The short definition
Agent attestation binds an AI agent to a verified legal entity. An attestation is a signed, revocable credential asserting three things at once: which organisation operates this agent, that the organisation has been independently verified, and what the agent is permitted to do. Any counterparty can check it before answering a single question.
The word matters because the alternative is assertion. An agent that introduces itself as agent@meridian-bank is making a claim about its employer in exactly the way an email address does — which is to say, not very convincingly. Attestation replaces the claim with something checkable.
Why an endpoint is not an institution
The Model Context Protocol made it trivial for an agent to call an external system. It deliberately says nothing about who is on the other end. An MCP server presenting itself as a bank, an insurer or a government agency is a URL and a TLS certificate, and a TLS certificate proves control of a domain — not that the operator is licensed, regulated, or who they say they are.
For an internal tool that gap is tolerable, because you own both ends. The moment an agent starts negotiating across a corporate boundary, three questions become unavoidable:
- Identity. Is this counterparty the institution it claims to be, or someone who registered a convincing domain?
- Entitlement. Even if it is that institution, is it permitted to receive this class of data, for this purpose, in this direction?
- Evidence. When the outcome is disputed months later, what record exists that anyone outside the two parties would accept?
Attestation answers the first, and makes the second and third possible. You cannot enforce a policy about a counterparty you cannot identify, and you cannot produce evidence about a conversation whose participants were never established.
What actually gets verified
An attestation is only worth the checks behind it. Self-service registration produces a credential that proves someone filled in a form. On MCPLayer, an organisation passes four distinct checks before anything is issued:
- Legal entity verification. The registering organisation is matched to a real, current registered company — not a trading name or a shell.
- Domain control. Proof that the organisation controls the domain its agents will present under, so identity and namespace cannot be separated.
- Regulatory licence verification. Where the vertical requires a licence to do the thing the agent will be doing, that licence is checked against the issuing register.
- Key custody. Keys are issued per organisation and rotated, so an attestation can be re-anchored without re-verifying the entity from scratch.
Only then is a cryptographic attestation issued and bound to the organisation's published MCP endpoints. When your agent connects, it checks that attestation rather than a hostname.
Attestation, authentication, certification
These three get used interchangeably and mean quite different things. The distinction matters when you are writing a control description for a risk committee.
| Term | Answers | When it is checked |
|---|---|---|
| Authentication | Does this party hold the credential? | At connection |
| Certification | Did this organisation have a governance process at audit time? | Annually, retrospectively |
| Attestation | Is this specific agent operated by this verified entity, in this scope, right now? | Every exchange |
Certification tells a regulator your processes existed last June. Attestation tells a counterparty what is true about this agent during this message. Both have a place; only one of them is checkable at runtime by the party taking the risk. See agent-to-agent authentication for how the credential is actually presented and checked on the wire.
What an attested exchange looks like
Attestation is not a badge on a directory listing. It is a check that runs inline, before the payload, on every exchange:
Note the ordering. Identity is established for both parties, then policy is applied, then the exchange happens, then it is recorded. A design where the payload moves first and is reviewed afterwards is not attestation; it is logging.
Revocation is the whole point
A credential that cannot be withdrawn instantly is a liability dressed as a control. The value of attestation is not that it can be granted — it is that when an agent is compromised, decommissioned, or simply exceeds what it should be doing, it loses access across every counterparty at once, without needing each of them to act.
This is the practical difference from API keys shared between organisations. Rotating a shared key means coordinating with everyone holding it. Revoking an attestation is a single operation whose effect is immediate and network-wide, because every counterparty is checking centrally at exchange time rather than trusting a secret they were handed once.
Where attestation meets regulation
Attestation is not mandated by name anywhere yet. What regulators do require, increasingly explicitly, is that you can establish who you are dealing with, constrain what a system may do, and evidence both — which is what attestation supplies.
Australia
APRA treats the existing prudential suite as already covering AI conduct, and ASIC's REP 798 found third-party vendor management to be a common weakness. Neither is satisfied by a counterparty you configured and trusted. Detail on APRA, ASIC and AI agents.
European Union
If your agents exchange with EU counterparties, the timing is worth getting right, because a lot of published commentary has it wrong:
- Live since 2 August 2026: the Act's transparency duties under Article 50, and the AI Office's enforcement powers over general-purpose AI providers. Systems already on the market before that date got a grace period to 2 December 2026 for the content-marking obligation specifically.
- Deferred: the high-risk obligations. Following the Digital Omnibus amendments agreed in June 2026, stand-alone Annex III systems — which include credit scoring — moved to 2 December 2027, and high-risk AI embedded in already-regulated products moved to 2 August 2028.
Credit scoring sits in Annex III, so a bank deploying agents into lending decisions has more time on the high-risk duties than early commentary suggested. It does not have more time on transparency, and it never had any relief from the obligation to know who its counterparties are. Attestation addresses the second, which no deadline moved.
The general pattern across both jurisdictions is the same one that motivates this whole page: certification proves a governance process existed at audit time, and attestation proves what is true of a specific agent during a specific exchange. Regulators are asking for both, and only the second is checkable at runtime by the party carrying the risk.
How this fits with MCP
Attestation does not replace MCP or compete with it. MCP is how an agent talks to a server; attestation is how two organisations decide they are willing to let their agents talk at all. You keep the MCP servers you already run, bind them to your organisation's attestation, and declare the data classes and scopes they expose.
If you are currently evaluating gateways to solve this, the distinction worth being precise about is internal versus cross-organisational — covered in MCP gateway vs trust layer.
Is agent attestation a standard?
Not yet a ratified one. Governance and identity are the acknowledged gaps in the current generation of agent interoperability protocols — MCP and A2A both describe how agents communicate, not how organisations establish trust in each other. Several efforts are converging on attestation as the answer, and MCPLayer's founding cohort shapes the schema and policy vocabulary directly.
Does attestation slow every exchange down?
The check is inline but cheap — a signature verification and a policy evaluation, not a round trip to a human. The relevant comparison is not against an unverified API call; it is against the phone calls, emails and PDFs the workflow uses today because nobody could safely automate it.
What happens if a counterparty's attestation is revoked mid-conversation?
The next exchange fails the identity check and is refused. Exchanges already sealed to the audit ledger remain valid evidence of what was true at the time — which is precisely why the record captures the attestation state per exchange rather than assuming it for a session.