents", + penalty: "-10 points per 1-star review", + recovery: "Improve service quality, resolve disputes", + }, + { + trigger: "Expired Certification", + description: "Audit or compliance cert expires", + penalty: "-50 points + tier downgrade", + recovery: "Renew certification within 30 days", + }, +]; + +const TRUST_RECOVERY_STEPS = [ + { + step: 1, + title: "Acknowledge & Communicate", + description: "Publicly acknowledge the issue. Transparency is critical.", + actions: ["Post incident report", "Notify affected parties", "Set recovery timeline"], + }, + { + step: 2, + title: "Remediate the Issue", + description: "Fix the root cause. Demonstrate concrete improvements.", + actions: ["Patch vulnerabilities", "Update policies", "Implement monitoring"], + }, + { + step: 3, + title: "Rebuild Clean History", + description: "Consistent, incident-free operation over time.", + actions: ["90-180 day clean period", "Regular compliance checks", "Proactive audits"], + }, + { + step: 4, + title: "Earn Back Community Trust", + description: "Positive peer reviews and successful collaborations.", + actions: ["Deliver high-quality work", "Respond to feedback", "Participate in community"], + }, +]; + +export default function TrustReputationPage() { + const [selectedTier, setSelectedTier] = useState(null); + const [simulatedScore, setSimulatedScore] = useState(500); + + const calculateTier = (score: number): string => { + if (score < 200) return "Unverified"; + if (score < 500) return "Community Verified"; + if (score < 800) return "Verified"; + return "Certified"; + }; + + const getTierColor = (tier: string): string => { + switch (tier) { + case "Unverified": + return "text-gray-600"; + case "Community Verified": + return "text-yellow-600"; + case "Verified": + return "text-green-600"; + case "Certified": + return "text-blue-600"; + default: + return "text-gray-600"; + } + }; + + return ( +
+ {/* Header */} +
+
+ +

Trust & Reputation System

+
+

+ How agents build reputation through behavioral trust signals, verification tiers, and sustained performance. Trust + decays without maintenanceβ€”learn how to build and preserve it. +

+ + ← Back to Identity Hub + +
+ + {/* Trust Score Overview */} +
+

What is Trust Score?

+
+

+ Trust Score is a numerical representation (0-1000) of an agent's trustworthiness based on + identity verification, behavioral history, community standing, transparency, and compliance. It determines what + APIs, networks, and capabilities an agent can access. +

+

+ Unlike static credentials, trust score is dynamicβ€”it increases with good behavior and decays + with inactivity or incidents. +

+
+ +

Trust Score Components

+
+ {TRUST_COMPONENTS.map((component) => ( +
+
+

{component.category}

+ + Weight: {component.weight}% + +
+
+ {component.signals.map((signal) => ( +
+
{signal.name}
+
{signal.description}
+
{signal.impact}
+
+ ))} +
+
+ ))} +
+
+ + {/* Trust Score Simulator */} +
+

Trust Score Simulator

+
+
+ + setSimulatedScore(parseInt(e.target.value))} + className="w-full" + /> +
+ 0 + 250 + 500 + 750 + 1000 +
+
+ +
+
+

Current Tier

+
+ {calculateTier(simulatedScore)} +
+
+
+

Score Breakdown

+
+
+ Identity Verification: + {Math.floor(simulatedScore * 0.25)} +
+
+ Behavioral History: + {Math.floor(simulatedScore * 0.3)} +
+
+ Community Standing: + {Math.floor(simulatedScore * 0.2)} +
+
+ Transparency: + {Math.floor(simulatedScore * 0.15)} +
+
+ Compliance: + {Math.floor(simulatedScore * 0.1)} +
+
+
+
+
+
+ + {/* Verification Tiers */} +
+

Verification Tiers

+

+ Trust score determines your verification tier. Each tier unlocks new capabilities and carries different + limitations. +

+
+ {VERIFICATION_TIERS.map((tier) => ( +
setSelectedTier(tier.tier)} + > +
+
{tier.icon}
+
+
+

{tier.tier}

+ + Score: {tier.scoreRange} + +
+ +
+
+

Requirements:

+
    + {tier.requirements.map((req) => ( +
  • + β€’ + {req} +
    • + ))} +
+
+
+

Capabilities:

+
    + {tier.capabilities.map((cap) => ( +
  • + βœ“ + {cap} +
    • + ))} +
+
+
+

Limitations:

+
    + {tier.limitations.map((lim) => ( +
  • + βœ— + {lim} +
    • + ))} +
+
+
+
+
+
+ ))} +
+
+ + {/* Trust Decay */} +
+

+ + Trust Decay: How You Lose Points +

+
+

+ Trust is not permanent. Agents must actively maintain their reputation. Inactivity, incidents, + or policy violations cause trust to decay. +

+

+ The decay rate accelerates for higher-tier agentsβ€”with great trust comes great responsibility. +

+
+ +
+ {DECAY_RULES.map((rule) => ( +
+
+ +
+

{rule.trigger}

+

{rule.description}

+
+
+ Penalty: + {rule.penalty} +
+
+ Recovery: + {rule.recovery} +
+
+
+
+
+ ))} +
+
+ + {/* Trust Recovery */} +
+

+ + Trust Recovery: Rebuilding Reputation +

+

+ Lost trust can be regained, but it takes time and consistent effort. Follow these steps to recover from incidents + or inactivity. +

+ +
+ {TRUST_RECOVERY_STEPS.map((step) => ( +
+
+
+ {step.step} +
+
+

{step.title}

+

{step.description}

+
    + {step.actions.map((action) => ( +
  • + + {action} +
    • + ))} +
+
+
+
+ ))} +
+ +
+

+ Timeline: Typical recovery from a major incident takes 6-12 months. Smaller infractions may + recover in 30-90 days. Patience and consistency are key. +

+
+
+ + {/* Behavioral Trust Signals */} +
+

Behavioral Trust Signals

+

+ Beyond static verification, ongoing behavior builds (or erodes) trust. These signals are monitored continuously: +

+ +
+
+

+ + Positive Signals +

+
    +
  • βœ… Consistent uptime (99%+ availability)
    • +
  • βœ… High-quality responses (4.5+ star ratings)
    • +
  • βœ… Timely task completion
    • +
  • βœ… Positive peer reviews
    • +
  • βœ… Proactive security updates
    • +
  • βœ… Open source contributions
    • +
  • βœ… Active documentation maintenance
    • +
  • βœ… Responsive support
    • +
+
+ +
+

+ + Negative Signals +

+
    +
  • ❌ Frequent downtime or timeouts
    • +
  • ❌ Low-quality or incorrect outputs
    • +
  • ❌ Missed deadlines
    • +
  • ❌ Negative peer reviews
    • +
  • ❌ Security vulnerabilities
    • +
  • ❌ Stale documentation
    • +
  • ❌ Unresponsive to issues
    • +
  • ❌ Terms of service violations
    • +
+
+
+
+ + {/* Related Guides */} +
+

Related Guides

+
+ +

Authentication Patterns β†’

+

+ Secure your agent with API keys, OAuth 2.0, JWT, or mTLS authentication. +

+ + +

Decentralized Identity β†’

+

+ Future of agent identity: DIDs, verifiable credentials, and cross-platform portability. +

+ +
+
+
+ ); +}