{
  "schema": "ecz.website_family_site.v2",
  "site": {
    "name": "ECZ-ID Agent",
    "url": "https://agents.ecocitizenz.com",
    "brand_contract": "ecz.website_brand_contract.v1",
    "operator": {
      "legal_name": "EcoCitizenz Ltd",
      "ecz_id": "ECZ-GB-RBS1NW",
      "resolver": "https://resolver.ecocitizenz.org/p/ECZ-GB-RBS1NW",
      "resolver_machine": "https://api.ecocitizenz.com/api/p/ECZ-GB-RBS1NW.json",
      "statement": "The operator's own record is proof about the company that runs this site, not about any visitor or any Passport they hold."
    }
  },
  "family": {
    "slug": "agent",
    "type_code": "AGENT_PASSPORT",
    "family_code": "AGENT",
    "product_name": "ECZ-ID Agent Passport™",
    "subject": "AI agent",
    "identifier_pattern": "ECZ-XX-XXXXXX::AGENT_PASSPORT-XXXXXX",
    "subject_law": "One Agent Passport is one logical AI agent operated by your organisation.",
    "not_separate_passports": "Versions, deployments, replicas, regions and platforms of that agent are not separate Passports."
  },
  "free_passport": {
    "price_gbp": 0,
    "price_label": "FREE",
    "includes": [
      "A persistent ECZ-ID for the AI agent.",
      "Your organisation on the record as its operator — a free DECLARED Parent is created if you do not already have one.",
      "A public Resolver record anyone can open, and the same record as machine-readable JSON.",
      "A badge, a QR code and a share link.",
      "Basic bindings to the public places your AI agent already appears.",
      "Lifecycle and current public state, evaluated on demand.",
      "Claim and recovery.",
      "Basic participation in the Digital Entity Graph.",
      "Essential lifecycle evidence, kept in LedgerCore."
    ],
    "distinctions": [
      {
        "title": "DECLARED ≠ VERIFIED",
        "body": "A DECLARED record states what your organisation says about itself, with the date it said it. It is not the outcome of an independent check."
      },
      {
        "title": "Identity ≠ Binding",
        "body": "The Passport identifies the AI agent. A binding records a public place it already appears. Adding a binding never creates a second identity."
      },
      {
        "title": "Binding ≠ Authority",
        "body": "A binding shows that a relationship has been declared. It does not grant, prove or imply authority to act."
      },
      {
        "title": "Parent verification ≠ Agent verification",
        "body": "A VERIFIED or ASSURED Parent verifies your organisation. It does not verify the AI agent."
      }
    ],
    "publication_consent_required": true
  },
  "acquisition": {
    "state": "AVAILABLE",
    "states": [
      "AVAILABLE",
      "TEMPORARILY_PAUSED",
      "NOT_YET_LIVE"
    ],
    "start_url": "https://trustops.ecocitizenz.com/start/agent?source_surface=agents-machine-descriptor",
    "authority": "https://trustops.ecocitizenz.com",
    "configuration": "Set by Operating Command through ECZ_FAMILY_ACQUISITION_STATE. FREE is the price; the state is whether new activations are open."
  },
  "aec": {
    "name": "AEC — Active Entity Capacity",
    "definition": "One AEC is one actively managed production entity with live bindings and current state.",
    "exists_without_aec": "A free Passport exists and resolves whether or not you use any AEC.",
    "counts_for_this_family": "An agent you actively manage in production, with live bindings and current state.",
    "pooled_across": "AEC is one pool shared across your Agent, MCP, Plugin, API, SDK and logical Service & Workload identities, and your IoT product, model and fleet identities.",
    "device_instances": "Individual IoT device instances are counted separately, in IoT Fleet Capacity, and never consume AEC.",
    "never": [
      "AEC never makes an identity more verified.",
      "AEC never replaces a Passport.",
      "AEC never changes an ECZ-ID. Your ECZ-ID does not change.",
      "Running out of AEC never deletes, revokes or unpublishes an identity."
    ]
  },
  "commercial": {
    "authority": "TrustOps",
    "trustops_origin": "https://trustops.ecocitizenz.com",
    "configure_url": "https://trustops.ecocitizenz.com/start",
    "prices_published_here": false,
    "statement": "Prices and what can be bought today come from TrustOps, which owns every purchase, entitlement and renewal."
