Agentic message security · standards-aligned

Compliance: the guidance, mapped to running code

On April 30, 2026, CISA, NSA and the Five Eyes published “Careful Adoption of Agentic AI Services.” Every requirement maps to something Rootz already runs — on both sides of every agent.

The guidance asks for message integrity between agents: cryptographic identity, short-lived credentials, zero trust, encrypted communications, attestation-backed tokens. That is exactly the Rootz primitive — signed, durable, verifiable messages — applied to how humans talk to AI (Proof of Origin) and how AI talks to services (Signed MCP).

Five Eyes requirement → Rootz implementation

Five Eyes requiresRootz implementationStatus
Cryptographically verified identityBirth certificate on Polygon. secp256k1 ECDSA. TPM-bound keys.Live
Short-lived credentials, JIT provisionedSession tokens (5–60 min TTL). Desktop V6 issues and revokes.Live
Zero trust between agentsEvery MCP call policy-checked. No implicit trust from co-membership.Live
Replace persistent API keysWallet-based OAuth (epistery challenge/sign/verify). No bearer tokens.Live
Encrypt inter-agent communicationsECDH + AES-256-GCM. Post-quantum: ML-KEM-1024 + ML-DSA-65.Live + PQ
Attestation-backed tokensTPM-bound key derivation. Hardware root of trust. Desktop as HSM.Live
Agent identity lifecycleProvisioning at spawn, scope binding, revalidation, automatic revocation.Live
Signed, fresh, context-bound tool messages (NSA MCP notice)Signed MCP: every response + tool definition signed with nonce, bounded-window timestamp, and context binding. Anti tool-poisoning.Live

ed25519ecdsa-p256ml-dsa-65 · FIPS 204ML-KEM-1024 · FIPS 203RFC 8785 (JCS)DKIM-style discovery

The gap everyone else has

The guidance says agents need cryptographic identity — but the common answer to “where does the root key live?” is “the infrastructure gives you one” (a SPIFFE issuer, cloud IAM, a vault). That recreates a central policy engine as a single point of failure.

Our answer: the key lives in the owner’s hardware (TPM). No central issuer, no infrastructure dependency. Sovereign — and the same root signs both the human’s prompt and the service’s response.

Verify it, don’t take our word

Signed MCP is live and checkable right now:

Open the Signed MCP page →  ·  GET /sign-demo   POST /verify   JWKS

Primary sources: Five Eyes guidance (CISA) · NSA MCP Security notice · Pope Leo XIV, Magnifica Humanitas