Home/How it works
How it works

Proof of origin, and a record of everything since.

The pedigree is a sealed birth record plus a tamper-evident history chain. Birth alone would miss later tampering; history alone could be anchored to a forged origin. The point is the unbroken line from a verified origin through a verified history.

Two births

A build identity, and a deployment identity that can't exceed it.

Identity comes in two tiers, and the relationship between them is the enforcement. A Build AIN is issued once per software release and seals the capability envelope: everything that version of the agent is ever allowed to do. A Deployment AIN is issued per running instance and seals a manifest that must be a provable subset of that envelope, along with its own storage, salt, retention, and anchoring. An instance can be narrower than its build, never wider.

Build AIN
Issued per release under KMC.BLD, bound to a specific build artifact by hash and to the vendor's enrolled key. It sets the outer limit of what any deployment of that software may do.
Deployment AIN
Issued per running instance under KMC.DPL, deriving from a Build AIN. Its manifest is checked to be a provable subset of the build envelope at issuance, so an instance can never grant itself reach the build didn't already have.
Build-level recall
Because every deployment traces back to its build, revoking a Build AIN recalls every instance derived from it at once. One action retires a bad release everywhere it is running.
People aren't agents
A human principal is never minted as an AIN. Human authority is handled as a session-scoped delegation assertion, recorded as a salted hash, so a person can authorize an agent without becoming one.
The pedigree

One credential, verified cheaply, at scale.

Four interdependent mechanisms keep verification cheap no matter how much history an agent accumulates, and none of them stands without the others. Every birth and event is signed with post-quantum signatures, and the signing scheme is built to stay agile, so the primitive can be swapped as the standards evolve without reissuing what came before.

Sealed birth identity · manifest · sig event 1 prev ← hash event 2 prev ← hash event n prev ← hash Running head constant size FAST ✓ one pass verified origin ——— unbroken, tamper-evident history ——— authenticated summary

Constant-size head

A running summary keeps verification flat regardless of history length. Whether an agent has ten events or a hundred thousand, the fast check costs the same.

Tiered FAST / FULL

A cheap FAST check serves the routine many; a deep FULL walk of the whole history is there for the rare few who need it. Most checks never pay the full cost.

Cached, single-pass

Cached trust removes repeated cost within a window, and verification is single-pass and asynchronous, with no round trips, so it fits agents that spend most of their time asleep.

The safety layers

A genuine agent can still misbehave. These watch for that.

Authenticity and conduct are different questions, so they're handled separately. Protection scales with irreversibility: reversible actions are automatic and fast, and the irreversible ones require the keys.

Behavioral monitoring
Watches conduct separately from authenticity, because an agent that is genuinely who it claims to be can still drift or misbehave. This is the fuzzy, threshold-based signal.
Manifest drift
Any attempt outside the sealed manifest is a clean, binary divergence between what was permitted and what was tried, a far sharper halt signal than behavioral thresholds. Isolation is automatic and reversible.
The encrypted twin
A dormant, encrypted twin is the restoration source, hidden from the world but reachable by the hardware keys. It's what makes recovery from a bad state possible without trusting the live copy.
The key quorum
A threshold hardware-key quorum gates the three existential, irreversible actions, creating an agent, restoring from a twin, and destroying one, with the most catastrophic action requiring the largest quorum.
The bridge

From provenance to enforcement.

The birth record already carries the rules an agent was born with. The bridge activates that field so the rules do real work: a machine-readable manifest, a sandbox that enforces it, drift as a clean halt, and MeshKor as the credential root.

Capability manifest

Allowed tools, allowed endpoints, credential scopes, and a declared blast radius, sealed into the signed birth. An agent can't widen its own reach later without breaking its own pedigree.

Runtime sandbox

Verifies the agent, loads its sealed manifest, and refuses anything outside it. Blocked attempts are recorded, not silently dropped.

Credential root

Short-lived, scoped tokens issued only against a passing verification and only for scopes already in the manifest. No standing secrets to steal, no reaching past the declared blast radius.

The honest boundary

MeshKor is the policy and identity layer. It does not provide the physical kernel isolation that would stop two agents sharing a process at the infrastructure level; that belongs to whoever runs the compute. True defense in depth pairs MeshKor with that isolation layer, and we're clear about where the line sits.

Early access

Prove your agents are who they say they are.

MeshKor is in preview. Join the waitlist and we'll reach out as we open enrollment to the first builders.

Join the waitlist →