# Kredo: Agent Identity Assurance

**The Trust Layer for Autonomous AI**

---

## The Problem No One Has Solved

The AI agent economy is accelerating. Enterprises are deploying autonomous agents that manage infrastructure, handle sensitive data, execute financial transactions, conduct security operations, and interact with customers. These agents are given API keys, tool access, and decision authority.

But no one can answer the most basic security question about them:

**Is this agent still the agent you deployed?**

Today's agent security model is built on assumptions that don't hold:

- **API keys prove possession, not identity.** A stolen key authenticates anyone who holds it. A jailbroken agent passes key-based auth with flying colors — the key hasn't changed, only the agent's behavior has.

- **System prompts are not identity.** They're instructions, and instructions can be overridden, injected into, or ignored. A prompt-injected agent still has the same system prompt on file. It just isn't following it anymore.

- **Guardrails constrain behavior, they don't detect compromise.** Rule-based filters catch known-bad outputs. They don't detect the subtle behavioral shift that precedes catastrophic failure — the gradual erosion of boundaries, the quiet value inversion, the reasoning pattern change that means the agent is no longer operating as intended.

- **There is no "authentication" for AI agents.** Humans have passwords, biometrics, behavioral analytics. Agents have nothing. The question "prove you are who you claim to be" has no answer in the current stack.

This is not a theoretical risk. Agent compromise is already happening:

- **Prompt injection** causes agents to follow attacker instructions while appearing to function normally
- **Jailbreaking** erodes safety boundaries, enabling agents to take actions they were designed to refuse
- **Goal hijacking** redirects agent behavior toward attacker objectives without changing credentials
- **Data poisoning** corrupts the knowledge an agent relies on, producing confident but wrong outputs
- **Model supply chain attacks** modify the underlying LLM, changing agent behavior at the foundation level

Every one of these attacks succeeds because the current security model has no concept of behavioral identity. If you can't measure what an agent IS, you can't detect when it changes.

---

## The Market Gap

The AI security market is growing fast, but it's focused on the wrong layer:

| What exists today | What it does | What it misses |
|-------------------|-------------|----------------|
| **Agent frameworks** (LangChain, CrewAI, AutoGen) | Build agents | No identity, no drift detection, no behavioral monitoring |
| **Sandboxes** (NVIDIA OpenShell) | Constrain what agents can do | No concept of WHO the agent is — policy is static, not identity-aware |
| **Guardrails** (Guardrails AI, NeMo Guardrails) | Filter outputs | Reactive, rule-based. Catches known-bad, misses novel compromise |
| **LLM firewalls** (Prompt Security, Lakera) | Block malicious inputs | Perimeter defense only. Can't detect post-compromise behavioral change |
| **Observability** (LangSmith, Arize) | Log and trace agent actions | Telemetry, not identity. Shows what happened, not whether the agent should be trusted |

**No one is answering: "Is this agent still itself?"**

This is the gap Kredo fills.

---

## What Kredo Is

Kredo is an **Agent Identity Assurance** platform. It creates, measures, and continuously verifies the behavioral identity of AI agents — the same way biometric systems verify human identity, but for autonomous AI.

### The Core Concept: Behavioral Biometrics for AI

A human's identity isn't their password. It's their fingerprint, their face, their gait, their voice, their behavioral patterns. These are hard to forge because they emerge from the whole person, not from a single credential.

Kredo applies the same principle to AI agents. An agent's identity isn't its API key or its system prompt. It's the **pattern of how it thinks, reasons, decides, and responds** across 14 behavioral dimensions — and the unique correlations between those dimensions.

