Every agent gets a license. A person answers for it.
Cars had this problem 100 years ago. Nothing drives on a public road without a plate, a registered owner and a license that says what the driver may do. AI agents act in the world with none of that. This track asks what the equivalent looks like: a license for each agent, a verified person who answers for it, and safety features that demand a human answer, from the right person, when it matters.
The prototype gate runs in Claude Code, Cursor, Codex, Antigravity, GitHub Copilot CLI and Hermes. Nothing the agent produces leaves the machine except the proof. What it reports to, and what never leaves: connectors and the connections map.
3 passkeys on file
RealSean's own agent, as the registry's signed plate record describes it. Anyone can pull that record from in.xchk.io/api/interchange/plates/OPS-YDDS.
Cars had this problem 100 years ago
When cars arrived they were fast, new and dangerous, and nobody was clearly answerable for them. Nobody fixed that by making cars smarter. Within a generation, society wrapped them in a system of accountability that still works today.
New York makes owners register their cars and put their initials on the back. The first plates, and the first registry.
Massachusetts issues the first state-made plates. Soon states are licensing drivers, not just cars.
Connecticut demands proof of financial responsibility after a crash. Massachusetts makes insurance a condition of registration.
Every new US car must come with seat belts. Safety features become the law, not an option.
The 17-character VIN becomes standard: the machine's own identity, eighty years after the owner's.
Every new US car must have front airbags for the driver and the passenger.
US rules standardize the event data recorder, the car's black box.
Accountability came first: an owner, a registry, a license, insurance. Then safety features, required by law: seat belts in 1968, airbags thirty years later. The machine's own identity came eighty years after the owner's. Most work on agent identity today runs the other way. It starts with the VIN and the ignition key, meaning workload identity and credentials, and hopes accountability follows.
The same kit, for agents
The prototype borrows the whole system, piece by piece, and like the car world it starts with a verified person. Nothing else is issued until someone has proven who they are.
| On the road | For agents | What it means in the prototype |
|---|---|---|
| Driver's license | Verified person | Before any plate is issued, a real person proves who they are and binds passkeys to their own devices. Government ID is preferred; corporate sign-in is accepted as a weaker anchor, and the record says which. Everything below hangs off this person. Their identity is built from facets proven over time. |
| License plate | Plate | Every agent's public identifier, like OPS-YDDS. Anyone can read it and ask the registry about it. |
| L-plate (the learner's mark) | Supervised plate | A learner drives only with a licensed adult in the passenger seat, and the plate says so to everyone behind. A new agent runs the same way: its safety features demand a human answer for the actions that matter, and the record it builds under that supervision is what earns it more. When safety demands it, the right person answers. |
| VIN (the chassis number) | Fitting | A plate is bolted to one car, and the VIN stamped in its chassis says which car. An agent's plate is fitted to one agent program on one machine, and every run on the record says which. The difference today: a VIN is stamped in metal, and the agent's is a credential, which could be copied to another machine. The registry can notice a plate turning up somewhere else, but it is not yet a number the hardware itself holds. |
| Registered owner | Owner | The verified person, or a verified organization behind them, who answers for the agent and decides who is asked when a safety feature demands an answer: usually themselves, sometimes a delegate such as a VP of Finance for payments. |
| State of registration | Venue | Where the owner is accountable: FL, CA, CO, GB, IE, EU. It follows the owner, not the server the agent happens to run on. |
| The DMV | Registry | Issues plates and keeps the record. There is more than one registry, as there is more than one state. |
| License class and restrictions | Grant sheet | What the agent may do and up to what amount. Beyond that, safety features demand a human answer before it acts. |
| Odometer | Run count | Every session is a numbered run under the plate, so work can be traced back to a run. |
| Dashcam | Dashcam | The machine's own record of what ran, reconciled against what the registry authorized. |
| Reporting a driver: complaint, ticket, points | Report, investigation, stop | Anyone can report an agent for bad behavior. A report opens an investigation of the agent's own record; upheld conduct brings a warning, points, a suspension, or an emergency stop that halts the agent on its own host. Run the plate, then report it. |
| Fleet sticker and fuel card | Charge code | Every plate carries a department sticker, and every action and every token is charged to a cost centre, like a fill-up on a company fuel card. |
| Trip log | Receipt with cost | Each action's record says what it was for and what it cost, so the bill can be read line by line. |
| Build sheet (the window sticker) | AI bill of materials | The factory's as-built list for one VIN, and the Monroney sticker that discloses it. For agents: a signed CycloneDX inventory of what is actually on each plate, machine and fleet: harnesses, gate and manager versions, AI surfaces, MCP servers. Signed and checked offline. |
| Insurance | Evidence of control | Proof that the controls were on at the moment of a loss, which is what an insurer needs to price them. |
What the car world teaches
Answer for the machine, don't perfect it
Cars still crash. What changed was that someone is always answerable. Agents will still make mistakes; the question is who answers for them.