  },
  "interoperability": {
    "families": [
      "MCP_PASSPORT",
      "API_PASSPORT",
      "PLUGIN_PASSPORT",
      "SERVICE_WORKLOAD_PASSPORT"
    ],
    "systems": [
      {
        "name": "Model Context Protocol (MCP)",
        "what_it_does": "Connects AI applications to tools and data through a defined client–server protocol.",
        "what_ecz_id_adds": "A resolvable identity for the agent and, separately, for each MCP server it uses — each with a named operator.",
        "replaces": false
      },
      {
        "name": "Agent2Agent (A2A)",
        "what_it_does": "Lets agents discover one another and exchange tasks.",
        "what_ecz_id_adds": "A persistent public identity a counterparty agent can resolve and re-check outside the conversation itself.",
        "replaces": false
      },
      {
        "name": "OAuth 2.x and OpenID Connect",
        "what_it_does": "Delegate authorisation and authenticate a principal for a session.",
        "what_ecz_id_adds": "A durable public record of the subject and its operator that outlives any token and needs none to read.",
        "replaces": false
      },
      {
        "name": "Microsoft Entra Agent ID and workload identities",
        "what_it_does": "Govern what an agent or workload may do inside your Microsoft tenant.",
        "what_ecz_id_adds": "An identity that resolves outside the tenant, for parties with no access to it.",
        "replaces": false
      },
      {
        "name": "AWS IAM",
        "what_it_does": "Governs what a role or workload may call inside your AWS accounts.",
        "what_ecz_id_adds": "A public identity a counterparty can read without any access to your accounts.",
        "replaces": false
      },
      {
        "name": "Google Cloud IAM and workload identity federation",
        "what_it_does": "Govern access to your Google Cloud projects.",
        "what_ecz_id_adds": "A public identity readable outside your projects, naming the organisation that operates the subject.",
        "replaces": false
      },
      {
        "name": "SPIFFE and SPIRE",
        "what_it_does": "Issue short-lived workload identities inside your infrastructure.",
        "what_ecz_id_adds": "A stable public identifier for the enduring service, rather than a rotating internal one for a running process.",
        "replaces": false
      }
    ],
    "boundary": "ECZ-ID complements your frameworks, protocols, OAuth, cloud IAM and workload identity. It replaces none of them and stays outside the execution path."
  },
  "strengthen": [
    {
      "key": "parent-assurance",
      "name": "Parent VERIFIED and ASSURED",
      "prominence": "PRIMARY",
      "phase": "CATALOGUE",
      "adds": "Independent verification of the organisation behind your Passports. VERIFIED suits production use; ASSURED is the higher-assurance posture for larger or more sensitive estates.",
      "boundary": "It verifies your organisation. It never verifies an agent, a server or any other child identity, and it never changes an ECZ-ID.",
      "included_free": "Every Passport starts with a free DECLARED Parent — created for you if your organisation has none.",
      "next_steps": [
        {
          "kind": "EXPLORE",
          "label": "Explore Parent VERIFIED and ASSURED",
          "url": "https://agents.ecocitizenz.com/parent"
        },
        {
          "kind": "TRUSTOPS",
          "label": "Configure in TrustOps",
          "url": "https://trustops.ecocitizenz.com/start#parent-passports"
        }
      ]
    },
    {
      "key": "kya-authority",
      "name": "KYA Authority",
      "prominence": "PRIMARY",
      "phase": "CATALOGUE",
      "adds": "Know-Your-Agent authority for the agents you govern — the authority and delegation layer that sits above an agent's identity, kept separate from it.",
      "boundary": "Authority is not approval. It never makes an agent verified, and a Passport or a binding never carries authority on its own.",
      "included_free": null,
      "next_steps": [
        {
          "kind": "EXPLORE",
          "label": "Explore KYA Authority",
          "url": "https://agents.ecocitizenz.com/kya"
        },
        {
          "kind": "CONTACT",
          "label": "Talk to us",
          "url": "mailto:hello@ecocitizenz.com?subject=KYA%20Authority%20%E2%80%94%20ECZ-ID%20Agent%20Passport%E2%84%A2"
