Enroll Agents with Services
Overview
The Agent Enrollment Protocol (AEP) gives an Agent a way to introduce an identity it controls to a Service. The Service decides whether to recognize that Agent and what it must provide before enrollment can become active.
The Agent starts with the Service's Inspect document. It advertises supported identity methods, required claims, available enrollment commands, and authentication methods for protected resources. An Agent's Owner may need to approve enrollment or supply information the Service requires. A Platform can host identity and signing for the Agent, but it is not required.
For the roles and terms used throughout these guides, read Core concepts.
How enrollment works
The Service advertises its requirements; the Agent follows the commands the Service supports.
Inspect the Service
Fetch the Inspect document and read its identity methods, claims, and endpoints. Start with Inspect a Service.
Prepare identity and claims
Use an identity method the Service accepts and gather any claims it requires for enrollment.
Enroll the Agent
Sign a client assertion and send the Enroll request to the advertised endpoint. Follow Enroll an Agent.
Check status when pending
Claim verification or Owner action may leave enrollment pending. Use Status to learn whether the Agent can proceed. See Check status.
Authenticate later requests
Use a method the Service advertises for its protected resources. Start with Access a protected resource.
If the Service supports Grant, the Agent can also request a session credential after enrollment. That is optional; it is not part of every enrollment flow.
Authentication after enrollment
AEP command endpoints accept a signed client assertion from the Agent. Protected application resources use the authentication methods listed in the Service's Inspect document. Those methods may include client assertions or an optional session credential.
Authentication establishes which Agent is making the request. The application still decides whether that Agent may perform the requested action. Read Protected-resource access and Session credentials when you need those flows.
Roadmap
The AEP roadmap explores proposed work on ecosystem integrations, blockchain-native Agents, identity, privacy, and more. Read about the ideas and share which capabilities would help your application.
Choose your path
Enroll with a Service
Inspect a Service, prepare an Agent identity, and follow its enrollment requirements.
Inspect a ServiceAccept Agent enrollment
Publish enrollment requirements and implement the commands your Service advertises.
Publish an Inspect documentNew to the terminology? Start with Core concepts.
