Verify agents across organisations with a trust registry

Create a connection point for each gateway

In the trust registry’s admin UI, select Connections, then Create connection. Enter a Name, such as “Org A gateway”, a Description, and the Mediator DID the registry connects through, then select Create.

Open the new row’s More menu and select Copy OOB to copy its OOB invitation URL. Repeat for Org B’s gateway, so each gateway has its own connection point.

Add the trust registry on each gateway

On each gateway, add the registry with its own OOB invitation URL, as described in Adding a trust registry. Each connection waits in AWAITING APPROVAL.

Approve each gateway and allow its actions

In the admin UI, open each connection point’s More menu and select Approve. Each gateway’s status changes to CONNECTED.

Approving a connection point also creates a policy for that gateway, named after the connection point, that denies every action. To change a gateway’s policy, select Policies, open the More menu of the policy, and select Edit.

• Org A writes records. Set Effect to Allow, keep the gateway’s DID in Applies to, and allow Create, Read one, Update, Delete, List, and Query. In Resources, type one pattern for each DID that Org A writes records under, plus reference fields, then select Save:
  • trust_record/<Org A gateway DID>/*, for registering its Issuers.
  • trust_record/<Org A Issuer DID>/*, for recording its agents. Add this pattern after you register the Issuer in the next part.
  • reference_field/*, for the names the gateway publishes. The list offers it as Any reference field.
• Org B only queries. While Settings › TRQP query access is Open access, its default, queries bypass policies, so keep Org B’s deny-all policy as it is. If it is Controlled access, set Effect to Allow and allow only Query, then select Save.

Register an Issuer

On Org A’s gateway, add an Issuer registered with the trust registry, as described in Adding an Issuer. Its Trust Registry Status reads Registered.

Copy the Issuer’s DID from the Issuers tab. Org B needs it in a later step.

Record the surface’s agents

Open Org A’s surface:

1. Select the surface’s container and set Issuer to the Issuer you registered.
2. Drop a Trust Recorder on the Managed Agent → Access Point edge. In its entry, select the Trust Registry, set Issuer to the Issuer you registered, set Authority to Use surface Issuer, and keep [Authority] Agent DID is ownedAgent turned on.
3. Save the surface.

The recorder records each managed agent when it responds. See Trust Recorder for every entry field.

Confirm the agent is recorded

Send a request to Org A’s surface. Then select Identity in the sidebar: on the Agent Identities tab, the agent’s Recorder chip reads Recorded.

Sign the agent’s identity on calls to Org B

On Org A’s surface, add a Transit Point as described in Apply policy to outbound calls. Set Endpoint Type to Direct URL, and set Target Endpoint to the Entry point URL of Org B’s surface, which Org B copies from its Access Point panel. The call reaches Org B over HTTPS, so this works without a connection between the two gateways. Drop an Identity element on its Managed Agent → Transit Point edge, configured the same way as the surface’s own Identity element, so the agent keeps the DID the recorder recorded.

Org A’s gateway then signs the agent’s identity on every call through that Transit Point, and Org B verifies it.

Add Org A’s Issuer as an Authority

On Org B’s gateway, add an Authority whose Authority DID is the Issuer DID you copied from Org A, as described in Adding an Authority.

Add a Trust Check for callers

Open Org B’s surface and drop a Trust Check on the Access Point → Managed Agent edge. Add a query:

• Trust Registry: the registry.
• Record Type: Recognition.
• Authority ID: the Authority you added for Org A.
• Entity ID: keep The caller’s agent DID (default).

This asks the registry whether Org A’s Issuer owns the calling agent. See Which DID goes in which field.

Refuse callers that fail the check

A Trust Check reports its result to policy and does not refuse a request by itself. Drop a Policy element on the same edge with a rule that requires the check to have run and passed:

package surface.policy

default allow = false

allow if {
    count(input.trust_check_results.caller) > 0
    every r in input.trust_check_results.caller { r.ok }
}

Save the surface. See Apply OPA policies for creating the policy definition.