# Record your agents in a trust registry

> Add a Trust Recorder to a surface so the gateway records each managed agent in a trust registry under your Issuer, where partners' Trust Checks can find it.

This guide adds a Trust Recorder to a surface, so the gateway records each of the surface’s managed agents in a trust registry as owned by your Issuer. For how the records fit together, see [How the trust chain is recorded](/products/affinidi-trust-fabric/agent-gateway/concepts/connections/trust-registry.md#how-the-trust-chain-is-recorded).

A partner whose Trust Check asks the registry about your agent gets NOT_RECOGNIZED until a record says who owns that agent. Registering your Issuer writes the records about the Issuer itself. The Trust Recorder writes the remaining record, one per managed agent, when the agent responds.

Use this guide when:

- Your agents call partners that check them against a trust registry.

- Partners call your agents through a Transit Point that checks each destination against a trust registry.

- You add managed agents over time and want each one recorded without editing the registry by hand.

A Trust Recorder is needed only for agents that a partner checks against a trust registry. To check the agents that call you, use your own [Trust Check](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/connections/agent-validation-via-trust-registry.md) instead.

## Prerequisites

| You need | Where it comes from |
| A trust registry with status CONNECTED, whose administrator allows your gateway to write records | [Adding a trust registry](/products/affinidi-trust-fabric/agent-gateway/reference/trust-registries/trust-registry.md#adding-a-trust-registry). For an Affinidi Trust Registry, see the policy step in [Verify agents across organisations with a trust registry](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/connections/verify-agents-across-organisations-with-a-trust-registry.md#connect-both-gateways-to-the-trust-registry). |
| An Issuer whose Trust Registry Status reads Registered | [Adding an Issuer](/products/affinidi-trust-fabric/agent-gateway/reference/trust-registries/issuer.md#adding-an-issuer). Registering it writes the two Issuer records. |
| A surface whose managed agents have a DID | An Identity element that derives each agent’s DID. See [Limit surface access by agent identity](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/access/limit-surface-access-by-agent-identity.md). |
| A role that can edit surfaces | Power User or Administrator, by default. |

## Steps

Set the surface’s Issuer

Open the surface and select the surface container, the outer box around the canvas. In its panel, set Issuer to the Issuer you registered.

Add a Trust Recorder on the response edge

From the Security & Policy section of the palette, drag Trust Recorder onto the Managed Agent → Access Point edge. The recorder runs after the managed agent responds, when the agent’s DID is known.

Select the Trust Recorder, then select Configure Trust Recorder….

Configure the entry

Select Add Record, then fill in the entry:

- Trust Registry: the registry to write to.

- Issuer: the Issuer you registered.

- Authority: select Use surface Issuer, so each record says that your Issuer owns the agent.

- Built-in triple: keep [Authority] Agent DID is ownedAgent selected.

Select Save, then save the surface.

To record the same agents in another registry, select Add Record again. A Trust Recorder holds up to 10 entries.

Send a request through the surface

Send any request that the managed agent answers successfully. The recorder writes the record in the background, after the response returns to the caller.

With Use surface Issuer, each record has your Issuer as its Authority and the agent as its Entity. That is the record a partner’s Trust Check finds when it uses your Issuer’s DID as its Authority ID. Selecting Explicit DID and your Issuer writes the same record. Selecting Explicit DID and an Authority writes records under that Authority’s DID instead, which suits a registry where a parent organisation vouches for every agent directly.

## Confirm

### Test 1: Identities page after a request returns Recorded for the agent

Send a request through the surface, for example on an A2A surface:

```bash
curl -X POST "" \
  -H "Content-Type: application/json" \
  -H "A2A-Version: 0.3" \
  -d '{"jsonrpc":"2.0","method":"message/send","id":1,"params":{"message":{"messageId":"recorder-1","role":"user","parts":[{"kind":"text","text":"Hello"}]}}}'
```

Expected: the managed agent’s response. Then select Identity in the sidebar. On the Agent Identities tab, the agent’s Recorder chip reads Recorded. Hover over the chip to see the last attempt, each registry entry, and its record counts.

The Trust Recorder panel on the surface shows the same outcome in its Last outcome row.

### Test 2: partner’s Trust Check for the agent returns ok

Send a request that makes your agent call the partner’s surface, with the command from [Agent validation via a trust registry](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/connections/agent-validation-via-trust-registry.md#confirm). The partner’s Trust Check uses your Issuer’s DID as its Authority ID.

Expected: the partner’s response. On the partner’s Audit page, the record reads Trust check passed, with Result Passed.

## Troubleshooting

| Symptom | Likely cause | Fix |
| The Recorder chip shows Skipped with “Surface has no Issuer”. | The entry’s Authority is Use surface Issuer, and the surface has no Issuer, or its Issuer was deleted. | Set the surface’s Issuer (Step 1) and save the surface. |
| The Recorder chip shows Failed with “Registry rejected the record”. | The registry’s policy does not allow your gateway to write records under the Issuer’s DID. | Ask the registry’s administrator to allow it. The next response records the agent. |
| The Recorder chip shows Skipped with “Trust registry not connected”. | The gateway’s connection to the registry dropped. | On Connections › Registries, select Reconnect. |
| The Recorder chip shows Not attempted yet. | No request or agent-card fetch reached the managed agent since the Trust Recorder was saved, or the agent did not answer successfully. | Send a request that returns 200. |
| The Issuers list shows Registration failed. | The Issuer records were refused, for the same reasons as above. | Fix the registry policy, then open the Issuer and select Retry TR Registration. |

For every status and reason, see [Last outcome](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/trust-element.md#last-outcome).

## Next steps

- [Verify agents across organisations with a trust registry](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/connections/verify-agents-across-organisations-with-a-trust-registry.md): Set up the partner’s side of the check.

- [Agent validation via a trust registry](/products/affinidi-trust-fabric/agent-gateway/how-to-guides/connections/agent-validation-via-trust-registry.md): Check the agents that call your own surfaces.

## Related

- [Trust registries](/products/affinidi-trust-fabric/agent-gateway/concepts/connections/trust-registry.md#how-the-trust-chain-is-recorded): The three records in a trust chain, and what writes each one.

- [Trust Recorder reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/trust-element.md#trust-recorder): Every entry field, custom resources, and status.

- [Issuer reference](/products/affinidi-trust-fabric/agent-gateway/reference/trust-registries/issuer.md): Fields and registration status of an Issuer.