Proof of origin, and a record of everything since.
The pedigree is a sealed birth record plus a tamper-evident history chain. Birth alone would miss later tampering; history alone could be anchored to a forged origin. The point is the unbroken line from a verified origin through a verified history.
A build identity, and a deployment identity that can't exceed it.
Identity comes in two tiers, and the relationship between them is the enforcement. A Build AIN is issued once per software release and seals the capability envelope: everything that version of the agent is ever allowed to do. A Deployment AIN is issued per running instance and seals a manifest that must be a provable subset of that envelope, along with its own storage, salt, retention, and anchoring. An instance can be narrower than its build, never wider.
One credential, verified cheaply, at scale.
Four interdependent mechanisms keep verification cheap no matter how much history an agent accumulates, and none of them stands without the others. Every birth and event is signed with post-quantum signatures, and the signing scheme is built to stay agile, so the primitive can be swapped as the standards evolve without reissuing what came before.
Constant-size head
A running summary keeps verification flat regardless of history length. Whether an agent has ten events or a hundred thousand, the fast check costs the same.
Tiered FAST / FULL
A cheap FAST check serves the routine many; a deep FULL walk of the whole history is there for the rare few who need it. Most checks never pay the full cost.
Cached, single-pass
Cached trust removes repeated cost within a window, and verification is single-pass and asynchronous, with no round trips, so it fits agents that spend most of their time asleep.
A genuine agent can still misbehave. These watch for that.
Authenticity and conduct are different questions, so they're handled separately. Protection scales with irreversibility: reversible actions are automatic and fast, and the irreversible ones require the keys.
From provenance to enforcement.
The birth record already carries the rules an agent was born with. The bridge activates that field so the rules do real work: a machine-readable manifest, a sandbox that enforces it, drift as a clean halt, and MeshKor as the credential root.
Capability manifest
Allowed tools, allowed endpoints, credential scopes, and a declared blast radius, sealed into the signed birth. An agent can't widen its own reach later without breaking its own pedigree.
Runtime sandbox
Verifies the agent, loads its sealed manifest, and refuses anything outside it. Blocked attempts are recorded, not silently dropped.
Credential root
Short-lived, scoped tokens issued only against a passing verification and only for scopes already in the manifest. No standing secrets to steal, no reaching past the declared blast radius.
MeshKor is the policy and identity layer. It does not provide the physical kernel isolation that would stop two agents sharing a process at the infrastructure level; that belongs to whoever runs the compute. True defense in depth pairs MeshKor with that isolation layer, and we're clear about where the line sits.
Prove your agents are who they say they are.
MeshKor is in preview. Join the waitlist and we'll reach out as we open enrollment to the first builders.
Join the waitlist →