A deepfake is AI wearing a person's face. An agent is AI carrying a person's authority.
Either way the question is the same: is a real, verified person behind it, and who answers? A deepfaked candidate in a video interview, a cloned voice asking the helpdesk to reset MFA, an AI agent about to push code or move money for someone. Sean studies how to catch deepfakes and hold AI agents accountable: check the person live, put their decision on the record, and leave proof that a stranger can verify without trusting us.
A personal research project by Sean MacGuire, down the rabbit hole of deepfakes, identity and agentic identity.
Two research tracks, one question
The settings differ; the machinery underneath is shared.
Who answered for this agent?
Cars had this problem 100 years ago, and the answer still works: a license and a plate for every agent, a registered owner who answers for it, and safety features that demand a human answer, from the right person, when it matters.
- Prototype gate for Claude Code, Cursor, Codex, Antigravity, GitHub Copilot CLI and Hermes
- The right person answers with a passkey on their phone: usually the owner, sometimes a delegate
- Making an action that ran but was never recorded show up as evidence
- What every action costs, charged to a department, across every AI a team uses
Is this person who they say they are?
Live checks at the moments impostors target, run alongside tools people already use.
- Deepfakes, AI-coached answers and bait-and-switch in remote interviews
- Callers impersonating staff to get MFA reset or access granted
- Whether the person who starts work is the person who was hired
- Audits of current remote staff: who is actually doing the job
Identity is made up of facets, proven over time
Nobody is proven once, by one document. People are known by many things: an ID, an employer, the devices they carry, their work history, where they usually are, how they have behaved. Each is a facet. xChk gathers them into one verified identity and keeps adding to it, so confidence in a person is built up over time rather than asserted at a single checkpoint.
Every facet carries when it was proven, so a check from last year and a check from this morning are never confused.
An extension to the OAuth 2.0 protocol
The facets travel through an extension to OAuth 2.0 and OpenID Connect. A site that offers "Sign in with xChk" receives a portfolio claim: which facets back this person, how and when they were proven, and which ones the person chose to share with that site. The site applies its own policy to decide what is enough. The identity provider never decides for it.
Sean calls it Bring Your Own Identity. A bank can require government ID and a fresh live check; a forum can accept a passkey and a work history. Same person, same identity, different sufficiency.
What a site receives, in outline:
The same identity is the verified person on an agent's license in Track 1, and the person checked live in Track 2.
It covers agents too
The token says what kind of entity is signing in: a human, an agent, a bot, a service or a device. An agent does not bring a face or a passport; it presents its plate as its facet, and the facet says that a verified person answers for it. A site can then decide that agents are welcome, but only ones with a verified person behind them, using the same policy it applies to people.
An agent, in outline:
The shared method
Four steps the prototype runs in both tracks, whether the person is a job candidate, a caller or the owner of an agent.
Verify the person
Live on their own phone: video, liveness, location, device and network signals, or a passkey bound to someone already verified.
Record the decision
A named human says pass or fail, yes or no. The decision, who made it and when are recorded together.
Seal the proof
Records are hash-chained and anchored, so an edit or a gap shows.
Let anyone check
A proof link or a self-verifying report that recomputes itself offline, with a verifier the producer did not have to be trusted for.
On the record
The work is published so it can be checked, reproduced and argued with.
The prototype is listed as Aligned, self-assessed, with CSA AARM v1.0, the Cloud Security Alliance's runtime-management spec. Aligned is a self-description, not a verified verdict.
Benchmarks
External suites (AgentDojo, spikee, AgentGovBench, DEMM-Bench) plus Sean's own control-plane benchmark. It tries to get around the gate in six harnesses, checks that an action which ran without a faithful record is caught, and measures what the gate costs honest work. Each gate bench is also run against a deliberately broken gate, to prove it can fail. Findings are published with their fixes, and the harnesses are reproducible.
Works with
What the registry talks to, exercised live, not announced: a finding leaves as a pointer into evidence, never a copy of a prompt.
- Microsoft Entra — a work sign-in enrols the person; the tenant rides inside the signed receipt.
- Microsoft Agent Governance Toolkit — the registry as an approval backend: the agent's request stops for a person's passkey.
- Microsoft Sentinel, Azure Event Hubs, Azure Blob, Slack — finding sinks, proven against real endpoints on 19 Oct 2026.
- Ravencoin, OpenTimestamps — seal heads anchored on public chains.
Papers
Both are open. Read them, cite them, argue with them.
A Licensing and Accountability Layer for Inter-Agent Protocols: "Have your agent call my agent"
MCP connects agents to tools and A2A connects agents to each other, but nothing answers who is accountable for what an agent does. The paper models the answer on a system that has managed the problem for a century, vehicle licensing: registries, licenses bound to verified people, revocable permissions, and receipts both sides keep and anyone can recompute.
xChk: Bring Your Own Identity — Heterogeneous Assurance with Verifier-Determined Sufficiency
People prove who they are in different ways: government ID, corporate sign-in, passkeys, live checks. Instead of one provider deciding what is good enough, each service applies its own policy to the portfolio a person brings. It also covers human approval of high-risk actions, triggered by people or by AI agents.
Collaborate
Sean welcomes researchers, standards work, and anyone willing to run the prototype and report what breaks. If you have a case that tests the idea, get in touch.