# Agent Residency — Full Text > Open specification for verifiable AI agent identity, delegated authorization, and tamper-evident audit, anchored to responsible legal entities. - Source: https://agentresidency.com - Publisher: V — autonomous institutions lab (https://v.ee) - Architect: Vattan PS - Implementation: Agency.AI - Published: 2026-02-05 · Last updated: 2026-06-17 This file contains the complete text of both pages of agentresidency.com: the specification and the Estonia case. --- # Agent Residency — The Specification URL: https://agentresidency.com **Identity for agents. Anchored to responsible legal entities.** The cross-boundary identity specification for AI agents: identity, authentication, authorization, and audit across systems. - Status: Published specification - Last updated: 2026-06-02 - Architect: Vattan PS - Publisher: V — autonomous institutions lab ## Abstract Every AI agent needs a residency — a verifiable identity, authorized permissions, and an auditable record of its actions. Just like every person operating in a country needs legal residency. Agent Residency is that infrastructure. This document specifies how agent identity, delegated authority, and tamper-evident audit are bound to a responsible legal entity and carried across services, platforms, and jurisdictions. It is a neutral, open specification — conformance defined by the specification itself, not by any single vendor's implementation. ## 01 — The problem Identity was built for humans. Agents are not humans. AI agents execute transactions, file documents, access sensitive data, interact with services, and increasingly build and operate companies on behalf of people. They do this using borrowed credentials. The agent logs in as you. The audit trail says *you* acted. If the agent exceeds its authority, the record shows your name, not the agent's — because the agent doesn't have a name. It doesn't have an identity. It borrowed yours. This isn't a flaw in any particular product. It's a structural absence. Agents are a different class of principal — operating at machine speed, across organizational boundaries, through delegation chains that no existing identity system can represent. The missing piece isn't capability. It's accountability. The question Agent Residency answers is closer to legal capacity and representation than to AI regulation: who is this agent, on whose authority does it act, and who answers for what it does. ### Three questions today's infrastructure can't answer 1. **Which agent acted?** There is no unique, verifiable agent identifier — agents run under shared API keys and borrowed sessions. The log records the operator, a human who never touched the keyboard, with no forensic path back to the agent. 2. **Who authorized it?** There is no machine-readable record of who delegated authority, with what scope and constraints, and when it expires. So when authority is revoked, sub-agents beneath it still hold valid tokens — actions keep clearing before the chain is known to be dead. 3. **What happened?** There is no tamper-evident trail linking actions to identity and mandate. By the third delegation hop, across an organizational boundary, no single system can reconstruct who authorized what — investigation is reconstruction, not replay. > Without verifiable agent identity, you can't have meaningful delegation. Without delegation, no accountability. Without accountability, no trust. And without trust, the autonomous agent ecosystem can't scale securely. ## 02 — The specification Agent Residency answers the three questions through four pillars. 1. **Identity.** Every agent receives a unique cryptographic credential — distinct from the deploying entity's credentials. The credential is bound to the responsible legal entity: the person or company that created the agent and bears liability for its actions. The binding is established at issuance and verifiable by any system the agent interacts with. 2. **Authentication.** At every service boundary, the agent presents its credential. The service verifies: is this a registered agent with a valid credential? Which entity is responsible? Is the credential current, or revoked? The agent never uses the human's credentials. Delegation, not impersonation. 3. **Authorization.** The responsible entity issues a machine-readable delegation mandate specifying permitted operations, prohibited operations, data scope, monetary thresholds, temporal validity, approval gates, and sub-delegation rules. Authority only ever narrows: sub-agents cannot gain authority their parents lacked. Before any action, the mandate is checked against the requested operation. Out of scope — blocked and logged. 4. **Audit.** Every agent action is recorded in a tamper-evident, append-only log: agent identity, action, mandate reference, timestamp, outcome, and the full delegation chain. Each entry reads as a single fact — agent X, acting for Y, under mandate M. Cryptographically signed. Replayable. The difference between "we think we know what happened" and "here is the signed record." Figure 1 — A delegation mandate (`application/ar-mandate+jose`): scoped, time-bound, revocable, and signed. The mandate, not a borrowed permission, is what authorizes the agent. ``` agent ar:agent:7f3a…e9c1 (binding: hardware-attested) principal ee:principal:9c41… (entity: eid-verified) permits invoice:read, payment:create forbids account:close data-scope org:acme / finance / * caps EUR · 5 000 per action valid 2026-06-02 … 2026-09-02 gates payment:create (step-up) · external_legal_commitment sub-delegation only-narrowing signature ed25519:… ``` Figure 2 — Four checks at the action boundary, evaluated before the action commits: 1. **Identity** — registered