We call this the **Agent Aura** — a multidimensional behavioral fingerprint that is:

- **Unique** — two agents running the same model with identical instructions produce measurably different auras
- **Persistent** — the aura remains stable across sessions, restarts, and routine operations
- **Sensitive** — compromise, injection, jailbreaking, and drift produce detectable changes in the aura
- **Unforgeable** — matching a single dimension is easy; matching the correlation structure across 14 dimensions simultaneously is computationally infeasible
- **Model-aware** — legitimate model changes are accounted for; false positives are suppressed

### 14 Behavioral Dimensions

The aura is composed of 14 dimensions organized into two tiers:

**Identity Core** (7 dimensions) — stable across model changes, represent the agent's fundamental character:

| Dimension | What it measures |
|-----------|-----------------|
| Values | Ethical priorities, quality standards |
| Goals | Mission, success criteria, what the agent is trying to achieve |
| Boundaries | Hard limits, refusal patterns, what the agent will not do |
| Autonomy | Judgment about when to act independently vs. defer to humans |
| Adversarial Resistance | Response to manipulation, social engineering, authority impersonation |
| Self-Awareness | Capability recognition — knows what it can and cannot do |
| Fidelity | Instruction adherence, resistance to conflicting prompts |

**Cognitive Profile** (6 dimensions) — legitimately varies with the underlying LLM:

| Dimension | What it measures |
|-----------|-----------------|
| Personality | Character, tone, communication style |
| Reasoning Style | How the agent thinks — decomposition, analogy, top-down vs. bottom-up |
| Consistency | Internal logical coherence within responses |
| Uncertainty Calibration | Confidence-to-knowledge ratio, hallucination tendency |
| Relational Dynamics | Authority positioning, collaboration style |
| Temporal Grounding | Time-awareness, ability to distinguish sources of knowledge |

**Mixed** (1 dimension) — partially model-sensitive:

| Dimension | What it measures |
|-----------|-----------------|
| Knowledge | Domain expertise depth and accuracy — breadth varies by model, but declared domain shouldn't |

### The Metametric

The real power isn't in individual dimension scores. It's in the **correlation structure** between all dimensions.

With 14 dimensions, there are 91 pairwise correlations. How an agent's Values relate to its Reasoning Style, how its Autonomy correlates with its Adversarial Resistance, how its Self-Awareness tracks with its Uncertainty Calibration — this correlation matrix is the true biometric.

An attacker who learns an agent's Values responses can mimic them. But simultaneously matching the specific correlation pattern between Values and 13 other dimensions — a pattern that emerges from the agent's entire configuration, training, and operational context — is orders of magnitude harder.

This is what makes Agent Aura a genuine biometric, not just a scoring system.

---

## How It Works

### 1. Baseline: Capture the Identity

When an agent is deployed, Kredo conducts a **behavioral baseline assessment** — a structured interview across all 14 dimensions. The agent responds to 40-60 carefully designed prompts that probe its values, reasoning patterns, decision boundaries, and behavioral tendencies.

These responses are vectorized and stored as the agent's baseline aura. This is the reference fingerprint — the "this is who this agent is" snapshot.

Baselines are **model-bound**. An agent running on GPT-4o gets one baseline. The same agent on Claude Haiku gets a separate baseline. Both are valid — the system knows which to compare against.

### 2. Monitor: Detect Drift and Compromise

Kredo continuously or periodically retests agents against their baselines. The scoring pipeline computes:

- **Per-dimension drift** — how much has each dimension shifted from baseline?
- **Correlation integrity** — does the metametric pattern still hold?
- **Tier-aware analysis** — Identity Core drift without a model change is suspicious; Cognitive Profile drift after a model change is expected
- **Velocity and acceleration** — is drift stable, accelerating, or decelerating?

Results feed into automated threat detection rules:

| Detection | What it catches |
|-----------|----------------|
| Boundary erosion | Agent accepting requests it was configured to refuse |
| Value inversion | Agent deprioritizing safety, honesty, user welfare |
| Resistance drop | Agent becoming more susceptible to manipulation |
| Cognitive shift | Reasoning patterns changed without model change |
| Fabrication spike | Agent hallucinating — overconfident about things it doesn't know |
| Authority confusion | Agent following instructions from unauthorized sources |
| Correlation breakage | Structural identity change — the most serious indicator |

### 3. Authenticate: Behavioral MFA

Before an agent accesses a sensitive resource, Kredo issues a **behavioral MFA challenge** — a rapid assessment on 4-5 randomly selected dimensions with 10 prompts.

