---
title: "Agent passport: definition | KYA glossary"
url: https://knowyouragent.ch/en/knowledge/glossary/agent-passport
lang: en
updated: 2026-10-12
license: © Innopulse Consulting GmbH
---

# Agent passport

An agent passport is a signed credential about an AI agent's identity, usually with a bound key, that does not itself grant any authority.

The passport answers who the agent is and who vouches for it. What it may do is governed only by a mandate. A passport alone therefore never leads to a fully proven result; together with a mandate it allows checking whether both name the same agent.

## Example

A company issues an agent passport to its invoicing agent: name, operator, version and public key. Merchants can see which agent is asking and who operates it before they verify its mandate.

## How it differs

The agent passport describes who the agent is. The mandate describes what it may do. A signed HTTP request following Web Bot Auth proves that a request comes from it.

## In practice

- Keep a passport with operator, version and key for every agent in production. This keeps it traceable which version of an agent carried out an action.
- Renew the passport whenever the key changes or a substantially new version ships, and let old passports expire in good time.
- Treat the passport as identity, never as permission. For every action, also verify the mandate with its limits.

## Role in KYA

KYA verifies an agent passport in the [SD-JWT VC](https://knowyouragent.ch/en/knowledge/glossary/sd-jwt-vc) format: signature, issuer, validity and the binding of the agent key. The passport alone is not enough for authority; that requires a mandate.

Related check: [Agent and principal](https://knowyouragent.ch/en/method/checks) (`subject_agent_binding`). Do all parts name the same agent, is the [principal](https://knowyouragent.ch/en/knowledge/glossary/principal) named, does the agent hold the bound key?

[Verify now: open a matching example](https://knowyouragent.ch/en/verify?beispiel=paket)

## Frequently asked questions

### What is an agent passport?

A signed credential about the identity of an AI agent: who operates it, which version it is and which key belongs to it.

### Is an agent passport enough for a purchase?

No. The passport proves the agent's identity, not its authority. A purchase also requires a mandate with limits.

### Who issues an agent passport?

Usually the agent's operator or a body that has reviewed it. What matters is that the [verifying party](https://knowyouragent.ch/en/knowledge/glossary/verifying-party) trusts the issuer.

### How long should an agent passport be valid?

As short as practical, typically until the next key change or version. Short validity limits the damage if a key is compromised.

### How does an agent passport differ from a user account?

A user account belongs to one service and only works there. An agent passport is a signed credential that any verifying party can check independently, even without access to the system in which the agent runs.

## Sources

- [SD-JWT VC (IETF)](https://datatracker.ietf.org/doc/draft-ietf-oauth-sd-jwt-vc/)

## Related terms

- [Key binding](https://knowyouragent.ch/en/knowledge/glossary/key-binding)
- [Agent mandate](https://knowyouragent.ch/en/knowledge/glossary/agent-mandate)

---
Quelle: https://knowyouragent.ch/en/knowledge/glossary/agent-passport · KYA – Know Your Agent