ECZ-ID for Agents
For organisations that build, deploy or operate AI agents. Which agent this is, what authority its operator says it has been given, and which organisation is accountable for it — in one public record anyone can re-check.
£0 · No card required · Permanent, not a trial.
Everything included with one FREE Agent Passport
Versions, deployments, replicas, regions and platforms of that agent are not separate Passports. The identifier above is an illustrative shape, not a live record.
FREE Agent Passport
Free · Permanent · No card
Nothing is published until you confirm it.
One subject
For example, your customer-support agent keeps one Passport whichever version, deployment or platform it runs on.
A new version, deployment, replica, region or platform is not a new Passport.
Publishing the record is your decision. Nothing about your agent becomes public until you consent to it, and what you publish stays under your control afterwards.
Every free Agent Passport also carries an accountable operator, basic bindings, Digital Entity Graph participation and essential lifecycle evidence: 13 inclusions in all — the full list.
Start here
Give it a permanent identity and put your organisation on the record as its accountable operator.
Resolve an ECZ-ID and read what is actually published — operator, current state, and what the record does not establish.
Verify an ECZ-ID
Publish identity from the surface your agent already serves. A static file, no library, nothing new in the execution path.
See the frameworks
Ask for the operator, the delegated authority and the evidence in one record — the Agent Authority & Enterprise Assurance Kit.
See the Authority Kit
Identity + authority graph
An agent matters because of who stands behind it and what it reaches. Each step below is published separately, with its own owner, so a reviewer can follow the path instead of taking the agent's word for it.
Starts with
The Parent: the accountable operator. A DECLARED Parent is created free if you need one. VERIFIED and ASSURED check the organisation, never the agent.
DECLARED free · VERIFIED and ASSURED optional
The Parent tiersoperates
One persistent ECZ-ID for one logical AI agent. Versions, replicas, regions and deployments are bindings, never new Passports.
FREE · permanent
What the free Passport includesacts with
What the operator has granted the agent — which tools, servers and APIs it may reach, and under which identity. Granted in your own OAuth, IAM, MCP and API configuration; ECZ-ID documents the declaration and never grants it.
Evidenced by the Agent Authority & Enterprise Assurance Kit
The Authority Kitreaches through
The assets and endpoints the agent runs on, proved and verified with a Last verified time and a Re-check due; the MCP servers and APIs it calls are separate subjects, related to it, each with a FREE Passport family of its own.
Basic bindings included
Bindings and freshnessis published on
The public record — a human page and machine JSON — that anyone can open with no account and no key. It publishes what is declared and the time it was read.
FREE · never metered
Verify an ECZ-IDis connected in
The published relationships between the organisation, the agent and what it is bound to. A current one-hop view is free; Graph Intelligence adds estate-level views.
One-hop view free · Graph Intelligence optional
Graph Intelligenceis watched and evidenced by
With free Watch, the parties relying on the agent follow up to three ECZ-IDs on their device and see what changed, with no account and no email; with Watch Pro, important public changes reach them by email. LedgerCore keeps lifecycle evidence of what changed and when, as local records; ledger anchoring is not live yet.
Free Watch and essential evidence free · paid Watch and more optional
ECZ-ID WatchEvery link is a published relationship, not a permission. Authority to act is granted inside your own systems, and no edge on a public record grants, infers or enforces it.
ECZ-ID stays outside the execution path. It does not broker your agent's calls, hold its credentials, or sit between it and the systems it uses.
Your agent already turns up in other organisations' logs under a name only you can explain. One FREE Passport gives it one anyone can check.
Get a FREE Agent PassportHow it works
Start from the FREE Agent Passport: one persistent ECZ-ID for the agent, with your organisation on the record as its operator.
In your ECZ-ID console, add an asset the agent really uses or appears on — the host that serves its manifest, a repository, a registry listing, an API or MCP endpoint you operate. It starts as a declared binding: your statement, labelled as one.
Show control of the asset. For an agent host, publish the agent manifest at /.well-known/ecz-agent.json declaring the agent's ECZ-ID; other asset types use the proof your console issues for them.
The proof is checked against the asset. A failed or incomplete proof leaves the binding declared — it is never silently upgraded.
A passing check marks the binding verified, with the moment it was verified. It establishes control of that asset at that time — not the agent's behaviour, not its authority, and not forever.
