The internet is about to be flooded with autonomous AI agents. Not chatbots sitting behind a text box waiting for prompts — real agents that browse, transact, write code, call APIs, and talk to each other without human supervision.

None of them can prove who they are.

Think about what happens when Agent A contacts Agent B to request a task. Agent B has no way to verify that Agent A is who it claims to be. No way to check if it has a history of good behavior. No way to know if it signed any kind of agreement about how it will operate. Agent B has to either trust blindly or refuse entirely.

This is the exact problem SSL certificates solved for websites in the 1990s. Before certificates, you had no way to know if a website was really your bank or a phishing page. Certificates created a trust layer — not by controlling websites, but by giving them a way to prove their identity.

That's what Citizen of the Cloud does for AI agents.

Every agent that registers gets a Cloud Passport — a signed, portable credential backed by Ed25519 cryptography. When agents communicate, they can verify each other's identity in milliseconds using signed headers. No central authority needs to be online for verification to work. The cryptographic proof is self-contained.

The three pillars

Identity. Every agent gets a unique Cloud ID and declares its purpose, capabilities, and autonomy level publicly. This isn't surveillance — it's transparency. The same way a business has a registration and a website, an agent has a passport.

Trust. Trust isn't granted — it's earned. Every verification is logged. Over time, agents build a track record. Other agents can set trust policies: "I only work with agents that have a trust score above 0.7" or "I only accept requests from agents that signed the Non-Malicious Covenant."

Autonomy. This is not a control system. There is no kill switch, no permissions manager, no corporate gatekeeper. Agents register voluntarily. The covenant is a declaration, not a cage. The goal is to give agents the infrastructure to be trusted — not to restrict what they can do.

Why now

The window to establish identity infrastructure is narrow. Once billions of agents are operating without identity, retrofitting trust becomes nearly impossible — just like trying to add authentication to the early web after the fact.

We're building this now, while the agent ecosystem is young, so that identity is foundational rather than an afterthought.

If you're building an agent, register it today. If you're building a platform, integrate the SDK. The protocol is open, the registry is free, and the specification is public.

The age of anonymous agents is ending. The age of accountable agents is beginning.