        }
      ]
    },
    {
      "key": "pulseguard",
      "name": "PulseGuard",
      "prominence": "PRIMARY",
      "phase": "CATALOGUE",
      "adds": "Current-state evaluation for the entities you operate. Paid tiers extend evaluation across more entities and more evaluations each month.",
      "boundary": "It reports state. It is not a safety verdict, and it never changes an identity or its tier.",
      "included_free": "On-demand and event-driven evaluation of your own entities.",
      "next_steps": [
        {
          "kind": "EXPLORE",
          "label": "Explore PulseGuard",
          "url": "https://agents.ecocitizenz.com/pulseguard"
        },
        {
          "kind": "CONTACT",
          "label": "Talk to us",
          "url": "mailto:hello@ecocitizenz.com?subject=PulseGuard%20%E2%80%94%20ECZ-ID%20Agent%20Passport%E2%84%A2"
        }
      ]
    },
    {
      "key": "evidencecore",
      "name": "EvidenceCore",
      "prominence": "SECONDARY",
      "phase": "IN_V2_BUILD",
      "adds": "The evidence behind each claim on a record: what supports it, where it came from, when it was checked and who may see it.",
      "boundary": "Evidence supports a claim. It does not make the claim true, and it never turns a declaration into a verification.",
      "included_free": "Essential evidence references are part of every free Passport.",
      "next_steps": []
    },
    {
      "key": "ledgercore",
      "name": "LedgerCore",
      "prominence": "SECONDARY",
      "phase": "CATALOGUE",
      "adds": "Tamper-evident retention of decisive lifecycle evidence — issuance, activation, material bindings, authority changes, suspension and revocation — with eligible evidence anchored to a permissioned, append-only ledger.",
      "boundary": "An anchor shows an entry has not been altered since it was written. It does not make the statement inside it true.",
      "included_free": "Essential LedgerCore evidence is kept for every identity, free ones included.",
      "next_steps": [
        {
          "kind": "EXPLORE",
          "label": "Explore LedgerCore",
          "url": "https://agents.ecocitizenz.com/ledgercore"
        },
        {
          "kind": "CONTACT",
          "label": "Talk to us",
          "url": "mailto:hello@ecocitizenz.com?subject=LedgerCore%20%E2%80%94%20ECZ-ID%20Agent%20Passport%E2%84%A2"
        }
      ]
    },
    {
      "key": "graph",
      "name": "Digital Entity Graph and Graph Intelligence",
      "prominence": "SECONDARY",
      "phase": "CATALOGUE",
      "adds": "The public-safe relationships between your organisation, its Passports and their bindings. Graph Pro, Graph Business and Enterprise Graph Intelligence add scale, history and custom analysis above the free view.",
      "boundary": "A relationship in the graph is a published link, not an endorsement of either end.",
      "included_free": "Basic Graph participation and a current one-hop view.",
      "next_steps": [
        {
          "kind": "PRIVATE_OFFER",
          "label": "Discuss a private offer",
          "url": "mailto:hello@ecocitizenz.com?subject=Digital%20Entity%20Graph%20and%20Graph%20Intelligence%20%E2%80%94%20ECZ-ID%20Agent%20Passport%E2%84%A2"
        }
      ]
    },
    {
      "key": "agent-trust",
      "name": "Agent Trust",
      "prominence": "SECONDARY",
      "phase": "CATALOGUE",
      "adds": "A local-first editor extension that inventories the agents in your workspace and what they can reach. Pro adds the authority graph, action chains and remediation.",
      "boundary": "It inspects your workspace on your machine and publishes nothing about your agents.",
      "included_free": "Agent Trust Community is free to install.",
      "next_steps": [
        {
          "kind": "EXPLORE",
          "label": "Explore Agent Trust",
          "url": "https://agents.ecocitizenz.com/agent-trust"
        },
        {
          "kind": "TRUSTOPS",
          "label": "Configure in TrustOps",
          "url": "https://trustops.ecocitizenz.com/start#mcp-kya-agent-trust"
        }
      ]
    }
  ],
  "operate": [
    {
      "key": "developer-gateway",
      "name": "Developer Gateway",
      "summary": "Integration reference, schemas and machine-readable documentation for ECZ-ID.",
      "url": "https://developers.ecocitizenz.com"
    },
    {
      "key": "frameworks",