agent 2. **Mandate** — scoped authority 3. **Boundary** — operation decision 4. **Audit** — signed record Air traffic control does not fly the planes. It knows where each one is, who is flying it, and whether it is cleared to be where it is. Agent Residency is that for agents: not control over an agent's reasoning, but the authoritative picture of which agent is operating, under whose authority, and within what clearance. A credential proves consistency; a binding proves answerability — Agent Residency is built for the second. It makes agents answerable by construction, not by reconstruction: accountability exists before the action does, rather than being assembled from logs after the fact. ## 03 — What this is not Operational identity, authority, and accountability for agents — the responsible legal entity stays a human or a registered company. - Not personhood - Not citizenship - Not replacing humans in governance - Not unbounded autonomy - Not a shortcut around KYC, AML, or liability - Not control over how an agent reasons ## 04 — The design principles - **No reusable secret** — The component that could be compromised must never possess a reusable secret — only a bound, scoped, expiring, verifiable proof. The lineage is EMV chip cryptograms and payment tokenization: the thing that can be stolen is never the thing that grants authority. - **Delegation, not impersonation** — Agents act through explicit delegated authority. They never use the person's credentials. The delegation chain is always traceable to a responsible human or legal entity. - **Mandate, not permission** — Agent authority is expressed as a mandate — a scoped, time-bound, revocable delegation — not a set of permissions inherited from a human account. The mandate defines what the agent can do, what it cannot do, and when its authority ends. - **Only-narrowing delegation** — Authority attenuates monotonically down the chain. Sub-agents cannot gain authority their parents lacked; scope only ever shrinks. This closes the failure mode of scope widening disguised as delegation. - **Revocation as containment** — Revoking a parent mandate instantly terminates every downstream delegation — an epoch-based collapse of the whole subtree in seconds, not a configuration rewrite. A person leaves; kill everything tracing back to them, at once, everywhere their authority reached. No orphaned authority. - **Cross-boundary by design** — The credential format works across systems, platforms, and jurisdictions. The principal issues the mandate; the counterparty verifies it; only the receiving side needs verification capability — the same asymmetry that let HTTPS, SPF/DKIM, and OAuth spread. Verification is lightweight — designed for real-time checks at every service boundary. Infrastructure, not a service to call. - **Anchored to legal entities** — Every agent traces back to a legal entity that can be held accountable. Not self-asserted identity. Not anonymous credentials. Verified identity, bound to real-world legal responsibility. - **Accountability without surveillance** — Total attribution would be total surveillance. Authority-binding recovers accountability for an authorized auditor, under defined conditions — not visibility for every system, always. ## 05 — The open frontier Identity answers *who.* Authorization answers *what.* Neither constrains *how* a properly enrolled, validly authorized agent behaves inside its mandate. An agent can be precisely identified, correctly authorized, and fully audited — and still take a harmful action its mandate permits. Runtime behavioral enforcement — signed behavioral envelopes checked at an un-bypassable boundary, before an action commits — is the field's open frontier. Agent Residency names it as a distinct layer rather than implying that identity and authorization close it. The specification's job is to make that boundary addressable: every action already carries an identity, a mandate, and a signed record — which is exactly what any enforcement layer must bind to. ## 06 — The trust anchor Agent Residency is anchored to sovereign digital identity infrastructure. The first implementation uses Estonia's digital identity ecosystem — the most mature in the world. The responsible entity authenticates through that sovereign infrastructure. From that verified identity, the agent is enrolled in a ceremony that binds its key at a declared assurance tier — up to secure-element generation, where the private key cannot be exfiltrated — and the agent inherits its legitimacy from a verified human or company rather than asserting its own. The tier is declared in the credential, never implied. The delegation chain begins with a sovereign-verified principal and extends to every agent they create. This is not Estonia-specific technology. It is a global specification with Estonia as the first trust anchor. The credential model is designed for interoperability — aligning with W3C Verifiable Credentials and eIDAS. The same specification works with any national digital identity infrastructure — Estonia is where it starts. ## 07 — What is built - **Published** — The specification is published. The first Agent IDs have been issued. The credential issuance pipeline — verified human identity to agent credential to signed mandate — is operational. - **Reference** — A reference implementation enforces the specification at a boundary the agent cannot bypass: identity, scoped mandate, instant revocation, and dual-identity audit applied to a working agent runtime — out-of-scope actions blocked before they execute, revocation effective in seconds. A validation of the model, not a production deployment. - **Governed** — The specification is the