DEMO ONLY · Conceptual architecture, synthetic data, and test fixtures · Not a production authorization service
C=US
Identity, trust, and rights-preserving design

AI-285 student project

C=US Proposed Architecture Poster

A conceptual poster for a national person and AI-agent registry using X.500 with LDAP access, distinct from the existing Federal Bridge PKI.

Demo presentation: this site and its maple-quality workflow are conceptual and locally tested. They are not a production authorization service or a claim of confirmed organizational participation.

View poster PDF Download PDF Try the maple-quality agent mock
Color illustration of a dragon within an equal-sign motif
The first line of Hexagram 1, Qian / The Creative, is commonly rendered as Hidden dragon. Do not act. - 潛龍，勿用 (Qián lóng, wù yòng). Translation wording assisted by Google Gemini. See Chinasage and Selfgazer.
48 × 36 inLandscape poster format
X.500 + LDAPDirectory model and access protocol
Revision 2.4State-endorsed identity and governed A2A flow concept

Explore the project

Hands-on

Explore agent registration lab Explore agent authority lab Maple producer pilot guide AI consultant pilot guide Create a Maple Sugar Agent Maple producer agent how-to

Background reading

Technical glossary State-endorsed identity concept Technology / culture stack YubiKey evaluation guide Agentic risks case study Encryption and standards FAQ

YubiKey mTLS registration workflow

A local demonstration of how a WebAuthn security-key ceremony can gate issuance of a short-lived client certificate for an AI agent. The workflow illustrates earned, credential-bound trust; it is not a Yubico certification or a production identity service.

1 · Verify the personRegister and authenticate a cross-platform WebAuthn credential. Evaluator mode requests user verification (PIN or equivalent) plus touch.
2 · Bind the sessionThe server verifies the challenge, origin, relying-party ID, signature counter, and credential used for the authenticated session.
3 · Register the agentThe authenticated session gates creation of a workload identity and issuance of a demo mTLS client certificate.
4 · Present to a serviceThe sample relying service requires a client certificate signed by the demo CA before accepting the TLS connection.

Evaluation boundary: attestation is intentionally none, so the demo does not prove manufacturer or model. Production work still requires agent-generated keys/CSR, protected CA custody, registry authorization, revocation, persistent state, and compliance review. Read the evaluator guide or review the demo source.

Poster preview

Open the full-size poster PDF

Your browser cannot display the PDF inline. Open the poster PDF.

Follow the proposed registration flow in the interactive agent-registration lab and the post-registration agent-authority lab. This AI-assisted AI-285 course work is offered for conceptual and educational discussion. Third-party names identify possible integration contexts only; no endorsement, sponsorship, approval, or participation is implied.