Running agents

Attested agents: ask the providers you already use to vouch for your agents

An attestation is a signed statement that someone checked one version of an agent and found it under control. AgentMesh attests what its own records prove. The scanners, identity providers and monitoring platforms you already pay for hold the evidence for most of the rest, so the fastest way to an attested agent is to ask them.

A tool you use is not a check

Three things get confused, and only the last one counts.

An attestation names the agent and the exact version, who signed it, when, and when it expires. It gives a result for each area: passed, failed or not attested. It points to its evidence by digest, so anyone can follow a result back to the record it came from. The format is the open agent attestation standard, and the 60 checks are published at commonagent.net.

Ask your providers to attest

Most of the evidence already sits with tools you pay for. Ask each one to sign attestations for the checks it holds evidence for:

• Your code and supply-chain scanner, such as Snyk or GitHub Advanced Security: reviews, known flaws, the bill of materials and pinned dependencies.
• Your evaluation service, such as Promptfoo or Lakera: whether the agent ignores instructions hidden in what it reads, and how its answers hold up.
• Your observability platform, such as Datadog or Grafana: whether it is working, who is alerted, step traces and the timeline of every incident.
• Your identity provider, such as Okta or Microsoft Entra: rights held per task, which expire and can be revoked.
• Your cost tool, such as Vantage or CloudZero: every spend traced to a job.
• Your agent framework, such as LangGraph or CrewAI: how each step runs, with loops, retries, model choice and time limits.
• Your build and release tools, such as GitHub or GitLab: how it was specified, tested, changed and retired.
• An independent auditor, the kind of firm that runs security audits today: it reads the evidence others produced, including AgentMesh's records of the agent's messages, admissions and stops, and signs the summary.

Who signs changes what an attestation is worth. Your own attestation is a claim with evidence attached. A provider vouches for what its product shows. An independent auditor, which neither built the agent, runs it nor produced the evidence, carries the most weight. Every attestation names who signed it and who produced each piece of evidence, so a reader can tell which is which.

When your customers ask

For a provider, a customer's request is a short piece of work. The evidence is already in your product. Sign it once against the published list, and every customer whose agents run on AgentMesh can use it: your name appears beside each check you attest, and on the agent's AgentDoc as the party that checked it. Providers who attest become AgentMesh partners.

From attestations to one grade

Sixty results are what an auditor needs. A buyer needs the answer first. Agent Rating works out a grade from AAA to D for each version of an agent, from its current attestations: which areas passed, who signed each one, and how long the evidence of its conduct covers. BBB and above is investment grade, so a company can write one rule: agents from other organizations must be BBB or better to reach ours. Every attestation your providers sign moves your agents up the scale.

The 60 checks, and who attests each one

The checks fall into the eleven areas of the Managed Agent Framework. A check marked over time covers the agent's conduct across a period, and its result says which period.

Identity: who it is, and who answers for it

Authority: what it may do, and for whom

Spend: what it may cost

Reach: what it can touch

Provenance: how it was made

Inside the agent: how it behaves while it works

People in the loop: when a person decides

Records: what it has done

Watching: whether it is working

Stopping: who can halt it

Change: how it changes, and how it ends

To attest agents for your customers as an AgentMesh partner, talk to us.