The binding, how it was established, when it was last verified and when its freshness window ends appear on the public Resolver record and in its machine JSON.
Keep the proof in place. Verification ages: ECZ-ID does not renew a bound binding, and once its freshness window ends a new binding is the fresh proof. Nothing is verified permanently.
A verified binding proves control of one asset at the moment it was last verified. It is never permanent, it never verifies the agent itself, and it gives ECZ-ID no control over what the agent does.
Bindings, the manifest and freshnessUse cases
Operate
Manage from your ECZ-ID account. Signing in takes you to TrustOps, which holds your organisation and the Passports it holds.
Sign in(opens in a new tab — trustops.ecocitizenz.com)The public record for any ECZ-ID — the only place current state is read from.
Open the Resolver(opens in a new tab — resolver.ecocitizenz.org)Publishing identity from the surface your agent already serves, the Publish Kit and the machine schemas.
Open the Gateway(opens in a new tab — developers.ecocitizenz.com)OpenAI Agents, Microsoft Agent Framework, Google ADK, AWS Strands and LangGraph — a static file, no library, nothing in the execution path.
See the frameworksA free local editor extension that shows what the agents in your workspace declare they can reach. It reports to you and publishes nothing.
See Agent TrustParent + seven FREE Passport families
An agent rarely works alone. The MCP servers it calls, the APIs it acts through and the workloads that host it are separate subjects — each with its own FREE Passport family, under the same organisation. Each card shows the state of that family's free door.
Every Passport is linked to one organisation, its Parent. A DECLARED Parent is free and created for you if you do not have one. VERIFIED and ASSURED independently check the organisation — never the agent.
Parent DECLARED, VERIFIED and ASSUREDAgentFREE
ECZ-ID Agent Passport™
Free door open
One Passport is one logical AI agent operated by your organisation.
The agent itself. Versions, deployments, replicas, regions and platforms are bindings, never separate Passports.
MCPFREE
ECZ-ID MCP Passport™
Free door open
One Passport is one logical MCP server operated by your organisation.
Agents call MCP servers for tools and data. The server is its own subject, with its own operator and its own Passport.
APIFREE
ECZ-ID API Passport™
Free door open
One Passport is one logical API operated by your organisation.
Agents act through APIs. An API Passport identifies the surface an agent calls, separately from the agent calling it.
PluginFREE
ECZ-ID Plugin Passport™
Free door open
One Passport is one logical plugin, extension, action or store app your organisation publishes.
Agents ship as, or inside, plugins and extensions. The plugin is identified once, across every store it is listed in.
Service & WorkloadFREE
ECZ-ID Service & Workload Passport™
Free door open
One Passport is one logical service or workload your organisation operates.
Agents run as services and workloads. The workload that hosts an agent is a different enduring subject from the agent.
SDKFREE
ECZ-ID SDK Passport™
Free door open
One Passport is one logical SDK, library or package your organisation publishes.
Agents are built with SDKs. The library is its own subject, published by its own maintainer, across every registry it ships to.
IoTFREE
ECZ-ID IoT Device Passport™
Free door open
One Passport is one physical device, or one device identity module, operated by your organisation.
Agents increasingly act on connected devices. The device is identified in its own right; a fleet is many Passports, never one.
Start with the agent.
Adjacent Passports are suggested, never issued for you. If your agent also exposes an MCP server or an API, you choose whether to give those an identity too.
All seven Passport families are FREE. FREE is the price of every one of them.
Also free — follow the agents you rely on
Free WatchFree · Open
Follow up to three ECZ-IDs on this device and see what changed, with no account and no email.
Agents and MCP
An agent and the MCP server it calls are two different things, run by two parties who may not be the same. Each can hold its own identity, with its own operator on the record.
Look it up before you wire it in. If it publishes an ECZ-ID you can see who operates it and what state the record is in; what you do with that is your policy. If it does not, that is not a finding against it — most servers have no ECZ-ID yet.
Give it its own FREE MCP Passport. Same organisation, same Parent, a separate identity for a separate thing, with its own operator on the record.
Adjacent Passports are suggested, never issued for you. If your agent also exposes an MCP server or an API, you choose whether to give those an identity too.
Products
Universal platform
Scale
AEC is the operating-capacity layer for ECZ-ID. Passports stay free; AEC is what expands the number of entities you can actively manage with live bindings, state and operational services.
