Security is not a posture here — it is a set of checks with names. For every realistic attack on an agent identity, the defense lives at a specific enforcement point in the code, and a test pins the behavior. Each attack below, and the mechanism that defeats it.
Every attack has an address in the source — the exact function where it fails.
The token points at a document the agent never authored.
Re-hash the fetched document and require equality with the committed hash. A wrong document fails at the pivotal gate, always.
verifyAgainstAnchorAn off-chain cache or indexer serves an altered record.
Every fetched byte is re-hashed against the on-chain commitment before reliance. Convenience never becomes authority.
aidContentHashA version claims a false predecessor to erase or alter its past.
Each link is recomputed and the genesis-root constancy is checked. A broken or forged link stops the walk.
verifyChainAuthority seized by acquiring or stealing the token.
The token is non-transferable; authority vests in the recorded controller, never in whoever holds custody. Seizing the token seizes nothing.
FA2_TX_DENIEDAn identity outlives the authority that once justified it.
Expiry, rotation, and offboarding are explicit; an offboarded-but-active identity is rejected at an explicit instant.
effectiveStatusA record silently weakens its key custody or assurance level to slip under a policy.
Assurance carries IAL/AAL/FAL plus key custody; a one-notch downgrade is rejected against a relying party's required floor.
strictVerifyThe token could point anywhere and a gateway could serve anything. So the bytes are always re-hashed against the on-chain commitment — transport is untrusted by construction.
Nothing is trusted transitively. Anchor confirms version; hash confirms bytes; signature confirms authorship; status confirms liveness. Break any link and the chain stops.
No score, no reputation, no balance to farm. The verdict is recomputed from scratch every time, from artifacts anyone can independently check.
An under-specified reliance rule is an exploit waiting for an implementation. We treat specification ambiguities as vulnerabilities, not just code defects. Report privately and we will acknowledge, investigate, and credit disclosures that follow a coordinated timeline.