Evidence Collector: Your Agent’s References Will Be Checked

Press enter or click to view image in full size

The diagram shows how records from identity, attestation, authorization, and runtime systems are correlated within an agent execution.

It connects five elements: the human principal, agent identity, hardware key, authorization decision, and governed capability.

An ID-JAG carries the human identity and delegated authority. A JWT-SVID carries the agent’s SPIFFE identity. Attestation binds the agent’s key to an appraised platform, while DPoP demonstrates possession of the corresponding private key. The PDP records authorization decisions. The PEP and target record invocations and observed effects.

Records are correlated using two values:

trace_execution_id identifies the execution.
execution_authority scopes that identifier.

In Janssen Project, Jans Auth Server creates the execution_authority when it opens an execution — either when redeeming an ID-JAG or on an autonomous agent’s first token request.

Its value is the server’s configured execution-authority identifier, defaulting to its OAuth issuer URL. For example:

{
  "trace_execution_id": "exe_01J9...",
  "execution_authority": "https://op.example.org"
}

It identifies the authority that allocated the execution ID, so the pair uniquely identifies the execution within that authority’s namespace.

Producers include this pair in signed TRACE records submitted to the evidence Collector. Enrollment and attestation records can support multiple executions, so execution records reference them through explicit parent links.

The shared identifier groups records belonging to an execution. It does not establish that an authorization decision, invocation, and effect describe the same operation. That requires additional bindings between the evaluated request, invoked operation, and result.

The evidence Collector preserves producer assertions and correlates the records. An execution view can therefore include the delegation, credential, platform assessment, authorization decision, and runtime observations, with each fact attributed to its producer.

Think of the evidence Collector as a Git history for an agent execution: attributed records with explicit links. A signed commit identifies its signer and protects its contents; it does not prove the code worked. Runtime evidence still has to come from the systems that observed the result.