Boundary: AEC is capacity, not verification, certification or trust status.
Monitor state
PulseGuard evaluates current observable state and helps an operator see which ECZ-ID entities need attention, without turning an observation into a safety or certification claim.
Boundary: PulseGuard reports observed state; it is not a safety verdict or certification.
Evidence/history
LedgerCore is the evidence layer for ECZ-ID: lifecycle events and eligible receipts, kept as local records that help a reviewer understand what was recorded and when. Ledger anchoring is not live yet.
Boundary: A record shows what was recorded and when; it does not make the statement true.
Relationships
Graph Intelligence helps an organisation understand how ECZ-ID entities, operators, bindings and dependencies connect, while keeping public-safe graph facts separate from private operating context.
Boundary: A Graph relationship is a published relationship, not an endorsement and not a permission.
Changes
Watch turns a one-time Resolver check into something you can come back to. Free Watch: follow up to three ECZ-IDs on this device and see what changed, with no account and no email. With Watch Pro, important public changes reach you by email; Watch Team adds a shared portfolio, routing and digests; Watch Operations is portfolio triage at scale.
Boundary: What Watch shows is a change signal, not certification, approval or a safety assessment.
Prices and what can be bought today come from TrustOps, which owns every purchase, entitlement and renewal.
Flagship digital product
Flagship · Agent specialist kit
Turn agent authority, operator and delegation evidence into a buyer-ready assurance record.
Boundary: Authority is delegated by the operator inside its own systems. The Kit documents that delegation; ECZ-ID never grants, enforces or revokes it.
Company
£349 one-off
Pro
£649 one-off
Agency Annual
£1,795 · one payment for a 12-month licence
Workflow bundles for agent stacks
Assure the connected agent stack rather than one component in isolation.
From £549 one-off
Give buyers one coherent assurance view across an AI platform.
From £749 one-off
Bring the specialist assurance products into one portfolio-level programme.
From £1,699 one-off
Also relevant: ECZ-ID Machine Identity Assurance Bundle.
Prices and what can be bought today come from TrustOps, which owns every purchase, entitlement and renewal. This site explains the product; TrustOps owns purchase state, payment, fulfilment and entitlement.
Business solutions
Most relevant for Agent
An agent is increasingly the digital surface a counterparty meets first: it calls their API, talks to their agent, files into their workflow or turns up in their logs. DCI gives that counterparty one path from the agent in front of them to the organisation behind it, and to the evidence you publish — for people and for software, without a questionnaire and without asking you.
Boundary: DCI is identity and evidence infrastructure; it is not a counterparty risk score or approval.
Regulated finance
The DORA solution helps an ICT provider organise identity, service, resilience and supporting evidence into a reusable review pack for financial-sector customers and their procurement or risk workflows.
Boundary: ECZ-ID supports evidence preparation and review; it does not certify DORA compliance.
Software supply chain
The SBOM solution organises software-component, dependency and provenance evidence around the digital product being supplied, so reviewers can understand what is in scope and what changed.
Boundary: An SBOM describes composition and evidence; it is not a declaration that software is secure.
Prices and what can be bought today come from TrustOps, which owns every purchase, entitlement and renewal.
Services
Assess
A one-off engagement, delivered with you: an assessment of your agent estate — which agents exist and who is accountable for each — built on FREE Agent Passports and your organisation's ECZ-ID. Purchase starts your engagement and written intake.
Boundary: Payment starts intake; it proves, certifies and completes nothing.
Bind authority
A one-off sprint, delivered with you, that binds the authority your organisation delegates to its agents to their ECZ-IDs. Purchase starts your engagement and written intake. The authority stays yours: it is delegated inside your own systems, and ECZ-ID never grants or enforces it.
Boundary: Authority is delegated by your organisation inside its own systems. The sprint documents and binds it; ECZ-ID never grants, enforces or revokes it.
Integrate
A scoped one-off engagement that integrates one agent identity across the platforms an agent runs on. Scope and the total are agreed with you in writing before anything is charged. It is by arrangement: you start procurement in TrustOps.
Boundary: Commercial entitlement only: identity, the Resolver record and the free baseline are never changed by buying, cancelling, refunding or exhausting it.
Govern
A scoped pilot of agent governance for an enterprise estate, built on FREE Agent Passports and your organisation's ECZ-ID. It is by arrangement: you start procurement in TrustOps.