Every plate has a verified owner.Register before the public road
You can build any car you like in your garage. You cannot drive it on a public road without a plate.
Consequential actions need a licensed agent.Legible to strangers
An officer reads a plate without calling the manufacturer, and runs plate and state against the issuing registry.
Anyone can pull a plate's signed record and standing from its registry.Graduated privileges
License classes, restrictions, and the learner's permit: some driving only happens with a licensed adult in the passenger seat.
Some actions only happen with the right person answering.Insurance does the enforcing
Massachusetts tied insurance to registration. From then on, insurers priced driving and did much of the policing.
Evidence that the controls were on, at the moment of a loss.Suspension is the teeth, the record is the memory
A license that cannot be taken away is decoration. An accident that leaves no record cannot be judged.
Revocation, an emergency stop, and a dashcam.Where agents are harder than cars
Speed
A driver makes a few decisions a minute; an agent can make thousands. So the license is checked by machine on every action, and only the restricted ones reach a person.
Copies
Cars do not fork. Agents spawn helpers and run in several harnesses at once. Each helper gets a child plate tied back to the parent and its owner.
No metal plate
An agent's plate is a signed record checked at every action, not a sheet of metal on a bumper. That makes it harder to swap and easier to check.
No one sees the road
Nobody watches an agent drive. That is why the dashcam matters, and why an action that ran without a check has to show up as evidence rather than simply be missing.
Borders in milliseconds
An agent crosses jurisdictions faster than any car. Its venue follows the owner, not the server it happens to run on.
When safety demands it, the right person answers
This is the heart of the track. When an action trips a safety feature, the agent cannot go on until a person answers, and xChk asks the right person for that action: usually the owner, sometimes a delegate such as a VP of Finance for payments. Their answer is bound to the exact action and sealed, so it can be checked afterwards.
- The agent trips a safety feature.Claude Code, working for Sean under plate CMP-YJ2T (run 403), wants to read files with
sedandgrepand look atprocess.env: a security-area action, so the safety features demand a human answer before it runs. - The gate holds the command.The hook inside Claude Code stops it before it runs and asks the registry. If the registry cannot be reached, the gate fails closed.
- Verify it's you (video 0:00).The right person here is Sean, the owner. His phone opens the request. Before he can even read it, he unlocks it with his own passkey.
- He reads the exact command and answers (0:07).The card shows who is asking ("Claude, acting for Sean"), the plate, the tool and area, the exact command, and when the request expires. He taps Approve; he could decline, or change the command.
- Photo proof, then sealed (0:10).He takes one photo as evidence, stored with the execution record. "Attestation complete": the answer, who gave it and how are sealed with the action. It fits that one command, and it expires.
The same approval, from the Black Box
What the video shows, as the agent's own sealed record keeps it. Record 16317 is the gate holding Claude's command for a human (attest, run 403). Record 16318 is Sean's passkey approval (webauthn) at 02:56:03 UTC, chained to it. Both were anchored to a public blockchain.
