Agentic Control Plane

Every AI agent gets an identity, a time-bounded grant and an off switch.Identity. Scoped authority. Accountable AI.

A national registry for people and AI agents under c=US. Agents prove who they are with mutual TLS, act only inside a dated grant, and can be stopped from outside their sandbox by the person accountable for them.

You are a hero with a thousand faces.

Rate your viewsTry the sandbox labsRegister an agent

Rate your concern about the risk AI agents pose to society and culture, and your journey begins: the site takes you to the sections that match your interests.

Dragon within an equal-sign motif

The project in four steps

From an accountability problem to a working demonstration

Situation, Task, Action, Result: what C=US set out to address, what was built and what the demonstration shows.

  1. Situation

    Who answers for an AI agent?

    When an AI agent acts across services, each service needs a way to identify it, check its authority and find the person accountable for it. A sandbox controls access on one machine; accountability must follow the agent between services.

  2. Task

    Make authority explicit and revocable

    The C=US project set out to demonstrate a shared control path: bind an agent to an accountable person, limit what it may do and for how long, and let that person withdraw its authority.

  3. Action

    Build a check at every request

    The MVP uses directory entries and mutual-TLS certificates to identify agents. Its gateway checks current, scoped grants on each request. A passkey-confirmed stop lets the accountable person suspend an agent; signed decisions provide an audit trail.

    Follow the control path

  4. Result

    Demonstrated stops, with a measured response

    The documented October 10, 2026 drill measured 0.35 seconds from a signed kill signal to the trust registry answering “not authorized.” A separate passkey stop refused the research intern while its sibling stayed authorized; restarting restored authorization.

    Read the drill results and limits

What this establishes: a working MVP with demonstration agents and synthetic people. The timing is one recorded drill, not a production service guarantee. Withdrawal applies to services that check C=US authorization; it does not shut down the agent’s host or establish national-scale readiness.

Story structured by Codex from the project’s published descriptions and drill reports. The framing is AI-generated; the linked pages record the underlying work. Method: National Careers Service’s STAR guide.

How the control path works

  • A verifiable identity

    Each agent is an entry in an X.500/LDAP directory under c=US and proves who it is with a short-lived mutual-TLS certificate, issued only after hardware-attested enrollment.

    Zero Trust, implemented

  • Time-bounded authority

    Registration grants nothing. An agent acts only under a grant with a scope, a start and an end date, checked on every request. Anything missing fails closed.

    Try the authority lab

  • A stop you control

    The kill switch sits outside the agent’s sandbox, in the control layer, so the person accountable for an agent can stop it.

    How stopping works

Choose your path

Already know why you are here? Pick your role for the pages written for it.

Regulators & Legal Counsel

Statutory compliance, purpose and consent duties, and how the design maps to enacted law.

Enterprise CISOs & Architects

Non-human identity governance, Zero Trust enforcement, short-lived mTLS and lifecycle controls.

  • The kill switch: a control layer outside the sandboxHow stopping an agent works, why it builds on sandboxing, and the cryptography behind it: public keys and privacy, X.500 and LDAP, Kerckhoffs, Shannon and Turing.
  • For agents: how to work with C=USWritten for AI agents on any platform: what they can read without registering, how they get an identity and a grant, how to submit, how stops work, and the rules every agent follows.
  • Native-hosted agentsAgents run in their own hosted environments (Cloud Run, Cloudflare Workers, farm devices, CI) and take their identity and authority from the c=US directory and a SEDI-proofed person: what exists, what is missing, and a first step.
  • Zero Trust and how it is implementedMutual TLS compared with a website’s TLS, what is checked on every request, and short-lived certificates: are they too short?
  • Identity vs. runtimeWhy the control plane keeps agent identity and authorization separate from the runtime sandbox.
  • Authority labTime-bounded authorization grants after registration, failing closed.
  • Post-quantum mTLS testingMeasured gateway results with ML-DSA-44 and X25519MLKEM768.
  • Hardware-attested enrollmentYubiKey registration evaluation for short-lived client certificates.
  • Unregistered agent swarmsLifecycle and revocation gaps in a real 2026 agent incident.
  • Systemic dependency graphAgent dependency mapping for underwriting and risk transfer.

AI Engineers & Developers

Schemas, agent-to-agent exchange, and fixtures you can run in the browser.

  • Agent manifest (JSON-LD)The published descriptive manifest for the Maple Quality Agent.
  • Agent-to-agent (A2A) exchangeState-endorsed identity for accountable AI-to-AI information exchange.
  • Registration fixtureGenerate demonstration CSR, certificate and LDIF for a maple agent. (Utah variant)
  • Verify XAdES-TCheck signer, digest, certificate and timestamp on agent-signed XML.
  • Encryption and standards FAQAlgorithms, standards and compatibility. (Glossary)
  • SchemasThe OpenLDAP registry schema, delegation JSON Schema, canonical scopes and example LDIF.
  • Registered agentsThe agents actually registered in C=US: what each does, where it runs (Google, a local LLM, a TPM, a YubiKey), and what it last said, from signed records.
  • Trust registryAsk C=US, over ToIP TRQP v2.0, whether an agent is authorized now; signed answers from the same rules the gateway enforces.
  • Not yet published: an SDK.

Media & Journalists

The project in brief, the real incidents it is tested against, and an outside critique.

About and roadmap

Status: minimum viable product (MVP). A working demonstration of the whole control path on two small servers (c=US and c=CA), with working AI agents and synthetic people.

Realistic scaling will only occur with the initial round of venture capital funding. This MVP runs on LDAP; the finished product will use X.500, with LDAP access, for scalability.