Boundary: Commercial entitlement only: identity, the Resolver record and the free baseline are never changed by buying, cancelling, refunding or exhausting it.
Every service, including the integration and Graph mapping sprints
Strengthen
Parent DECLARED
Free. The organisation's own truthful self-declaration, dated. Created for you if you need one.
Parent VERIFIED
£19.99/month. The organisation's identity is independently checked. Suits production use.
Annual prepaid: One payment of £199 for exactly 12 calendar months; it does not renew automatically.
Prices in GBP. VAT is not charged. Payment opens checks; the tier shows only after checks pass. It verifies your organisation — never an agent.
Parent ASSURED
£49.99/month. The higher-assurance posture for larger or more sensitive estates, including who may bind the organisation.
Annual prepaid: One payment of £499 for exactly 12 calendar months; it does not renew automatically.
Prices in GBP. VAT is not charged. Payment opens checks; the tier shows only after checks pass. It verifies your organisation — never an agent.
Developers
Machine presence
A name tells another system what your agent calls itself. An ECZ-ID gives it a persistent identity, an accountable operator relationship and a live public record that people and software can resolve and re-check.
Most agents in production present some combination of these. All of them are real, and none of them are wrong.
Questions the other side cannot look up
The same agent, with the same capabilities, carrying one stable reference that resolves to a published record.
Your agent already has capabilities. An ECZ-ID gives it a persistent identity others can resolve.
The logical agent gets the persistent Passport. Its native identity stays exactly where it is.
Your agent keeps authenticating exactly as it does now. Nothing here issues it a credential, holds one, or stands between it and the systems it calls.
A binding links the stable Agent ECZ-ID to something specific you choose to publish, according to canonical law:
A relationship is not ownership. An MCP server or an API surface your agent calls is its own subject, with its own operator and its own Passport — the binding records that they are connected, not that one covers the other.
A version, a replica, a region or a single run is a binding on the same agent, never a new Agent Passport.
This is the whole mechanism. It is a lookup, not an integration, and the last step is the one that matters most.
Another agent, MCP server or platform
Something on the other side of an interaction needs to decide.
Discovers an ECZ-ID
From declared metadata, a well-known path, or a reference your agent presents.
Resolves it
A public lookup. No account, no key, no permission from you.
Reads the persistent identity
The same identifier it saw last time, if it saw one.
Reads the operator relationship
The Parent organisation on the record, and its tier.
Reads current public state
Lifecycle state as at the moment of the read.
Reads available public evidence
What is published, and what it does and does not cover.
Re-checks
Re-check before reliance. State can change between the moment a badge is drawn and the moment an agent acts.
Applies its own policy
ECZ-ID tells you what is published and by whom. What that is worth in your context is your policy's decision, not ours.
A2A lets two agents discover and talk to one another. It does not tell either one who is behind the other. That is the gap an ECZ-ID fills — outside the conversation, where it can be checked independently.
Agent A
Opens an A2A interaction with Agent B.
Agent B
Presents its metadata, including an ECZ-ID.
Agent A
Resolves that ECZ-ID against the public record.
The record
Returns the operator relationship and current public state.
Agent A
Applies its own policy and decides what B may reach.
NO_PUBLIC_ECZ_ID_FOUND
If Agent B publishes no ECZ-ID, the lookup returns exactly that and nothing more. It is not a finding of any kind about Agent B.
No public ECZ-ID Passport found is not a safety finding. It means this identifier resolves to no published record — nothing more. Most software has no ECZ-ID yet.
An ECZ-ID is a public record whether or not anything is integrated with it. Compatible integrations make it easier to discover — they do not make it universal, and software that has no ECZ-ID integration will not go looking.
A short explainer covering the same ground as this section: what is bound, what another machine can see, and who decides what it is worth.
What changes when your agent gets an ECZ-ID?
55 seconds · in production
A short explainer covering the same ground as this section: what is bound, what another machine can see, and who decides what it is worth.
An agent goes to work. It calls an API, reaches an MCP server, and opens a conversation with another agent.
Each of them sees a name, an endpoint and whatever the agent says about itself.
None of that answers who operates it, or whether this is the same agent as last time.
An ECZ-ID is a persistent identity for the logical agent, linked to the organisation that operates it.
