Identity for models and agents, from training to action
AI passport
Every AI should be able to say what it is, where it came from and who it works for. And prove it.
An AI talks like a person and is run like a service. People trust the first and should be checking the second. An AI passport puts the checkable facts in one place. Which model is this? What was it trained and tuned from? Who built it? What does it run on now? Whose instructions does it follow? Every fact is signed, and every fact has an expiry, because a model that was retrained last night is a different traveller.
Who this is for
- Model providers and AI labs, who have to document origin and lineage
- Companies that fine-tune and deploy models, and answer for what they ship
- Buyers and auditors of AI, who need facts they can check
What is in the passport
Seven pages. Each is a signed statement that a machine can check, and each names the open standard it can be built on.
1. OriginWho trained and published the model, with a signature over the weights. Built on model signing.
2. LineageThe base model, every fine-tune and adapter on top of it, and a summary of the data used. Built on an AI bill of materials.
3. BuildHow training and fine-tuning ran: code, pipeline and environment. Built on build provenance. 4. RuntimeThe hardware and software that serve the model now, measured and attested. Built on remote attestation. 5. ConfigurationThe system prompt, tools and policy in force, by version.
6. PrincipalWho operates this AI, on whose behalf it acts, and what it is allowed to do.
7. ValidityWhen the passport was issued, when it expires and how it is revoked.
When trust has to be proved again
The model is retrained, fine-tuned or swappedLineage changes. The old passport describes a model that no longer answers.
The system prompt, tools or policy changeThe same weights now behave differently. Configuration is a page of the passport, so the passport is issued again.
The model moves to other hardware or another providerThe runtime page must come from the new machine's own evidence.
The operator or the principal changesAn agent that now acts for someone else must say so before anyone relies on it.
Training data is found poisoned, or a licence is withdrawnEvery model with that data in its lineage needs a decision: keep, retrain or revoke.
What we deliver
- A passport design for your model or agent: which claims, who signs each one, how a counterpart verifies them.
- The chain behind it, from training and fine-tuning through build to the attested runtime, on open standards: model signing, AI bills of materials, build provenance, remote attestation, workload identity.
- A verifier your customers, partners and other agents can run, and rules for renewal and revocation.
- A mapping to the documentation duties of the EU AI Act, so the passport is evidence for the file you have to keep anyway.
Questions worth answering
- Can a customer tell which model version, with which system prompt, answered them?
- Can you prove a fine-tune started from the base model you name?
- If a dataset is withdrawn tomorrow, which deployed models carry it?
- Does the other side of a transaction know who your agent acts for?
Across the life cycle
DesignBuildMake or deployOperateUpdateRetire
The stage that decides here: build. Lineage is fixed when a model is trained and tuned. If the build stage records nothing, no later stage can recover it. See attestation in the product life cycle.
Rules and standards your buyers cite
EU AI ActDORACyber Resilience Act
Industries that use this
Healthcare and medical dataPharma and life sciencesLegal services and digital trust
Use case
A private inference service sold to a bank · An AI agent that calls tools for an enterprise
Go deeper
Who builds in this area
From our public landscape: OpenSSF Model Signing, Sigstore model-transparency, CycloneDX ML-BOM, SPDX AI, C2PA, Coalition for Secure AI, Hugging Face model cards, Solid.
The problem statement owes much to Bruce Schneier's essays on AI and trust. His argument: trust in AI has to be the kind we give institutions. It has to rest on facts that can be checked, and integrity matters most. In his words, "If we want trustworthy AI, we need trustworthy AI controllers." Read AI and Trust and Building Trustworthy AI Agents. A passport records what was declared and what was measured. It does not certify that a model is fair, safe or correct.
Not quite your case? Running models for customers? Attested AI. Agents that act for someone? Attested AI agents.
Working on AI passport? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.
Concepts: Re-attestation · Continuous attestation · Remote attestation · IETF RATS architecture