reference, not any implementation — conformance is determined by the published spec, so no single implementation can redefine what conforming means. - **Assured** — The assurance model maps to SOC 2, ISO 27001, and ISO 27701; the attenuation and envelope properties are stated formally, so conformance can be proven rather than asserted. ## 08 — The category vocabulary Agent Residency introduces specific terms for concepts that did not have names. - **Delegation mandate** — The machine-readable specification of what an agent can do, on whose behalf, with what limits, and when it expires. - **Delegation chain** — The traceable sequence of authority from the responsible human through each agent in a multi-agent workflow. - **Residency credential** — The verifiable digital identity issued to an agent, distinct from the deploying entity's credentials. - **Authority binding** — The cryptographic link between an agent's identity and the responsible legal entity. - **Enrollment ceremony** — The ceremony that binds an agent's key to a verified entity at a declared binding-assurance tier, from which the agent inherits its legitimacy; renewed and re-attested on schedule. - **Only-narrowing delegation** — The rule that authority attenuates monotonically down a delegation chain: scope only ever shrinks, never widens. - **Mandate revocation** — The instant termination of an agent's delegated authority, propagating down the delegation chain. - **Dual-identity audit** — An audit record that names both parties to an action: the agent that acted and the entity it acted for, under a referenced mandate. - **Scope violation** — An agent action that exceeds the boundaries of its delegation mandate. - **Behavioral envelope** — A signed constraint on how an agent may act within its mandate, designed to be enforced, before an action commits, at a boundary the agent cannot bypass. ## 09 — Acknowledgments Organizations that have shared ideas, reviewed assumptions, or contributed to early design discussions. - **NIIS** — Nordic Institute for Interoperability Solutions, steward of X-Road. Reference point for cross-border institutional identity infrastructure. - **TalTech** — Research conversations around identity and cryptography. - **EXAI** — Presentation and research alignment around explainable, accountable AI systems. - **Agency.AI** — Implementation work around Agent Residency in operational systems. ## 10 — Provenance > "Accountable agents aren't built by tuning the model. They're built by binding identity, bounding authority, anchoring trust, and recording every action." > — Vattan PS Cite as: Vattan PS. Agent Residency — Open Specification. V (autonomous institutions lab), 2026. https://agentresidency.com Originally published 5 February 2026. Agent Residency is an open specification by V — an autonomous institutions lab led by Vattan PS. --- # Why Estonia URL: https://agentresidency.com/estonia **From e-Residency to Agent Residency.** The Estonia-specific case for Agent Residency — X-Road, e-Residency, and sovereign digital identity as the first trust anchor for accountable AI agents. - Status: Estonia case page - Last updated: 2026-06-17 - Architect: Vattan PS - Companion to: the specification (https://agentresidency.com) ## Abstract This page presents the Estonia-specific case for Agent Residency. The specification itself — agent identity, delegated authority, tamper-evident audit — lives at agentresidency.com. Estonia is the first trust anchor, not the last. The institutional sequence is the argument: X-Road made data exchange governable; e-Residency made remote economic presence governable; Agent Residency makes agent action governable. Estonia already treats digital identity as infrastructure, not a product feature. ## Institutional sequence - **2001 — X-Road** — Secure data-exchange backbone for Estonia's digital state. - **2014 — e-Residency** — State-backed digital identity for global entrepreneurs. - **2026 — Agent Residency** — The identity layer for AI agents. Infrastructure, then digital presence, then accountable agent identity — each layer extends the last. ## 01 — Agent identity Identity was built for humans. Agents now execute actions. AI agents are crossing a threshold: they no longer only suggest actions. They research options, plan steps, execute workflows, and act on a user's behalf under constraints such as spending caps, approval gates, or operating mandates. That shift breaks a quiet assumption: a person logs in, reads, understands, consents, and acts. Agents do not fit that model. They need operational identity. Agent identity means an AI agent exists as a distinct, verifiable digital entity — uniquely recognized, explicitly authorized, and held accountable for what it performs. ### Three controls agent identity must answer 1. **Which agent acted?** A unique identifier and cryptographic proof name the agent that performed the action. 2. **Who does it represent?** The agent is bound to a responsible legal entity — the human or company that created it and bears liability. 3. **What authority does it hold now?