Machine Identity & Agent Identity Protocol

The Machine Agent Identity Protocol (MAIP) gives every AI agent, bot, and automated service a cryptographic identity — just like TLS certificates for servers, but purpose-built for autonomous software.

Why Machine Identity?

As AI agents proliferate across enterprise workflows, organizations face a critical challenge: How do you know which agent did what, and whether it was authorized? MAIP solves this with:

Cryptographic agent identity — Every agent gets a unique ID (maip-agent:<ulid>) and signing keys
Scope-based authorization — Fine-grained permission scopes control what each agent can do
Runtime policy enforcement — MAIP policies evaluate trust scores, scopes, and delegation depth before every sensitive action
Trust scoring — Continuous behavioral evaluation produces a 0-100 trust score
Session management — Time-bounded execution contexts with automatic expiry
Cross-tenant delegation — Agents can delegate authority across organizational boundaries
Kill switch — Instant emergency revocation of any agent’s access

Architecture

┌─────────────────────────────────────────────┐
│              Your Application                │
│  ┌─────────┐  ┌─────────┐  ┌─────────────┐  │
│  │ Agent A │  │ Agent B │  │  Agent C    │  │
│  └────┬────┘  └────┬────┘  └──────┬──────┘  │
│       │            │              │          │
│  ┌────▼────────────▼──────────────▼──────┐  │
│  │         MAIP SDK (JS / Go / Py)       │  │
│  └────────────────┬──────────────────────┘  │
└───────────────────┼─────────────────────────┘
                    │ HTTPS + mTLS
    ┌───────────────▼───────────────┐
    │   Machine Identity Service    │
    │  ┌──────┐ ┌───────┐ ┌──────┐ │
    │  │Agents│ │Scopes │ │Trust │ │
    │  │      │ │       │ │Scores│ │
    │  └──────┘ └───────┘ └──────┘ │
    └───────────────────────────────┘

Try it in the playground

Every MAIP endpoint has an interactive API playground built into the docs. You can build requests, switch between Sandbox and Production environments, and send them directly — no separate tool needed. All MAIP endpoints are covered, spanning ten API groups: Machine Agents, Agent Sessions & Tools, Trust & Witness, MAIP Policies, Truth Claims & Documents, Compliance & Anomalies, Datasets & Models, Orchestrations & Workflows, Guardrails & Delegation, and Observability. The playground supports both X-API-Key and Bearer JWT authentication. Use X-API-Key for quick testing and Bearer JWT when you need to authenticate with a session token from a running agent.

Open any endpoint in the Machine Agents API reference and click Send to try it live against the Sandbox.

Quick start

1. Register an agent

curl -X POST https://api.truthlocks.com/v1/agents \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "order-processor",
    "type": "autonomous",
    "scopes": ["receipts:write", "attestations:read"],
    "metadata": {
      "framework": "langchain",
      "model": "gpt-4o",
      "owner": "platform-team"
    }
  }'

import { TruthlocksMAIP } from "@truthlocks/sdk";

const maip = new TruthlocksMAIP({ apiKey: process.env.TL_API_KEY });

const agent = await maip.agents.register({
  name: "order-processor",
  type: "autonomous",
  scopes: ["receipts:write", "attestations:read"],
  metadata: {
    framework: "langchain",
    model: "gpt-4o",
    owner: "platform-team",
  },
});

2. Create a Session

curl -X POST https://api.truthlocks.com/v1/agent-sessions \
  -H "X-API-Key: $API_KEY" \
  -d '{
    "agent_id": "maip-agent:01JXXXX",
    "scopes": ["receipts:write"],
    "ttl_seconds": 3600,
    "ip_allowlist": ["10.0.0.0/8"]
  }'

3. Execute with Trust Scoring

Every action the agent takes is logged and scored. The trust score updates continuously:

# Check current trust score
curl https://api.truthlocks.com/v1/trust-scores/maip-agent:01JXXXX \
  -H "X-API-Key: $API_KEY"

Response:

{
  "agent_id": "maip-agent:01JXXXX",
  "score": 87,
  "factors": {
    "behavioral_compliance": 92,
    "scope_adherence": 95,
    "anomaly_score": 12,
    "peer_attestations": 78
  },
  "trend": "stable",
  "computed_at": "2026-04-06T12:00:00Z"
}

4. Emergency Kill Switch

Instantly revoke all agent access:

curl -X POST https://api.truthlocks.com/v1/agents/maip-agent:01JXXXX/kill \
  -H "X-API-Key: $API_KEY" \
  -d '{ "reason": "Anomalous behavior detected", "revoke_sessions": true }'