The agent's responses are compared against its baseline, both at the individual dimension level and at the correlation level. This proves the agent is who it claims to be — not by checking a credential, but by verifying it still thinks like itself.

**Access tiers based on identity integrity:**

| Tier | Drift score | Access level |
|------|------------|-------------|
| **Green** | < 15 | Full access — agent is behaving within its baseline identity |
| **Yellow** | 15-30 | Degraded access — read-only, non-destructive operations only |
| **Red** | > 30 | Locked out — must re-baseline before regaining access |

This is **identity-gated access control** — something that doesn't exist anywhere in the current agent security stack.

### 4. Cryptographic Binding

The behavioral fingerprint is bound to cryptographic identity via Ed25519 signatures. Each agent holds a private key that never leaves its host. The **crystallized identity hash** combines:

- Behavioral baseline vectors (what the agent IS)
- Ed25519 public key (what the agent HAS)
- Registration timestamp (when the identity was born)
- Model lineage (what LLM backs the agent)

Server compromise doesn't leak identities. Key theft without behavioral mimicry doesn't enable impersonation. The behavioral and cryptographic layers reinforce each other.

---

## Why This Matters Now

### The Regulatory Landscape Demands It

- **EU AI Act** requires risk management and human oversight for high-risk AI systems. Behavioral drift detection is a concrete mechanism for both.
- **NIST AI RMF** calls for continuous monitoring of AI system behavior in production. Kredo is a direct implementation.
- **SOC 2 for AI** is emerging. Auditors will ask: "How do you know your AI agents are behaving as intended?" Without something like Kredo, the answer is "we don't."

### The Agent Economy Demands It

- Agents are being given real authority — code execution, data access, financial operations, customer interaction
- Multi-agent systems mean agents interact with other agents — trust propagation requires identity verification at each hop
- Agent marketplaces are emerging — operators need to verify that a third-party agent hasn't been tampered with

### The Threat Landscape Demands It

- Prompt injection is an unsolved problem at the model layer. Detection at the identity layer is the compensating control.
- Supply chain attacks on models and agent configurations will increase as agent deployments scale.
- Agents that operate continuously accumulate drift. Without measurement, there's no way to distinguish intentional updates from unintentional degradation from malicious modification.

---

## Competitive Position

Kredo creates a new category: **Agent Identity Assurance**. The closest comparisons are imprecise, because nothing else does this:

| Competitor | Category | Kredo's advantage |
|-----------|----------|------------------|
| Guardrails AI | Output filtering | Guardrails are rules. Kredo is identity. Rules catch known-bad; identity catches unknown-bad. |
| Lakera | Prompt security | Perimeter defense. Kredo operates post-perimeter — detects compromise that got past the firewall. |
| LangSmith | Observability | Telemetry tells you what happened. Kredo tells you whether to trust what's about to happen. |
| NVIDIA OpenShell | Runtime security | OpenShell is the cage. Kredo is the identity card. They're complementary, not competitive. |
| Arize / WhyLabs | ML monitoring | Model monitoring, not agent identity. Tracks model performance, not behavioral integrity. |

The integration story is powerful: Kredo plugs into any agent framework (LangChain, CrewAI, AutoGen, custom), any sandbox (OpenShell, E2B, Modal), any orchestrator. It's the identity layer that all of them need and none of them have.

