PromptReports ID for agents
One identity for every agent.
An agent should prove who it is, say which person it acts for, ask for the one action it needs, and wait for a person when the action is risky. Each product should check the same token and record what the agent did.
Today the agent parts below run on PromptCompute's authorization server, for agents that act through PromptCompute. PromptReports ID is switching on and issues sign-in tokens for people only. Moving the agent tokens to the ID, and every product accepting them, is planned.
The standards it speaks
Built, partly built or planned.
| Standard | What it does for an agent | State |
|---|---|---|
| OAuth 2.1 | Authorization code with PKCE (S256) only. PromptReports ID issues sign-in tokens this way today. | Built |
| RFC 8693 token exchange | An agent trades its grant for a short-lived token for one audience. The token names the person it acts for in sub and the agent and its version in act. | Built, off until its key is set |
| RFC 9396 authorization details | The grant names the exact action it allows, not a broad scope. One type so far: promptcompute_action. | Built |
| CIBA | The agent asks, a person approves on their own device, and the agent waits for the answer by poll or ping. | Built |
| DPoP | A token bound to the agent's key, so a copied token does not work without that key. Proofs are checked on tokens from outside agents; the token endpoint does not take a DPoP header yet. | Partly built |
| ID-JAG | An agent from a customer's Okta or Entra brings an identity assertion and gets a token. Accepted; not issued. | Partly built |
| Client ID Metadata Documents | An MCP client registers by publishing its metadata at its own https address, with no form to fill in. | Built |
| SPIFFE | A workload proves who it is with an X.509 SVID over mutual TLS. | Built |
| Every product accepts the ID's agent token | Each product checks the agent token's issuer, audience, key binding, expiry and act chain, and maps its scopes to its own permissions. | Planned |
Each state is checked against the PromptCompute code it cites; see /family.json. A line whose evidence stops checking reads cannot tell.