NHID-Clinical v2: Cryptographic Agent Identity

v1.3 establishes disclosure and audit. v2 adds the missing piece: a way to cryptographically verify that an AI agent is actually authorized by the provider it claims to represent.

Status: Reference implementation complete. Spec and test suite in development. No production deployments yet. Target release: August 2026.

Where v1.3 Ends and v2 Begins

Capability	v1.3 (current)	v2 (planned)
Identity disclosure	✅ Behavioral (spoken)	✅ + Cryptographic (signed)
Provider authorization	❌ Not verifiable	✅ Ed25519 delegation chain
Revocation	❌ Not supported	✅ HTTP revocation list
Audit trail	✅ Structured event logs	✅ + Passport ID in every log
Suitable for	Shadow pilots	Production deployments

What's Coming in v2

Agent Passport System (APS)

Ed25519-based cryptographic identity for AI agents. Each agent has a key pair. Providers sign a delegation granting the agent specific scopes (e.g., eligibility, claim_status). Based on IETF draft standards.

Delegation Chains with Scope Attenuation

A provider authorizes an agent with limited permissions. The agent cannot exceed its granted scope. Delegations have explicit TTLs — a 24-hour delegation cannot be replayed the next day.

Revocation Lists

Compromised agents can be revoked immediately. Payers check a simple HTTP endpoint before accepting a passport. No central registry required in v2 — each provider hosts their own revocation list.

Call Integration

Passport tokens delivered via DTMF or SIP headers — no change to the voice interaction itself. The payer's system validates the token out-of-band before the call proceeds to data exchange.

Reference Implementation

The core identity module is already written and tested. Four passing tests covering key generation, delegation + verification, expiry, and revocation:

git clone https://github.com/NHID-Clinical/NHID-Clinical.git
cd NHID-Clinical
pip install -r requirements.txt
python -m pytest tests/ -v

# Expected output:
# 173 passed, 18 skipped in ~1.4s

Source: src/agent_identity.py

Timeline

Month	Milestone
May 2026	Reference implementation complete — `src/agent_identity.py`, 173 passing tests
July 2026	Full v2 spec + expanded conformance test suite
August 2026	Demo + first payer pilot integration
Q1 2027	v2 release — production-ready with cryptographic identity

← Pilot Guide · v1.3 Spec · Five-layer trust architecture →

Get involved

Read the proposal and share your reaction.

Whether you think it is right, wrong, incomplete, or misses the real problem — that feedback is what shapes the next version.

Join the Discussion →