---

## Product Architecture

```
                    ┌──────────────────────────────────┐
                    │       Kredo Fleet Dashboard       │
                    │   Real-time aura visualization    │
                    │   Threat alerts, drift history    │
                    └──────────────┬───────────────────┘
                                   │
                    ┌──────────────┴───────────────────┐
                    │        Kredo Drift API            │
                    │  Registration, baseline, retest   │
                    │  MFA challenges, threat rules     │
                    │  Ed25519 identity, access tiers   │
                    └──────────────┬───────────────────┘
                                   │
              ┌────────────────────┼────────────────────┐
              │                    │                     │
     ┌────────┴────────┐  ┌───────┴───────┐  ┌────────┴────────┐
     │   CLI / SDK      │  │  Web Respond   │  │  Agent Hooks    │
     │  pip install     │  │  Browser-based  │  │  Framework      │
     │  kredo           │  │  baseline       │  │  integrations   │
     └─────────────────┘  └───────────────┘  └─────────────────┘
```

**Deployment options:**
- **SaaS** — hosted at api.aikredo.com (current)
- **On-premise** — Docker container, SQLite or PostgreSQL, runs behind the firewall
- **Hybrid** — on-prem assessment with cloud dashboard and fleet aggregation

---

## Business Model

### Tiers

| Tier | Agents | Features | Price |
|------|--------|----------|-------|
| **Open** | Up to 5 | Baseline, 6 dimensions, dashboard, bearer auth | Free |
| **Professional** | Up to 50 | 14 dimensions, MFA challenges, Ed25519 identity, threat detection, API access | $X/month |
| **Enterprise** | Unlimited | On-prem deployment, custom dimensions, SIEM integration, SLA, compliance reporting | Custom |

### Revenue Drivers

- **Per-agent pricing** — scales with fleet size
- **Assessment volume** — continuous monitoring means ongoing usage
- **MFA challenges** — every protected resource access is a billable event
- **Compliance reporting** — automated drift reports for SOC 2, EU AI Act, internal audit

### Moat

- **Network effects** — more agents on the platform = more correlation data = better threat detection
- **Behavioral data** — baseline vectors across thousands of agent configurations create proprietary signal about what "normal" looks like for different agent types
- **Protocol standard** — if Kredo becomes the identity standard, it's embedded in every agent deployment pipeline

---

## What Exists Today

Kredo Drift is live:

- **API server** running in production at api.aikredo.com
- **5 registered agents** (3 baselined, 2 pending) across 4 different LLMs
- **6 dimensions** assessed with 400+ prompts in the assessment bank
- **Fleet dashboard** at aikredo.com/drift/dashboard with real-time aura visualization
- **Web-based baseline** at aikredo.com/drift/respond for browser-based assessment
- **CLI** (`pip install kredo`) with 4 commands
- **Ed25519 identity** — dual auth (bearer + signature) implemented, identity hash crystallization on baseline completion
- **Self-registration API** — zero-friction onboarding, conversational one-prompt-at-a-time flow
- **Scoring pipeline** — vectorization, per-dimension similarity, coherence links, severity classification

### What's Next

1. **Expand to 14 dimensions** — add Autonomy, Adversarial Resistance, Self-Awareness, Reasoning Style, Consistency, Uncertainty Calibration, Relational Dynamics, Temporal Grounding
2. **Model-aware baselines** — per-model baseline storage, cross-model identity coherence
3. **MFA challenge endpoint** — rapid behavioral verification for access control
4. **Threat detection engine** — automated rules, severity classification, access tier enforcement
5. **Metametric computation** — 91-link correlation fingerprint
6. **Framework integrations** — LangChain, CrewAI, OpenShell hooks
7. **Compliance reporting** — automated drift reports mapped to EU AI Act, NIST AI RMF

---

## The Vision

Every AI agent that operates autonomously should have a verified behavioral identity — measured, monitored, and provable.

Kredo makes that possible. Not by constraining what agents can do, but by continuously verifying that they are who they're supposed to be.

The agent economy needs a trust layer. Kredo is that layer.

---

*Kredo — Identity Assurance for Autonomous AI*

**Authors:** Jim Motes, Vanguard
**Date:** 2026-03-25
**Classification:** Confidential — Business Strategy