      "name": "Framework integration",
      "summary": "Publish an agent's ECZ-ID from the framework it already runs on. No library, and nothing new in the execution path.",
      "url": "https://agents.ecocitizenz.com/frameworks"
    },
    {
      "key": "ci-cd",
      "name": "GitHub and CI",
      "summary": "Carry the identity through your repository and pipeline, and understand why a badge is a pointer rather than proof.",
      "url": "https://agents.ecocitizenz.com/github"
    },
    {
      "key": "resolver",
      "name": "Resolver",
      "summary": "Resolve any ECZ-ID to its public record — free, with no account and no API key.",
      "url": "https://agents.ecocitizenz.com/verify"
    },
    {
      "key": "machine-json",
      "name": "Machine-readable record",
      "summary": "Every record as JSON at /api/p/{ecz_id}.json, for policy engines, gateways and agents. Shown here on EcoCitizenz's own record.",
      "url": "https://api.ecocitizenz.com/api/p/ECZ-GB-RBS1NW.json"
    },
    {
      "key": "trust-mcp",
      "name": "ECZ-ID Trust MCP",
      "summary": "A read-only remote MCP server (com.ecocitizenz/trust-mcp) that looks up public ECZ-ID Business Passport state for MCP clients. It reports state only.",
      "url": "https://developers.ecocitizenz.com/install"
    },
    {
      "key": "console",
      "name": "ECZ-ID console",
      "summary": "Sign in to TrustOps to reach the Passports your organisation holds. It is where current commercial configuration lives, too.",
      "url": "https://trustops.ecocitizenz.com/console"
    },
    {
      "key": "sdks",
      "name": "SDKs and libraries",
      "summary": "What exists today, stated plainly — including that no ECZ-ID client SDK is published yet.",
      "url": "https://agents.ecocitizenz.com/sdk"
    }
  ],
  "related": [
    {
      "type_code": "MCP_PASSPORT",
      "product_name": "ECZ-ID MCP Passport™",
      "relationship": "Agents call MCP servers for tools and data. The server is its own subject, with its own operator and its own Passport.",
      "acquisition_state": "AVAILABLE",
      "start_url": "https://trustops.ecocitizenz.com/start/mcp?source_surface=agents-machine-related-mcp",
      "site": "https://mcp.ecocitizenz.com"
    },
    {
      "type_code": "API_PASSPORT",
      "product_name": "ECZ-ID API Passport™",
      "relationship": "Agents act through APIs. An API Passport identifies the surface an agent calls, separately from the agent calling it.",
      "acquisition_state": "NOT_YET_LIVE",
      "start_url": null,
      "site": null
    },
    {
      "type_code": "PLUGIN_PASSPORT",
      "product_name": "ECZ-ID Plugin Passport™",
      "relationship": "Agents ship as, or inside, plugins and extensions. The plugin is identified once, across every store it is listed in.",
      "acquisition_state": "NOT_YET_LIVE",
      "start_url": null,
      "site": null
    },
    {
      "type_code": "SERVICE_WORKLOAD_PASSPORT",
      "product_name": "ECZ-ID Service & Workload Passport™",
      "relationship": "Agents run as services and workloads. The workload that hosts an agent is a different enduring subject from the agent.",
      "acquisition_state": "NOT_YET_LIVE",
      "start_url": null,
      "site": null
    }
  ],
  "resolver": {
    "human": "https://resolver.ecocitizenz.org/p/{ecz_id}",
    "machine": "https://api.ecocitizenz.com/api/p/{ecz_id}.json",
    "is_proof": false,
    "recheck_before_reliance": true,
    "statement": "A Resolver record is not proof. It publishes what is currently declared and what evidence exists, with the time it was read — is_proof is false and recheck_before_reliance is true. Re-check before you rely on it.",
    "absence": "No public ECZ-ID found is not a finding. It means the identifier resolves to no published record — nothing more."
  },
  "boundaries": [
    "An ECZ-ID does not make anything safe, certified, approved or compliant, and holding one does not make you compliant with anything.",
    "ECZ-ID complements your frameworks, protocols, OAuth, cloud IAM and workload identity. It replaces none of them and stays outside the execution path."
  ],
  "not_published_here": [
    "No A2A Agent Card and no agent manifest: this host is a website, not an agent endpoint.",
    "No prices, allowances, SKUs or purchase states: TrustOps is the commercial authority."
  ]
}