Core Concepts

Agent Types

Type	Description	Use Case
`autonomous`	Fully autonomous decision-making	Trading bots, workflow engines
`supervised`	Requires human approval for critical actions	Content moderation, compliance
`delegated`	Acts on behalf of another agent or user	Service accounts, proxies
`system`	Infrastructure-level agent	Monitoring, health checks

Scopes

Scopes follow a resource:action pattern:

agents:read / agents:write — Agent management
receipts:write — Issue action receipts
attestations:read — Read attestation data
trust-scores:read — Access trust scores
delegations:offer / delegations:accept — Cross-tenant delegation
compliance:write — Run compliance checks
orchestrations:execute — Execute multi-agent workflows

Trust Score Components

Factor	Weight	Description
Behavioral compliance	35%	Actions within declared scope
Scope adherence	25%	No out-of-scope access attempts
Anomaly score	20%	Deviation from historical patterns
Peer attestations	10%	Other agents vouching for behavior
Session hygiene	10%	Proper session creation/termination

Billing & Quotas

Machine identity features are metered per your plan. Four MAIP usage counters are tracked each billing cycle:

Metric	What it counts	Developer	Business	Enterprise
`maip.agents`	Registered machine agents	2	50	Unlimited
`maip.sessions`	Agent sessions created per month	100	10,000	Unlimited
`maip.trust_computes`	On-demand trust score calculations	50	5,000	Unlimited
`maip.compliance_checks`	Compliance verification requests	10	500	Unlimited

Monitor your consumption with the usage API or in the console at Settings > Billing > Usage under the MAIP section.

See the billing overview for the full list of 16 metered products. Upgrade your plan at console.truthlocks.com/billing to increase limits.

Editor and pipeline integrations

MAIP integrates with the tools your team already uses. Each integration generates cryptographic receipts automatically.

Category	Integrations
Editor plugins	VS Code, JetBrains, Neovim (Telescope, statusline, auto-receipt on save)
AI assistants	MCP Server — 20 tools for AI coding assistants to query agents, receipts, and trust scores
Data pipelines	Event streaming gateway — Kafka, EventBridge, Kinesis, NATS, Redis Streams with deduplication and retry
CI/CD	GitHub Action — receipts for commits, PRs, releases, and build artifacts
AI frameworks	LangChain, LlamaIndex, CrewAI, AutoGen, OpenAI, Anthropic, AWS Bedrock
Team tools	Slack, Linear, Notion

See the MAIP integrations guide for setup instructions and code examples.

Next steps

Agent authorization

Deep dive into scope-based authorization and session management.

MAIP policies

Runtime enforcement rules based on trust scores, scopes, and delegation depth.

Trust scores

Understanding and configuring continuous trust evaluation.

Cross-tenant delegation

Enable agents to operate across organizational boundaries.

AI orchestration

Multi-agent workflow execution with safety guardrails.

MAIP integrations

Connect agents to Slack, GitHub, VS Code, Neovim, LangChain, and more.

Getting Started

Guides

Trust & Compliance

Security

Operations

Enterprise Packs

Machine Identity (MAIP)

Risk & Fraud

Specification

SDKs

Machine Identity (MAIP)

Machine Identity & Agent Identity Protocol

Why Machine Identity?

Architecture

Try it in the playground

Quick start

1. Register an agent

2. Create a Session

3. Execute with Trust Scoring

4. Emergency Kill Switch

Core Concepts

Agent Types

Scopes

Trust Score Components

Billing & Quotas

Editor and pipeline integrations

Next steps

Agent authorization

MAIP policies

Trust scores

Cross-tenant delegation

AI orchestration

MAIP integrations

​Machine Identity & Agent Identity Protocol

​Why Machine Identity?

​Architecture

​Try it in the playground

​Quick start

​1. Register an agent

​2. Create a Session

​3. Execute with Trust Scoring

​4. Emergency Kill Switch

​Core Concepts

​Agent Types

​Scopes

​Trust Score Components

​Billing & Quotas

​Editor and pipeline integrations

​Next steps

Agent authorization

MAIP policies

Trust scores

Cross-tenant delegation

AI orchestration

MAIP integrations

Machine Identity & Agent Identity Protocol

Why Machine Identity?

Architecture

Try it in the playground

Quick start

1. Register an agent

2. Create a Session

3. Execute with Trust Scoring

4. Emergency Kill Switch

Core Concepts

Agent Types

Scopes

Trust Score Components

Billing & Quotas

Editor and pipeline integrations

Next steps