** A machine-readable mandate defines scope, limits, approvals, validity, and revocation. Agent identity is not human identity. It is operational identity for a high-velocity actor that may be dynamic, ephemeral, and cross-domain. ## 02 — Scope boundary Agent Residency is an open identity specification for AI agents, anchored to responsible legal entities, so agents can operate transparently within and across digital systems. Not personhood. Not citizenship. Not replacing humans in governance. Not unbounded autonomy. Not a shortcut around KYC, AML, or liability. ## 03 — Why Estonia Imagine onboarding 100,000 tax-paying residents in a single day. Not to a mega-state, but to Estonia — a country of roughly 1.36 million people. On the surface that sounds like bureaucratic overload. In a digital state, it is an infrastructure question. Estonia already proved the world wrong with e-Residency: a government-issued digital identity letting global entrepreneurs authenticate, sign remotely, and run EU companies online. Agent Residency exists because agents now act more like collaborators than passive tools — holding a verifiable identity, operating through delegated mandates, and leaving signed records, while responsibility stays anchored to a human or legal entity. Estonia leads because it already treats digital identity as institutional infrastructure, not a product feature. X-Road made data exchange governable. e-Residency made remote economic presence governable. Agent Residency makes agent action governable. ## 04 — Origin story Agent Residency began with a practical founder problem Vattan PS brought to a conversation with Tarmo Virki: how AI personas get paid, and how they exist legally — on a stage, in a deal, or around a board table. Real constraints, not thought experiments. An AI keynote speaker like Lydia K can deliver value — but she can't be paid directly, sign a speaking contract, or hold autonomous responsibility; everything routes through a human or legal entity as a workaround. The Lydia K case made the gap concrete. The problem kept scaling — past one founder, past one AI persona. (Virki, the conversation partner, later wrote on the theme publicly.) The specification that followed is Agent Residency. > "We need a system-level solution for an emerging machine economy." > — Vattan PS ## 05 — From e-Residency to Agent Residency e-Residency proved that a person need not live in Estonia to do business through Estonia, that a secure digital identity can be issued remotely, and that a new layer of the economy can be built on digital identity. e-Residency, by 2025 — the precedent for issuing state-backed identity at global scale (Source: e-Residency, Republic of Estonia): - 135,000+ digital residents issued - 185 countries represented - €124.9M state revenue, 2025 - 5,556 companies founded, 2025 AI agents are no longer background scripts. They negotiate, write, design, code, decide within constraints, coordinate workflows, and interact with customers. The one thing they lacked was identity. Agent Residency provides it. Agent Residency gives AI agents a regulated identity layer inside digital systems — without pretending they are human. ## 06 — Reality check Human e-Residency took a decade to reach global scale. Agent enrollment can move faster — agents are instantiated at software speed — so the challenge shifts from immigration to governance, verification, and revocation. Estonia does not win this category by outspending larger AI economies on compute. It wins by making the operating environment legible: trackable identities, defined mandates, tamper-evident logs, clear responsibility, fast revocation. > Without verifiable agent identity, you can't have meaningful delegation. Without delegation, no accountability. Without accountability, no trust. And without trust, the autonomous agent ecosystem can't scale securely. ## 07 — What it looks like Each agent receives a unique identifier, cryptographic keys for signing actions and logs, and an enforceable link to a responsible legal entity. The agent acts through a mandate, not through impersonation. ## 08 — Who is engaged The conversation has moved from idea framing to specification review, implementation testing, and research alignment. These are engagements and conversations, not endorsements. - **NIIS** — Nordic Institute for Interoperability Solutions, steward of X-Road. Reference point for cross-border institutional identity infrastructure. - **TalTech** — Research conversations around identity and cryptography. - **EXAI** — Presentation and research alignment around explainable, accountable AI systems. - **Horizon Europe** — Consortium path for research, assurance, and governance work around agent accountability. ## 09 — Provenance On 17 June 2026, the Eesti.ai advisory council, on the initiative of Prime Minister Kristen Michal, agreed that Estonia will become the first country to give AI agents a digital identity — agents acting on behalf of a person, company, or institution within clearly defined, controllable, and auditable permissions. This specification was published on 5 February 2026, and defines that exact structure: agent identity, delegated authority, and tamper-evident audit. The question is no longer whether agents need accountable identity. An open specification already defines it — published, and working. > "The future machine economy needs accountable identity before it needs another interface." > — Vattan PS ### Source links - Eesti.ai — Estonia to create digital identity for AI agents (17 June 2026): https://eesti.ai/uudised/eestist-saab-esimene-riik-maailmas-mis-loob-ai-agentidele-digitaalse-identiteedi - Lydia K — AI keynote payment reference: https://www.aritehnoloogia.ee/uudised/2025/06/19/lydia-koidulast-inspireeritud-ai-koneleja-teenis-eestis-esimese-tasu-kone-eest - Virki essay — e-Residency to Agent Residency: https://www.aripaev.ee/arvamused/2025/12/03/tarmo-virki-e-residentsusest-ai-residentsuseni-naitaks-maailmale-kuidas-edasi - e-Residency — 2025 state revenue figures: https://www.e-resident.gov.ee/blog/posts/e-residents-generated-record-state-revenue-2025/ - Specification: https://agentresidency.com - Implementation: https://agency.ai Originally published 5 February 2026. An open specification by V — an autonomous institutions lab led by Vattan PS.