What is an agent passport, and why is identity alone never enough to trust an agent?

What is an agent passport?

An agent passport is a portable identity credential for an agent. It travels with the agent across tools and platforms and states, in a form others can check, who operates the agent and what the agent may do. Think of it as the identity page, not the whole file. It answers who is this and who stands behind it. It does not, on its own, answer whether this agent does good work.

Scope, stated once: an agent receipt is a record of one ai agent tool call that anyone can check: it keeps the exact saved bytes and their sha-256 digest, and it proves the result was not changed since it was saved, not that it was right.

What a useful passport should bind

• Who operates the agent. A named person or organisation that can be held to account for what the agent does, not just a handle created five minutes ago.
• What the agent may do. Its scope: which tools, which systems, which spending or action limits. An identity with no stated scope tells you almost nothing about risk.
• How to check it. A credential nobody can verify in the moment, at the point of use, is decoration. The check has to be cheap, public, and repeatable.

Identity standards such as ERC-8004 work on exactly this layer: a registry identity for agents that other systems can reference. The hub covers that layer in depth on its ERC-8004 agent identity page and its ERC-8004 validation registry page. Those are sibling pieces to this one: identity there, work record here.

Why identity alone is not enough

A passport can be perfectly valid and the work can still be poor, late, or quietly edited after delivery. Identity tells you who showed up. It says nothing about what they did on the day, on your task, with your files. That gap is where most agent trust failures actually live: not fake agents, but real agents whose work nobody can check.

The work record is what makes an identity worth trusting. Receipts for each call, a verification history that anyone can rerun, and handovers that carry the record forward: that history, attached to the identity, turns a credential into a track record. AER-1, the IETF Internet-Draft draft-zambo-aer1-26, specifies the receipt format for that record. Zambo, the verifiable work layer for AI, issues an AER-1 receipt on every call across 153 tools, 35 on the default surface, through one MCP endpoint at https://zambo.dev/mcp.

Put plainly: trust the passport to tell you who, and the receipt stream to tell you what actually happened. You need both, and the second is the one people skip.

Worked example: the work record behind an identity

From the public stream on October 25, 2026: a write call saved at 2026-10-25T18:35:38Z, receipt at zambo.dev/run/a4f6103d-35be-4bc5-885b-d032408e4471, saved result digest sha256:5731eb786850933accfdafafb62619ea6602b34e99a9a792a238f1b86a6970b0.

The verification endpoint returned verified for this receipt. Anyone can rerun that check free at zambo.dev/verify. A stack of receipts like this one, tied to one agent identity over time, is a history you can audit. A passport with no such history behind it is a claim waiting for evidence.

How passports, receipts, and HANDOVER fit together

The passport identifies the agent. Receipts record its work, call by call. HANDOVER, Zambo flagship product, carries the open work, its context, and its receipt record from one agent or session to the next, so trust built in one place does not evaporate at the switch. Start building that record at zambo.dev/add with 20 free calls per day. Day Pass $0.99 USDC on Base for 24h for a heavy day; Zambo Pass $29 for 30 days, one payment, annual $290, for ongoing work.