// GLOSSARY -- SECURITY & COMPLIANCE
What is Agent Attestation?
Cryptographic proof of an agent's identity, capabilities, and authorization — issued by a trusted party and verifiable by counterparties for establishing trust in transactions.
WHY IT MATTERS
Anyone can deploy an agent. How do you know it's legitimate? Attestation provides cryptographic proof — a signed statement confirming identity and authorization.
Can include: operator identity, spending authorization, capability declarations, audit status, compliance certifications.
Foundational trust infrastructure. Without attestation, agent commerce relies on reputation or blind trust — neither scales.
HOW POLICYLAYER USES THIS
PolicyLayer uses attestation to verify identity before granting spending authority — the trust anchor linking policies to verified agents.
FREQUENTLY ASKED QUESTIONS
Who issues attestations?
The operator, a trusted platform, or a decentralized identity system. PolicyLayer can verify attestations from multiple issuers.
How long do attestations last?
Configurable — from hours to months. Short-lived attestations are more secure; long-lived ones are more convenient.
Can attestations be revoked?
Yes. Issuer can revoke at any time, and PolicyLayer checks revocation status before accepting.