Most teams are trying to secure AI agents with controls built for people and for servers. Neither fits. A person signs in once and a human watches the session; a server has a fixed address and a long life. An agent is neither: it is software that acts on its own, can be copied in seconds, and borrows a key to do its work. To govern agents you need a model made for agents.
Oathera organizes agent identity around four moves. We call it the OATH model: Own, Approve, Tether, Hold to account. Each move answers a question a security team actually asks.
Own: an identity of its own
An agent should not borrow a key. At enrollment, the Identity MCP creates an Ed25519 anchor key on the agent's own host and computes the key digest; that digest is the agent's identity. The key is made where the agent runs and is bound to that host, so a copy of the agent on another machine is a different thing, not the same identity. Copy an agent and you get the same code with a different fingerprint.
Approve: a named person stands behind it
Nothing runs on an unapproved identity. A principal signs in at the company's identity provider with OIDC and PKCE, sees the requested and granted clearance, and approves the enrollment. A named, verified sponsor, checked against the company's proofing sources, answers for the agent. Approval is recorded in the enrollment record, so every agent traces back to a person.
Tether: bound to what it may do
An approved identity still needs limits. The Gateway MCP sits in front of your tools and, on each enforced call, asks the identity service for a signed, single-use boundary decision that checks the agent, its principal, its permitted services and its clearance. An agent holds the lower of its requested clearance and what its evidence supports, where evidence is graded self-reported, corroborated or verified. The tether travels with the call, not with a static policy that drifts.
Hold to account: a proof on every call
The identity token lasts 120 seconds by default and names a session key held only in memory. Every operation carries a single-use operation proof signed with that session key over the operation, its arguments and the token. A replayed or tampered proof is refused. The identity service keeps a hash-chained audit log, with credential-like values replaced by a correlation ID, signed seals, chain verification and export exactly once to a SIEM or write-once store, and one audit event per Gateway MCP call. You can show what each agent did, and prove it later.
How Oathera helps
Oathera gives every AI agent an identity bound to the machine it runs on, approved by a named person, and checked every time it acts. The four moves are not a framework to adopt by hand; they are what the Identity MCP, the Gateway MCP and the identity service do together. Oathera works with your identity provider and does not replace your IAM or AI governance; it is the identity layer under them. It does not verify people, judge model output or rewrite prompts.
See it, or build it with us
Watch a stolen token fail, a replayed proof get refused and a tampered call get caught, in the simulator at sim.oathera.org. Our first design partners start in early November 2026. If you are putting agents into production, become a design partner.
Every AI agent, sworn in.