Preview — not for production reliance
Agentic Root TrustPowered by Sectigo
Documentation

Docs

Agentic Root Trust documentation

A public directory that connects a SPIFFE workload identity to the verified organization behind it. What it does, who it is for, and what it deliberately does not do.

Agentic Root Trust, powered by Sectigo, is a universal workload trust directory at svid.io. An organization proves that it controls a domain, that it is who it says it is, and that the person acting for it may do so. It then registers the SPIFFE issuers that speak for it. A relying party that receives a request from an agent resolves the agent's trust domain and gets back a short-lived signed assertion naming that organization, plus the exact public trust bundle the organization approved.

You run agents or workloads

Claim your domain, pass the identity and authority review, and register the SPIRE servers that issue your workloads' SVIDs.

Get started as an organization

You receive requests from agents

Resolve a trust domain, verify the signed assertion offline against pinned keys, then check the SVID against the approved bundle.

Verify an agent's issuer

How it fits together

Who uses the directory An organization claims its domain and registers its SPIRE issuer with the directory, sending only the public bundle. Reviewers verify the organization's identity and authority. The SPIRE server issues an SVID to an AI agent, which connects to a relying party over mTLS. The relying party resolves the agent's trust domain at the directory, receives a signed assertion and the approved bundle, and makes its own allow or deny decision. YOUR ORGANIZATION Organization admins in the console SPIRE server holds CA keys, issues SVIDs AI agent workload holds an X.509-SVID ③ issues SVID Reviewers independent checks ② verify identity + authority Agentic Root Trust svid.io Verified organizations Domain claims + evidence Issuer bindings + bundles Signed assertions (ES256) Public change feed ① claim, register bundle (public keys) Relying party API, service or agent ⑦ allow or deny: its own decision ⑤ resolve ⑥ assertion + bundle ④ mTLS connection with the X.509-SVID The directory never issues credentials and never holds private keys.
The organization registers its issuer once; every relying party then checks each agent against the directory and decides for itself.

What the directory does

  • Discovery. A public, searchable list of domains. Every domain starts unclaimed. The list is seeded from a pinned Tranco snapshot; popularity only affects browsing order.
  • Claiming. Three checks before a claim is verified: a DNS TXT challenge, a reviewed organization identity, and a reviewed representative authority. See Concepts.
  • Issuer authorization. A verified organization registers an exact SPIFFE trust domain, the federation bundle endpoint, the public trust bundle and the workload paths the issuer may speak for. Two independent reviewers approve the exact bundle digest before it becomes active.
  • Signed resolution. GET /v1/resolve?trust_domain= answers with a compact JWS (ES256) that lives at most 300 seconds, or with an explicit inactive status.
  • Lifecycle. Rotation with an explicit overlap, withdrawal with a stated race bound, and a public change feed that tells relying parties when to resolve again.

Who it is for

You are You use Start with
An organization that runs agents or other workloads with SPIFFE identities (usually SPIRE) The organization console or the authenticated API Getting started
A relying party: an API, service or agent that must decide whether to trust a caller The public API: /v1/resolve, /.well-known/jwks.json, bundles and the change feed Verification

What it is not

The directory makes one kind of statement: which verified organization has authorized a trust domain, with which bundle and scope, as of a moment no more than 300 seconds ago. It deliberately stops there.

  • It never issues credentials. Your SPIRE servers stay the issuers. The directory does not attest workloads or mint SVIDs.
  • It holds no private keys. It stores public trust bundles only; a bundle containing private key members is refused. Issuer control is proven without exporting a CA key.
  • A lookup never grants access. A valid assertion tells you who stands behind a trust domain. Whether that workload may perform an operation is always the relying party's own decision.
  • It does not revoke SVIDs. Withdrawing a binding stops the directory's endorsement. Credentials the issuer already minted stay valid until they expire; short SVID lifetimes remain the issuer's job.
  • There is no trust score. Each check is recorded and shown separately. DV, OV and EV describe evidence, not legitimacy or agent safety.

Preview status

Agentic Root Trust is a preview. Every page carries the "Preview — not for production reliance" banner, and data and behaviour may change without notice.

Production reliance is blocked on two launch gates: a human security review of the assertion semantics, signing controls and representative verification, and a managed KMS or HSM signer. Today assertions are signed by a prototype signer whose key lives in a Worker secret, which is not an HSM. See Security and trust model for the controls in place and the open items.

The public API is described in OpenAPI 3.1 at /v1/openapi.yaml and rendered in the API reference.