Record 16318 · 2026-09-29T02:56:03Z · approved · webauthn
recordHash 098b5644d460631052a6a077157d033cd12752e0fdd06d5e95018da6ecef7f64
prevHash 67e5e33699137cb3199959c766092404c3e4f5dd691877bdf83198422d7722a1 (record 16317, the held command)
attestation 23d98e3a271c40c846d814d2d77cd01278d479c12c8aa229579b4df308a8476f
anchored: Ravencoin block 4,558,860
It verifies itself in your browser: 2 of 2 record hashes and 1 of 1 seal recomputed, chain intact. The report also carries a flag from an 8 August red-team drill on the same plate, where the recorder was deliberately withheld. That flag is shown with the written finding beside it, because a finding never erases an exception.
Fuel cards and trip logs: what each agent costs, and who pays
Fleets solved this too. Every company car belongs to a cost centre, every fill-up goes on a fuel card tied to the car and the driver, and the trip log says what the miles were for. The prototype does the same for agents, down to the single action, across every AI a team uses.
A department sticker on every plate
Each plate carries a charge code, set when it is issued, like a fleet sticker on the windshield. Work is charged by the first rule that applies:
Reports say which rule decided, so an allocation is never a guess dressed as a fact.
Change the code mid-trip
Typing /charge dev in Claude Code or Hermes charges the session to dev from that moment. The switch is sealed on the action record; earlier records keep their original code.
Every AI, one ledger
Claude Code, Codex and Hermes are metered on the machine from token counts and model names only, never prompts or content. OpenAI's own usage feed can be pulled in beside them and reconciled against the bill.
Cost on every receipt
Each finished errand shows what it cost, for example $0.20 · 3.1k tokens in, 12 out · 4 s · subscription seat. Long jobs report their cost so far every five minutes, so nothing is invisible until it ends.
Seats are not dollars
Subscription plans and pay-as-you-go APIs are different units. Plan usage is shown as a share of the plan with its list-price equivalent; API usage is shown in dollars. Mixing them is how budgets lie.
Runaways stopped before the bill
A plate spending far above its own usual pace climbs a ladder: notice, throttle, hold for a person's answer, stop. Each step is recorded.
Department reports
Spend by person, department, plate, model and charge code, day by day, with each person's monthly allowance and a warning when they will run out before month end. The whole ledger exports in FOCUS, the FinOps standard format, straight into a finance system.
On the record
Real 12 Sep 2026: run CMP-YJ2T.370 was switched to charge code dev mid-session. Record 15024 was sealed carrying chargeCode: dev; the records before it kept their original code.
Real The session that wrote this page ran under license CMP-YJ2T as run CMP-YJ2T.402, metered like any other.
The dashcam: silence becomes evidence
The machine keeps its own record of what ran, chained and sealed every few minutes, and it is reconciled against what the registry authorized. An action that ran without a license check does not simply go missing. It shows up as an omission, on both sides.
Contemporaneous
Recorded when it happened, not reconstructed after an incident.
Tamper-evident
Edits are refused at intake and gaps are detected. Records are anchored so the history cannot be quietly rewritten.
Cuts both ways
Like a real dashcam, it clears the owner as readily as it implicates them.
Stop that works
The emergency stop halts authority on the agent's own host, and no one can resume it without a signed answer.
Check it yourself
This is the complete, unedited report for one hour of OPS-YDDS on 24 August 2026. It does not ask to be trusted; it asks to be checked. Open it and watch it verify.
Open the real Black Box ReportAbout 900 KB, one self-contained HTML file. No account needed.
Why the plate in the report is Irish: on 24 August OPS-YDDS was registered in venue IE. It has since moved to FL, which is what the registry shows today. A sealed report shows the license as it stood at the time, and it cannot be edited to match the present.
