AI Agent Governance Glossary
Definitions of every key term in AI agent identity, governance, and security — from agent passports to tamper-evident audit ledgers.
A2A (Agent-to-Agent)
A communication standard that enables AI agents to call other AI agents directly, forming multi-agent pipelines. A2A defines how agents exchange task requests, status updates, and results. AgentTag governs A2A calls by enforcing mandate checks on each inter-agent request.
Agent Passport
An agent passport is a cryptographic identity issued to a single AI agent: an Ed25519 keypair bound to a W3C Decentralized Identifier (DID). The passport's private key is stored in an isolated vault and never exposed in logs or environment variables. Every action the agent takes is signed with this key, creating a verifiable chain of attribution. Contrast with shared API keys, which cannot distinguish between agents.
Audit Ledger
A sequential, cryptographically linked record of every action an AI agent takes. In AgentTag, each ledger entry includes the SHA-256 hash of the previous entry, making the chain tamper-evident: any retroactive modification breaks every subsequent hash. The ledger can be exported and independently verified without relying on AgentTag's infrastructure.
Blast Radius
The maximum scope of damage that can result from a security incident involving an AI agent. Blast radius is bounded by the agent's permissions: an agent with a narrow mandate that expires in one hour has a much smaller blast radius than an agent given full human API key access. Reducing blast radius is a core goal of AgentTag's mandate system.
Credential Sharing
The practice of giving AI agents access to systems using credentials (API keys, tokens, passwords) that belong to a human or are shared between multiple agents. Credential sharing is the primary security anti-pattern that AgentTag is designed to replace: it prevents scoped access, clean attribution, and targeted revocation.
Cryptographic Identity
An identity that is proven by a cryptographic keypair rather than by a password or secret. In AgentTag, each agent's identity is its Ed25519 keypair — possession of the private key proves identity. Cryptographic identity cannot be stolen by reading a log file or environment variable the way a shared API key can.
DID (Decentralized Identifier)
A W3C standard for identifiers that do not depend on a central authority to be valid. AgentTag binds each agent passport to a DID — a string like did:key:z6Mk... — that uniquely identifies the agent and can be resolved to its public key. DIDs are the foundation of self-sovereign identity for AI agents.
Ed25519
An elliptic-curve digital signature algorithm used by AgentTag to generate agent passports. Ed25519 produces compact, fast, and highly secure keypairs. The private key signs each request the agent makes; the public key (embedded in the agent's DID) allows anyone to verify the signature. Ed25519 is used by SSH, Signal, and many modern cryptographic systems.
Escalation
The process by which an AI agent pauses and requests human approval before proceeding with an action. Escalation is triggered when an agent's mandate specifies a step-up condition — for example, spend above $100, deleting data, or sending external communications. The agent waits for a cryptographically signed approval from the operator before continuing.
Governance (AI Agent)
The set of policies, controls, and audit mechanisms that constrain and record what AI agents can do in production. AI agent governance includes: identity (who is the agent?), policy (what is it allowed to do?), audit (what did it do?), and revocation (how is access removed?). AgentTag provides all four as a unified control plane.
Hash Chain
A sequence of data entries where each entry includes the cryptographic hash of the previous entry. Hash chains are tamper-evident: modifying any entry changes its hash, which no longer matches the reference stored in the next entry, breaking the chain from that point forward. AgentTag's audit ledger is a hash chain using SHA-256.
Identity (AI Agent)
The mechanism by which an AI agent is uniquely identified in a system. In AgentTag, identity is cryptographic: each agent has its own Ed25519 keypair and W3C DID. Identity is distinct from authentication (proving identity) and authorisation (determining what an identity may do).
Least Privilege
A security principle stating that any entity (agent, user, process) should have only the minimum permissions required to perform its specific task. In AgentTag, least privilege is enforced through mandates: each mandate specifies exactly which tools an agent may invoke, its spend cap, and its expiry — no more access than the task requires.
Mandate
A cryptographically signed policy document that defines what a specific AI agent is permitted to do. A mandate specifies: allowed MCP tools, spend cap, step-up approval triggers, and an expiry date. Mandates are evaluated by the policy engine at request time (not at agent startup) and can be revoked instantly without restarting the agent.
MCP (Model Context Protocol)
An open standard developed by Anthropic that defines how AI language models communicate with external tools and data sources. MCP separates the AI client (e.g. Claude Desktop) from MCP servers (tools, APIs, databases). AgentTag adds an identity and policy layer on top of MCP — every MCP tool call is authenticated, policy-checked, and recorded before it reaches the server.
MCP Server
A process that exposes tools and resources to MCP-compatible AI clients via the Model Context Protocol. AgentTag sits in front of MCP servers as a policy surface: agents must present a valid, in-scope mandate before any tool call is forwarded to the underlying MCP server.
Multi-Agent System
A system in which multiple AI agents work together to complete complex tasks, with agents orchestrating other agents or calling specialized sub-agents. Multi-agent systems amplify the importance of identity and governance: each agent in the pipeline needs its own revocable identity so a single compromise does not cascade.
Policy Engine
The component of AgentTag that evaluates mandates at request time to decide whether an agent's action should be allowed, denied, or escalated for human approval. The policy engine runs on every tool call, checking the agent's mandate against the requested action, spend amount, and tool name.
Prompt Injection
An attack in which malicious instructions embedded in a tool's response, document, or web page cause an AI agent to take actions the operator did not intend. Prompt injection is the primary AI-specific attack vector. AgentTag mitigates it by enforcing signed mandates at the policy engine level: even if an injected prompt instructs the agent to exceed its permissions, the policy engine blocks the action.
Revocation
The act of immediately invalidating an agent's mandate or passport, cutting off its access to all permitted tools. In AgentTag, revocation takes effect on the next request with no credential rotation or system restart required. The revocation event is recorded in the audit ledger with a timestamp and reason.
SHA-256
A cryptographic hash function used by AgentTag's audit ledger to chain entries together. SHA-256 produces a fixed 256-bit digest for any input; changing even one bit of the input produces a completely different digest. This property makes SHA-256 hash chains tamper-evident.
Step-Up Approval
A mechanism in which an AI agent pauses mid-task and sends a signed approval request to the human operator before proceeding with a sensitive action. The operator reviews the request and responds with a cryptographically signed approval or denial. Step-up approval is configured per-action in the mandate.
Tamper-Evident
A property of a record or ledger that makes any modification detectable. AgentTag's audit ledger is tamper-evident because each entry contains the SHA-256 hash of the previous entry: altering any entry breaks the hash chain from that point forward, and the break is detectable by anyone who verifies the chain.
Vault
An isolated secure storage component used by AgentTag to hold agent private keys. The vault ensures that private keys never appear in logs, environment variables, or network traffic. The vault signs requests on behalf of the agent; the key itself never leaves the vault.
Zero Standing Access
A security posture in which no person or process has permanent, always-on access to a sensitive system. Access is granted only when needed, logged, and time-limited. AgentTag's mandate system enforces zero standing access for AI agents: mandates have expiry dates, and revocation is instant.
Related resources
Govern your first agent in under five minutes
Create agent passports, establish mandates, and audit activity on your own terms. Free during the public beta.