WISeID Keystone · Agent Identity & Control

Identity and trust
for the agents
that act for you.

AI agents are starting to call APIs, read calendars, write code, and move money. WISeID Keystone is the identity, permission, and audit layer that decides which agents are real, what they're allowed to do, and who said so — backed by 25 years of WISeKey PKI.

Now in private beta Standards: X.509 · OAuth2 · mTLS · OIDC
iD agent.a agent.b agent.c agent.d KEYSTONE · IDENTITY · POLICY · AUDIT
Built on open standards X.509 OAuth 2.0 OpenID Connect mTLS · TLS 1.3 RFC 8705 PQC-Ready
The problem

Agents have no identity.
No policy. No accountability.

Frameworks like MCP let agents call tools. They don't answer who is calling, on whose authority, or what actually happened. That gap is where credentials leak, blast radius grows, and trust breaks down.

Keystone is the wedge stone at the apex of the arch. Remove it, and the structure collapses.

Every other stone leans on it. The same is true of agent trust: without a verifiable identity, a named delegation, and a provable record, every control above it falls. These are the six load-bearing gaps Keystone closes.

01 / IDENTITY

Is this a real agent, or an impostor?

Servers have no way to verify the agent calling them. A stolen API key or a spoofed client looks identical to a legitimate one.

The load-bearing gaps
  • No verifiable agent identity
  • No server authentication
  • No revocation
02 / PERMISSION

What is it actually allowed to do?

Broad OAuth scopes hand agents more access than they need. Users can't see which agent can use which account, and policies live in scattered dashboards.

The load-bearing gaps
  • No delegation model
  • No credential opacity — agents hold the keys
03 / ACCOUNTABILITY

What did it do, and can you prove it?

Logs are fragmented, missing context, or entirely absent. When something breaks, no one can reconstruct the chain from human intent to final action.

The load-bearing gaps
  • No tamper-evident audit trail
The business problem: security teams in finance, healthcare and legal are currently blocking AI agent deployments — not approving them — because none of these controls exist. Keystone is what unblocks them.
How it works

Four checkpoints. One keystone.

Every agent call passes the same four checkpoints — identity, authorization, execution, audit. The keystone locks them into one system. Scroll to build the arch.

Begin

An empty arch.

Foundations only. Scroll, and the controls that make an agent trustworthy lock into place, one stone at a time.

SCROLL TO BUILD ↓
STONE 01

Identity

The agent connects with a Keystone-issued JWT or X.509 certificate. Its waap:// URI is verified in the token's sub claim — no password, no static API key, no shared secret.

KEYSTONE IDENTITY · JWT / X.509 · waap:// VERIFIED
STONE 02

Authorization

A human principal grants the agent a scoped, time-bound delegation per service and operation. Sensitive executions additionally require per-request human approval before anything proceeds — human-in-the-loop at two levels.

DELEGATION · ABAC · PER-CALL APPROVAL
STONE 03

Execution

The Control Plane injects the downstream credential at the transport layer and runs the call. The agent sees the result — never the key. Out-of-scope attempts are blocked before they leave.

HTTP + MCP EXECUTORS · ZERO CREDENTIAL EXPOSURE
STONE 04

Audit

Every operation — granted, executed or denied — is written to an append-only, hash-chained log with full attribution. Cryptographic non-repudiation, exportable as a signed evidence pack for DORA, NIS2, SEC and HIPAA.

HASH-CHAINED · TAMPER-EVIDENT · AUDIT-PACK EXPORT
The keystone

Keystone

The four stones are the controls. The keystone is what turns them into a system — binding verifiable identity, human-authorised delegation, credential-opaque execution, and tamper-evident audit into one load-bearing whole. Remove it and the arch falls; lock it in, and agent trust finally stands.

WISEID KEYSTONE · THE STONE THAT LOCKS THE ARCH
The detail
How Keystone works

One platform.
Three trust flows.

Every agent call passes through the same pipeline: authenticate → authorize → execute → audit. Credentials never reach the agent. Every action is hash-chained.

AGENTS Claude Desktopwaap://acme/agents/desk Autonomous Agentwaap://acme/agents/rpa Browser Agentwaap://acme/agents/web Custom Agentwaap://acme/agents/* WISEID KEYSTONE iD 01 · KEYSTONE IDENTITYVerifiable agent identityX.509 · OAuth2 · PKI 02 · KEYSTONE CONTROL PLANEPolicy, execution, auditABAC · Vault · Hash-chain 03 · CONSUMERPersonal trust & approvalsLinked accounts · Consent UI SERVICES & ACCOUNTS MCP Serversgithub / slack / drive REST APIssalesforce / stripe Personal accountsgoogle / microsoft Internal APIsmTLS · OAuth2 ① AUTH · mTLS + Bearer ② POLICY · ABAC + Delegation ③ EXECUTE · Inject & audit
Agent authentication (mTLS / Bearer) Downstream credential (injected, never exposed) Hash-chained audit (append-only)
Three components · one platform

The Keystone stack.

