Held, Not Issued

A bearer token is a confession waiting to happen. The name says it plainly: whoever bears it, is you. Your Personal Access Token in an agent’s environment, your service-account key in a CI runner, your session cookie in a browser extension — each one is a complete identity in a copyable string. Steal it and there is no further test to pass. The copy works exactly as well as the original, which means that once it’s stolen, nothing in any log will ever distinguish the thief from you.

Now hand one to an agent. The agent reads untrusted input all day, runs in environments you don’t fully control, and retries things in ways you didn’t predict. Every place it operates is a place your whole identity sits in plaintext, waiting.

Whoever holds it, is you

The industry has known this shape of failure for a long time — it’s the same one behind every leaked-credential postmortem. What agents changed is the blast radius and the odds. An agent with your token doesn’t just risk leaking it; it exercises it, constantly, from IP addresses and at rates that look nothing like a person. And when a supply-chain compromise lands — a build tool, an action, a dependency — the tokens standing in those pipelines are the prize. The Trivy breach in March was that story again, told at ecosystem scale.

Underneath the theft problem sits a design problem: a bearer token conflates identity with authorization. The same string is both who you are and what you may do — one artifact holding two jobs that should never have been fused. This is exactly why delegating to an agent keeps going wrong. What you want to hand over is authority: do this task, touch this repo. What the token forces you to hand over is yourself, because the two are the same bytes. You can’t revoke the authority without revoking the identity, can’t scope one without scoping the other, and when an auditor asks which was exercised, the token has no answer.

The fix isn’t a better place to hide the string. It’s pulling the two jobs apart — and that starts with an identity that isn’t a string at all.

Possession, proven

signet replaces bearer tokens with proof-of-possession: ephemeral certificates issued by a local CA, bound to a private key that never travels. Presenting the certificate isn’t enough — the holder has to prove, cryptographically, that it possesses the key. A stolen certificate is useless without the key. A stolen key is worth five minutes, because that’s the certificate lifetime; there is no renewal, they just expire.

The practical surface is deliberately boring. It signs your commits, replacing GPG with plain Ed25519 — and the algorithm is a parameter, so ML-DSA-44 is already there for the post-quantum migration rather than a future rewrite. In CI there are no standing secrets at all: a GitHub Actions run exchanges its OIDC identity for a five-minute bridge certificate, does its work, and the credential is gone before the run’s logs finish uploading. Nothing to rotate, because nothing persists.

OAuth is converging on the same instinct — DPoP exists precisely because the industry stopped trusting bare bearers — and notme adopts it in its own design record. The distinction I keep drawing on the map is whether identity is issued — a signed statement handed over, trusted because a gateway vouches — or held: a key the holder can prove possession of, trusted because the proof can’t be copied. Everything else about an identity system follows from which side of that line it sits on.

This dispatch, and no other

There’s a second break with convention, and it matters more for agents. The machine-identity industry already agrees about bearer credentials — Teleport, the incumbent in the space, issues short-lived SPIFFE-compatible certificates to every bot, CI job, and service precisely so no long-lived secret exists to steal, and now pitches that same machinery at what it calls the agentic identity crisis. The direction is right. But the unit is still the workload: SPIFFE assumes the program is the same actor across runs — one identity, automatically renewed, for whatever it does next. Agents void that assumption. The same orchestrator, model, and prompt produce different behavior every run, so the only thing an attestation can be about is the run.

APAS — the Agent Provenance Attestation Standard — makes the execution the unit of identity. Not “an agent did this,” and not even “this agent did this,” but this dispatch, bearing this certificate, at this moment. When something needs answering for later, the answer has a serial number.

And the two jobs the bearer token fused stay separate all the way down: the certificate’s signature proves who acted, the dispatch attestation proves it was authorized to act, and each claim can be checked, revoked, or audited without touching the other. That separation is what delegation needed all along — authority that travels without dragging identity behind it.

Two days

Here’s how the timeline actually ran. signet’s design dates to September — proof-of-possession, short lifetimes, the whole shape — built on the thesis that a machine acting on my behalf is not me. When Trivy was breached in March, I realized the design I already had was exactly the missing piece for agents and CI, and notme went from design document to running service in eleven days.

Two days after notme’s first commit, my own account was closed. My agent traffic, running under my own identity — the exact arrangement this whole layer exists to end — tripped enough signals that a classifier decided I was an attack. It happened while rosary was in the middle of its first overnight run. I’d been arguing that bearer-style identity fails in both directions: a thief can be you, and you can look like a thief. I did not expect to demonstrate the second half personally, within the same week.

The classifier wasn’t wrong about what it could see. That’s the point. Under held identity, there would have been something else to see: an agent with its own certificate, scoped to its dispatch, provably not me and provably authorized by me. The signal it needed didn’t exist yet, so I became the signal.

Nothing worth stealing

The bearer model made theft equal to identity, so we built an entire industry around preventing theft — rotation schedules, secret scanners, vaults for the strings. Held identity dissolves the problem instead of guarding it. A certificate that expires in five minutes, bound to a key that never leaves its holder, scoped to a single dispatch, isn’t worth stealing — there’s nothing to do with it.

You still can’t know what an agent will do. But who it was can stop being the string it happened to be carrying, and become a proof it has to keep making — five minutes at a time, one dispatch at a time.

Open source: github.com/agentic-research/signet. Ed25519 today, ML-DSA-44 when you need it.