Architecture
Client runtime
The client runtime is the enforcement point that lives inside the agent process. It sees every outbound call the agent makes, native tool calls and MCP calls alike, and gives each governed one a scoped, verifiable intent token before it leaves. It is the durable path. Because it runs in-process and depends only on the HTTP layer, an agent can’t route around it.
What it does on every call
Four things, in order. It derives the acting agent’s identity from what the process is actually running. It recomputes the checksum and confirms it matches a registered agent. It holds an ephemeral proof-of-possession key in memory and uses it to sender-constrain the token. And it mints and attaches the intent token to the outbound request, or fails closed if any check doesn’t hold.
Note
agent(...) context. Calls to governed audiences get an intent token stamped on automatically; everything else passes straight through.Identity is announced, never inferred
The runtime does not walk the call stack to guess which agent is calling, and it never trusts an identity passed as a call-time argument. A prompt-injected LLM can forge an argument, but not the framework’s own execution entry. The verified agent declares its identity at its execution entry point (via auto-instrumentation), and the runtime attributes egress to it using process-local context rather than stack introspection.
The unbypassable path
Enforcement that depends on the agent’s cooperation is not enforcement. Because the runtime intercepts at the HTTP layer, it catches all egress regardless of the agent host’s conventions. There is no authenticated_request() the agent has to remember to call, and no framework-specific hook to opt out of. The tools are plain HTTP calls; governance happens underneath them.
▶Embed mode and the open runtime
There are two client forms sharing one model. The embed client is the in-process interceptor described here. It is the generalized, MCP-era successor to the original A-JWT shim, with context-based attribution rather than call-stack introspection. The open-source runtime is the same client half of the protocol, packaged for adoption; it establishes verified identity and fails closed, and never enforces on its own. The Authority remains the verifier and trust root.
Both share the exact hashing code with the Authority (see checksum engine): only the extraction layer that turns a live agent into identity inputs is client-side and framework-aware. That parity is what lets a client prove “this is the registered, unmodified agent” without the agent declaring anything the Authority has to take on faith.