The problem
Agentic capability tends to arrive department by department. Revenue cycle stands up an eligibility agent; the pharmacy team pilots a different vendor; a business unit inherits three more through an acquisition. Six months later nobody can answer a simple question: how many AI agents call on our behalf, and who signed off on each one?
That is not a tooling gap. It is an accountability gap — overlapping agents, inconsistent controls, and no clear owner when something goes wrong.
TrustLayer runs the same deterministic controls as the open framework — this module adds operations around them, not different rules.
What the registry tracks
| Field | Purpose | Example |
|---|---|---|
agent_id | Stable identifier for the agent across its lifetime | claims-agent-prod-001 |
organization | The entity the agent acts on behalf of, bound to its NPI | Regional provider group |
vendor | Who builds and operates the agent software | Voice-AI platform vendor |
owner | The named internal person accountable for this agent | Director, revenue cycle operations |
purpose | Why the agent exists — the business workflow it serves | Eligibility and benefits verification |
permissions | The bounded scope of actions the agent may take | ["eligibility", "claim_status"] |
expiration | When delegated authority lapses without renewal | Fixed date, re-approval required |
status | Active, suspended, expired, or revoked | active |
Why expiration is a field, not a policy
Authority that never lapses is authority nobody reviews. Registry entries carry an expiration, so continued operation requires a deliberate act by a named owner. An agent that quietly outlived its business case stops working instead of quietly continuing.
The same principle underlies NHID-Auth in the open framework: scope and expiry are signed fields inside the agent passport, so an over-broad or stale credential fails verification rather than depending on someone remembering to revoke it.
Illustrative entry
Illustrative registry entry — not live product data.
Related
Identity is the input to enforcement and to evidence.
TrustLayer by NHID-Clinical is in active development. It is not an accredited standard, a certification, or a regulatory compliance guarantee. The open framework it enforces remains free under CC BY 4.0 and is never gated behind a plan.