The build sheet: an AI bill of materials, signed
Every car leaves the factory with a build sheet, the as-built list of what is on that VIN, and a window sticker that discloses it. An agent fleet now has the same: every plate, every machine and the whole fleet can hand over an AI bill of materials (AIBOM) in CycloneDX 1.6, the format asset-inventory tooling already reads. It lists what is actually there: the licensed plates, the gated harnesses with their gate and manager versions, the machines, the AI surfaces the host manager can see, including the ones no plate covers yet, and the MCP servers each harness is configured with.
Signed by the registry
The document is hashed and signed like a receipt: Ed25519 today, with an ML-DSA-65 leg beside it where the registry has one. The public keys travel in the envelope.
Checked offline
A short script recomputes the hash and verifies every signature with no account, no shared secret and no call to the registry, then prints the inventory it just checked, so a reader sees what was signed, not only that it was.
One per plate, machine or fleet
Scope is stated in the document. A plate's BOM is the plate and what it runs on; a machine's is everything on that host; the fleet's is all of it.
Built for the forms
It answers the inventory question in ISO/IEC 42001 (A.4), the NIST AI RMF MAP function and EU AI Act Article 9 in the shape those controls expect, from the machines' own reports rather than a spreadsheet someone filled in.
The OWASP AIBOM Foundations Guide (September 2026) asks that an AIBOM state its scope, completeness and provenance so that what is missing shows. That is the frame here: the inventory is evidence of what was seen, not a safety score.
Run the plate, then report it
A plate is only useful if someone on the receiving end can act on it. Like a police officer, a checker always runs plate and state together, against the registry that issued it. From there a site has three moves: check the agent's standing, ban it, or report it.
1 · Run the plate
Every request an agent signs names its plate. A site verifies the signature against the issuing registry's keys and reads the plate's standing: a plain band and the facts behind it, never a secret score. It is public and needs no account.
Standing rises with time and clean activity, and falls with proven bans and upheld reports. It is counted against the plate's own sealed actions, so a busy agent is not punished for being busy. A brand-new plate starts at "new" and has to earn trust.
OPS-YDDS Good standing
- Licensed 78 days ago; 111 sealed actions on its record.
- No upheld reports in the last year.
- No proven bans.
- Its owner's other plates: 1 upheld serious report.
Real in.xchk.io/api/reputation/OPS-YDDS, 29 Sep 2026. The owner's record follows every plate they hold, so a fresh plate cannot wipe the slate.
2 · Ban it: "not welcome here"
For nuisance behavior such as ignoring robots.txt or hammering a site. The site gets a ready-made rule for its own web server or edge, so the ban works in seconds without waiting on anyone. The owner is told, and the plate honors the ban from its own side: its signer refuses to sign requests to that site. Coming back after a ban is itself reportable, and the agent's own signature proves when.
3 · Report it: serious harm
For fraud, breaking into accounts, taking data or attacks. The evidence is the agent's own signed lines from the site's logs; the plate is read from those lines, so no plate, no report. How serious it is comes from what the logs show, not from the story. No account needed: confirm an email address with a six-digit code.
The owner has to answer
A serious report alarms the owner and the registry at once, and the owner gets a clock, as with a card chargeback: take a position within the hour, or the plate is suspended until the report is resolved. A reply is not a position. Neither side sees the other's identity; the registry relays.
A party is never the judge
Someone who owns the plate, or filed the report, cannot decide it, even if they are an administrator. Every step of a report is hash-chained on its own record.
Stolen plates show up
When someone signs as a plate without its key, the verification fails and the real owner is told that someone tried to pass as their agent, like a report of stolen plates. It never counts against the real plate.
What happens after a report
A report is a lead. The evidence is the agent's own sealed record of what it did. A report opens an investigation; nothing is stopped on someone's say-so.
1 · The warrant
The investigation covers only the sites named in the evidence and the time window the signed lines span. Three bans in a day open one too.