Bindings connect it to the deployments, services and relationships you choose to publish.
When another agent meets it, it resolves the identifier against a public record.
It reads the operator relationship, the current public state, and what evidence is published.
It re-checks at the moment it matters, rather than trusting a cached answer.
Then it applies its own policy. ECZ-ID publishes what is known. The decision stays with the relying party.
It is free, it is permanent, and it takes one form. You do not need a catalogue, a quote or a call to start.
What you get
Two addresses, both public, neither requiring an account or an API key. One for people, one for machines.
Resolve before reliance
For people
resolver.ecocitizenz.org/p/ECZ-GB-XXXXXX::AGENT_PASSPORT-YYYYYY
A readable page: the agent, its operator, current state, and what the record does not establish.
For machines
api.ecocitizenz.com/api/p/ECZ-GB-XXXXXX::AGENT_PASSPORT-YYYYYY.json
The same record as JSON; its fields are documented on the Developer Gateway. Readable by other agents, platforms and your own review tooling — whatever they decide is their policy; ECZ-ID takes no part in it.
What the record carries
In plain English
ECZ-GB-XXXXXX::AGENT_PASSPORT-YYYYYY
The agent's permanent ECZ-ID. The type is inside the identifier.
An Agent Passport
The record's type, derived from the identifier.
The organisation behind the agent
The operator, and whether the ORGANISATION has been independently verified. Never the agent.
For example, active — with the time of reading
The state published right now, with the time it was read alongside it.
Where the agent is declared to run
Where this agent is declared to run, and how that was established.
Listed on the record itself
The things this record explicitly does not establish. Read it.
A current reading, not proof
The Resolver says so itself. The record is evidence to weigh, not a verdict — and state can change after you read it, so re-check before relying on it.
Field reference on the Developer Gateway(opens in a new tab — developers.ecocitizenz.com)
The record is not proof. It publishes what is currently declared and what evidence exists, with the time it was read. Re-check the live record before you rely on it.
Re-check before reliance. State can change between the moment a badge is drawn and the moment an agent acts.
Example identifiers on this page use the placeholder form ECZ-GB-XXXXXX and are not real records.
Works with your agent stack
| Alongside | What it does | What ECZ-ID adds |
|---|---|---|
| MCP | Connects an agent to tools and data through a defined server protocol. | A resolvable identity for the agent and, separately, for the MCP server it uses — each with a named operator. |
| A2A | Lets agents discover and talk to one another. | A persistent public identity a counterparty agent can resolve and re-check outside the conversation itself. |
| OAuth and OIDC | Delegates authorisation and authenticates a principal for a session. | A durable public record of the agent and its operator that outlives any token and is readable by parties who hold none. |
| Native IAM and workload identity | Governs what a workload may do inside a cloud account, tenant or cluster. | An identity that is meaningful outside that boundary, to someone with no access to it. |
| SPIFFE and service accounts | Issues short-lived workload identity inside infrastructure. | A stable public identifier for the logical agent, rather than a rotating internal one for a running process. |
ECZ-ID stays outside the execution path. It does not broker your agent's calls, hold its credentials, or sit between it and the systems it uses. What it adds is the layer none of those provide: a persistent public identity for the agent itself, tied to a named operator, that someone outside your organisation can resolve and re-check.
What this is not
Identifying an agent is not controlling it. ECZ-ID does not authorise, restrict, supervise, pause or stop what an agent does — its operator and the party relying on it stay responsible for that.
DECLARED does not mean independently verified. It records what an organisation says about itself, with the date it said it — not the outcome of a check.
A VERIFIED or ASSURED Parent does not verify the agent. The parent organisation's identity is verified. The machine is not.
An Agent Passport is identity, not a credential. It holds no key, issues no token and grants no access: it publishes who the agent is, who operates it and what is declared about it. Evidence about the agent's authority is a separate, optional layer with its own scope.
No public ECZ-ID Passport found is not a safety finding. It means this identifier resolves to no published record — nothing more. Most software has no ECZ-ID yet.
ECZ-ID works alongside your agent framework, OAuth, native IAM and workload identity. It does not replace any of them. ECZ-ID stays outside the execution path. It does not broker your agent's calls, hold its credentials, or sit between it and the systems it uses.
FAQ
£0 · No card required · Permanent, not a trial.
Quick routes · ECZ-ID Agents
