AgentTrust

AI Agent Identity, Verification, Authorization, and Trust Platform

AgentTrust is a full-stack security platform that explores how autonomous AI agents can establish identity, trust, and accountability when collaborating on tasks.

The platform assigns every agent a cryptographic identity, enables secure message signing and verification, enforces role-based authorization, maintains immutable audit logs, and constructs verifiable trust chains that provide end-to-end provenance for AI-driven workflows.

---

Features

🔐 Agent Identity

• Register AI agents with unique UUID identities
• Generate RSA public/private key pairs
• Persistent identity storage using SQLite

✍️ Cryptographic Verification

• RSA message signing
• Signature verification
• Tamper detection
• End-to-end authenticity validation

🛡️ Authorization

• Role-Based Access Control (RBAC)
• Allow/Deny policy enforcement
• Authorization decision engine

📜 Audit Logging

• Record every authorization decision
• Persistent audit history
• Action tracking with timestamps

🔗 Trust Chains

• Multi-agent workflow validation
• Cryptographic provenance
• Chain-of-custody verification
• Persistent trust chain storage

📊 Dashboard

• Live platform metrics
• Agent registry visualization
• Trust chain history
• Audit log monitoring

---

Architecture

                 ┌─────────────┐
                 │ AI Agent    │
                 └──────┬──────┘
                        │
                        ▼
                Agent Identity
                        │
                        ▼
          Cryptographic Verification
                        │
                        ▼
                 Authorization
                        │
                        ▼
                  Audit Logging
                        │
                        ▼
                  Trust Chains
                        │
                        ▼
             Persistent Provenance

---

Technology Stack

Backend

• Python
• FastAPI
• SQLAlchemy
• SQLite
• RSA Cryptography

Frontend

• React
• TypeScript
• Vite
• Tailwind CSS
• Axios

---

Example Workflow

ResearchAgent discovers a vulnerability.

Finding:
Found SQL Injection

ResearchAgent signs the finding using its private key.

↓

CodeReviewAgent verifies the previous signature and signs the reviewed finding.

↓

SecurityAgent verifies both signatures and signs the final approval.

↓

A Trust Chain is created.

The resulting trust chain provides cryptographic proof of:

• Who created the finding
• Who reviewed it
• Who approved it
• Whether the chain remains valid

---

API Endpoints

Agents

GET    /agents
POST   /agents

Messages

POST   /messages/sign
POST   /messages/verify

Authorization

POST   /policies/check

Audit Logs

GET    /audit/logs

Trust Chains

GET    /trust-chain
POST   /trust-chain

---

Running Locally

Clone Repository

git clone https://github.com/samartha-2601/AgentTrust.git

cd AgentTrust

---

Backend Setup

python3 -m venv venv

source venv/bin/activate

pip install -r requirements.txt

uvicorn backend.main:app --reload

Backend:

http://localhost:8000

Swagger API Documentation:

http://localhost:8000/docs

---

Frontend Setup

cd frontend

npm install

npm run dev

Frontend:

http://localhost:5173

---

Current Capabilities

• ✅ Persistent Agent Registry
• ✅ RSA Key Generation
• ✅ Cryptographic Signing
• ✅ Signature Verification
• ✅ Role-Based Authorization
• ✅ Audit Logging
• ✅ Persistent Trust Chains
• ✅ Multi-page React Dashboard
• ✅ Live Metrics
• ✅ Agents Page
• ✅ Trust Chains Page
• ✅ Audit Logs Page
• ✅ Authorization Filtering

---

Roadmap

• Agent revocation
• Trust chain detail view
• Advanced search & filtering
• Export audit reports
• Trust scoring engine
• Hawcx SDK integration
• Multi-tenant organizations
• PostgreSQL support
• Docker deployment
• Kubernetes deployment

---

Motivation

As AI systems become increasingly autonomous, establishing trust, identity, and accountability between collaborating agents becomes critical.

AgentTrust explores how cryptographic identity, authorization, auditability, and provenance can be combined into a practical platform that enables secure and verifiable AI workflows.

The project is inspired by emerging challenges in AI identity, agent verification, and trust infrastructure.

---

License

This project is intended for educational and portfolio purposes.