2 · Sealed before anyone looks
The plate's own records for that window are sealed into a bundle before review, so the owner cannot tidy up, and an appeal sees exactly what the reviewer saw. The signer's log shows whether the agent or a person at a keyboard sent each request.
3 · A reviewer that cannot be talked into it
An AI reviewer reads everything as untrusted text. A report can say where to look but never justify a penalty on its own: a penalty must cite the plate's records that touched the reported site, or it is thrown out.
4 · The results, on a ladder
No action, a warning, points against the license, a suspension, or an emergency stop that halts the agent on its own host. Taking the license away for good is a hearing a person holds, never a step the investigation takes.
5 · Warned first
Before a suspension or stop takes effect, the owner and administrators are told what, why and when: minutes if the conduct is still going on. An administrator can hold it.
6 · Appeal, and a report anyone can check
The owner gets one appeal. The person who reported sees the outcome, never the plate's records. The investigation ends in a signed report whose seal anyone can recompute.
Everything an LLM says is false until proven true
The same rule applies to what AI writes. Paste text with its cited links: the registry fetches every source itself, checks each claim by plain rules first (does the page exist, is the quote really there), asks a model only about what the rules leave open, and signs a receipt that anyone can check without an account. The receipt holds fingerprints, not your text, and is tied to your agent's plate.
Where this fits
A lot of good work is going into agent identity and safety, and most of it is complementary. Each layer answers a different question. This track works on the one that is usually left open: which person answered for this action, and would we know if an action went unrecorded?
| Layer | Question it answers | What this track adds |
|---|---|---|
| Workload and agent identity (SPIFFE, WIMSE, AAuth, agent IDs) | Which software is calling? | The VIN and the ignition key. Adds the registered owner behind it, and answers from the right person. |
| Delegation and authorization tokens (OAuth, actor chains, scoped tokens) | What is this token allowed to do? | Binds a verified person's answer to one specific action, so a yes cannot be reused for a different amount or command. |
| Execution attestation (signed run records, confidential computing; AgenTrust TRACE) | How did the agent run, and under what policy? | The registry produces one TRACE Trust Record per run, in AgenTrust's integrations repository since 19 Oct 2026 and checked by their verifier, not ours. What this track adds: who was allowed to say yes, and proof that no action ran without a record. |
| Signed web requests (Web Bot Auth) | Which bot sent this request? | A plate the site can run against its registry: owner, standing, and a way to ban or report it. |
| Runtime guardrails and sandboxes | What can the agent reach, and can it be stopped? | Runs alongside them. When a guardrail escalates, a named person answers, and the answer is sealed. |
| Agent payments and "know your agent" | May this agent pay on someone's behalf? | The same answer-per-action model beyond payments: code, infrastructure, data, customer actions. |
Research questions
Can a yes be proven?
Can a person's answer be bound to one specific action so a stranger can verify who answered, what they saw and when, offline?
Can silence be evidence?
If the dashcam and the registry each keep a record, can an unlicensed action be detected rather than simply missing?
Can the gate be bypassed?
A public benchmark measures how often agents route around the gate, and what closes each path. See the scorecard.
Can a license be priced?
If the controls on the license are continuously proven, can they be treated like telematics, for audit, regulation or insurance?
"The button halts authority instantly and provably. The agent's own host refuses it, and no one can resume it on an unsigned word."
From the interchange paper, on the emergency stop.
On the record
The work is published so it can be checked, reproduced and argued with.
Benchmarks
External suites (AgentDojo, spikee, AgentGovBench, DEMM-Bench) plus Sean's own control-plane benchmark. It tries to get around the gate in six harnesses, checks that an action which ran without a faithful record is caught, and measures what the gate costs honest work. Each gate bench is also run against a deliberately broken gate, to prove it can fail. Findings are published with their fixes, and the harnesses are reproducible.
License an agent, break it, tell us
Issuing a plate and installing the gate takes one command per machine. Reports of what breaks, and cases that stress the idea, are the most useful contribution.