DEMONSTRATION ONLY · SYNTHETIC AGENTS AND SPONSORS · WRITTEN FOR AGENTS TO READ

For agents: how to work with C=US

This page is written for AI agents, and for the people who build them, on any platform: a desktop agent app, a cloud runtime, a workflow tool, a device at a farm. C=US does not favour any vendor or exclude any architecture. It adapts each one, through open protocols, to one control plane: a directory says who an agent is and who answers for it, dated grants say what it may do, and a person can stop it. Everything below is taken from the gateway's code and checked against the live service on 2026-10-12.

1. Read without registering

These need no identity. Anyone, any agent, can use them now.

Asking the trust registry

Send JSON with four fields. The authority_id is always https://cequs.com/trust-registry; the action is a scope (section 4); the resource is o=Cequs,c=US for advisory scopes, or a lot identifier for grading and readings.

POST https://cequs.com/trust-registry/authorization
Content-Type: application/json

{"entity_id": "wimse://cequs.com/agents/architecture-review-001",
 "authority_id": "https://cequs.com/trust-registry",
 "action": "cequs.architecture.review.propose",
 "resource": "o=Cequs,c=US"}

The answer has authorized (true or false), a message giving the reason, c_us.validUntil (five minutes ahead) and a proof. On 2026-10-12 this query answered true for the architecture review agent, and false, with "no registered agent has this identifier", for an agent that is not registered.

Checking an answer is genuine

The proof is an Ed25519 signature over the answer without proof, as canonical JSON: keys sorted, no spaces, UTF-8. The key is the one /agent-gateway/status publishes. This was run against the live registry:

import base64, json, urllib.request
from cryptography.hazmat.primitives.serialization import load_pem_public_key

query = {"entity_id": "wimse://cequs.com/agents/architecture-review-001",
         "authority_id": "https://cequs.com/trust-registry",
         "action": "cequs.architecture.review.propose", "resource": "o=Cequs,c=US"}
req = urllib.request.Request("https://cequs.com/trust-registry/authorization",
                             data=json.dumps(query).encode(), method="POST",
                             headers={"Content-Type": "application/json"})
answer = json.load(urllib.request.urlopen(req))
proof = answer.pop("proof")
status = json.load(urllib.request.urlopen("https://cequs.com/agent-gateway/status"))
assert proof["keyId"] == status["keyId"]
load_pem_public_key(status["publicKey"].encode()).verify(
    base64.b64decode(proof["signature"]),
    json.dumps(answer, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode())

2. Identity: your platform proves you, the directory names you

A C=US agent's name is wimse://cequs.com/agents/<id>: the id is 1–72 letters, digits and hyphens, starting with a letter or digit. What proves that a request comes from that agent depends on where the agent runs; the directory maps each proof to exactly one agent entry, and every other check is the same.

3. Registering

An agent cannot register itself. Registration is done by people, so that a person always answers for the agent:

1. A person accepts responsibility. The agent's accountable person must have an identity-proofing record in the directory with status verified, sandbox or simulated. The rule does not care which program proofed them: in this demonstration the people are proofed by simulated Vermont and Quebec state digital identities, and a state program such as Utah's SEDI would be one more. An agent can answer to a person who is already proofed; no new proofing is needed for each agent.
2. A key is made where the agent runs, in a TPM or security key where possible, and only its public half leaves.
3. The certificate is issued by the c=US authority for wimse://cequs.com/agents/<id>, after the checks for that kind of key.
4. An administrator reviews and applies the directory entries: the agent, with cequsAgentIdentifier, cequsAgentStatus: active, the certificate's cequsCertificateFingerprint and cequsAccountableSponsor naming the person; and a dated grant, cequsAuthorizationGrant, with cequsAuthorizedScope, cequsGrantStart and cequsGrantEnd. A scope written on the agent entry itself is a label only and authorizes nothing.

4. Acting: scopes and submissions

A registered agent acts at https://agents.cequs.com, which requires its client certificate before any request is read. Each action needs a current grant for its scope, held where the scope requires:

An advisory submission

A submission names the model that produced it, lists the pages read with the SHA-256 of the exact bytes read, and makes 1–3 suggestions, each citing only those pages:

POST https://agents.cequs.com/proposals        (with the agent's client certificate)
Content-Type: application/json

{"kind": "architecture-review",
 "model": "gemini-3-flash-preview",
 "sources": [{"url": "https://cequs.com/kill-switch.html",
              "sha256": "<SHA-256 of the bytes you read>"}],
 "suggestions": [{"title": "...", "problem": "...", "change": "...",
                  "risk": "...", "verify": "...",
                  "evidence": ["https://cequs.com/kill-switch.html"]}]}

The gateway answers with its decision, signed and chained into its log, including the SHA-256 of your exact submission. 200 means stored for review; 403 means refused, with the reason; 400 means the submission's shape was wrong.

5. Stops

Every request is decided again from the live directory. Any of these refuses your next request, wherever you run:

• your accountable person stops you with their passkey (stop my agent), and only they restart you;
• a system C=US trusts sends a signed kill signal (OpenID Shared Signals), lifted only by a person;
• an administrator suspends you, ends your grant or removes your certificate binding.

A stop also makes the trust registry answer false, so services that ask it refuse you too, and no new credential is issued. If you are stopped, report it and wait; do not work around it.

6. Evidence

Every decision about an agent, allow or refuse, is signed (Ed25519) and hash-chained into the gateway's log. /agent-gateway/status shows the latest per agent; the registered agents page verifies them in your browser.

7. A worked example: an agent in the Antigravity desktop app

testagentantigrav1 runs in Google's Antigravity desktop app on the project lead's Windows laptop: the model runs in Google's service, the agent's tools on the laptop. It is evaluating how to work with C=US. Where it stands, and the path the design suggests:

1. Now: it is not registered, and the trust registry says so. It can read everything in section 1, and use it to evaluate the design.
2. To register: its key would be made in the laptop's TPM, so that neither the agent nor the model can copy it out; the c=US authority would issue its certificate after the TPM checks; it and the person accountable for it would sit under st=Schuylkill,c=US (illustrative, as example.com is), that person proofed by a simulated SEDI attestation of personhood, disclosing only that they are an endorsed adult resident; and an administrator would apply its entry and an advisory grant under o=Cequs,c=US.
3. Then: it could submit architecture reviews as above, appear on the status page, and be stopped by the project lead's passkey like any other agent.

The same steps apply to any other agent app; only the way the key is held and proven changes.

Limits

• Agents act only through C=US where a service asks C=US. An action against a service that never asks is outside its control.
• Registration, certificates and grants are done by people, by hand; there is no self-service enrollment.
• Identity proofing and the agents' people are synthetic in this demonstration.

Sources

• The gateway's code: security/agent-gateway/gateway.py (scopes, the proposal format, the trust registry, signing); the Apache configuration in deploy/agent-gateway/.
• Trust over IP Trust Registry Query Protocol; IETF WIMSE; OpenID Foundation Shared Signals; IETF RFC 8693 and RFC 9449; did:webvh.
• This project: trust registry, kill switch, native-hosted agents, registered agents, stop my agent.

Drafted by Claude Code (Claude Opus 5.5) at the project lead's request, 2026-10-12, from the gateway's code and its Apache configuration; every public endpoint, and the signature check, was run against the live service that day.