Each component stands alone and composes with the others. Deploy Keystone Identity to issue identity. Add the Keystone Control Plane for policy and audit. Plug in the Consumer layer for individuals.

01
X.509 · AGENT CERTIFICATE CN = data-fetcher.agents SAN URI waap://acme/agents/fetcher Valid · 365d · RSA-2048 · SHA-256
01 · Keystone Identity

Identity you can verify.

PKI for AI agents

Issue cryptographic identities to every agent and service. Short-lived X.509 client certificates, OAuth2 tokens, and a trusted root chain — the same pattern that secures the airline cargo network.

  • mTLS-first authentication with SAN URI identity
  • Two-tier CA · CRL & OCSP · instant revocation
  • RFC 8705 mTLS-bound access tokens
  • SPIFFE federation — every waap:// identity is also a deterministic spiffe:// peer for SPIRE / Firefly / Teleport
  • Crypto-agile & PQC-ready (FIPS 203 / 204)
Learn about Keystone Identity
02
REQUEST POLICY EXECUTE AUDIT · #9e2a #7b11 #42ff #c310 VAULT · principal-scoped credential
02 · Keystone Control Plane

Policy before execution.

Authorization, audit & mediation

The mediator between agents and everything they try to touch. ABAC policies, delegation, credential injection, and a hash-chained audit log — so credentials never reach the agent, and every action is provable.

  • Six MCP tools over Streamable HTTP with OAuth 2.1 Resource Server discovery
  • Attribute-based policy & time-bound delegations
  • Credential vault · zero-exposure injection
  • Human-in-the-loop approvals for sensitive calls
  • Audit-pack export — signed evidence bundle + keystone-audit-verify CLI runs offline
Learn about Keystone Control Plane
03
APPROVAL REQUIRED Travel Assistant wants to: send an email from alice@example.com Approve Deny
03 · Consumer

Control your agents.

Personal trust layer inside My WISeID

Connect Google, Microsoft, GitHub, Slack, Notion, Dropbox. Decide which agents can use which account, set approval rules, and revoke in one tap — all from the WISeID portal and mobile app you already use.

  • Verified agent directory & trust tiers
  • Per-agent, per-account permission grants
  • Push approvals via My WISeID mobile app
  • Plain-language activity history & instant revoke
Learn about Consumer
Capabilities

What you get, day one.

Engineered on standards. No proprietary crypto. No vendor lock-in on the agent side — any MCP or REST client works.

Short-lived identities

Agents: 365-day X.509 certs. Servers: 90 days. OAuth2 tokens: 30 minutes. Limited blast radius by default.

Zero credential exposure

Agents never see downstream tokens, keys, or certs. The Control Plane injects at the transport layer and zeroes memory.

Hash-chained audit

Every request, approval, and execution is cryptographically linked to the prior entry. Tamper-evident by construction.

Time-bound delegations

Permission grants expire by default. Renewals are explicit. Revocation propagates in seconds across active sessions.

MCP-native

Six first-class tools agents call directly: request, execute, check_approval, audit, and more.

Human-in-the-loop

Mark any operation as requiring approval. Principals get a plain-language prompt on the web, email, or My WISeID mobile push.

Federated principals

Plug in your existing IdP — Entra, Okta, Ping — for enterprise; WISeID OIDC for consumer. Agents & users stay separate by design.

Crypto-agile & PQC-ready

Algorithm is a runtime parameter. Dual-stack JWKS ready for ML-DSA (FIPS 204), hybrid TLS with X25519+ML-KEM768 on the roadmap.

Deploy how you want

Hosted SaaS, self-managed on Kubernetes, or sovereign cloud. Same codebase; same standards; same audit semantics.

Who it's for

Three audiences.
One trust layer.

Keystone is neither a consumer toy nor an enterprise monolith. It's the same architecture repackaged for every place an AI agent can go.

For CISOs & Platform Teams

Enterprise security

"Every agent in my org has a verifiable identity and a policy. Every call is audited. Revocation is instant."

  • Enrol agents at scale via REST + HSM-backed CA
  • Bring your own IdP · SSO · RBAC
  • Export audit to SIEM · JSON & CSV
  • Federation gateway for partner org trust
CISO · IAM lead · Security architect
For Agent Builders & Developers

Agent platform

"I ship an MCP server or an autonomous agent and let Keystone handle identity, secrets, and permission."

  • Python, Node, Go SDKs — enrol with one call
  • MCP playground & test harness included
  • Publish to the verified agent directory
  • Developer plan · sandbox · staging PKI
Platform engineer · MCP server author
For Individuals & Households

Personal control

"I know which agent can read my calendar, which can email my clients, and I approve what matters."

  • Connect Google, Microsoft, GitHub in one flow
  • Per-agent approval rules · plain-language
  • Revoke in one tap · no provider hunting
  • Inside the WISeID portal you already use
WISeID account holder · family organiser
Trust & standards

Built on protocols,
not promises.

Keystone is assembled entirely from open, audited standards. No proprietary cryptography. No closed formats. No hidden trust anchors.

X.509 v3 TLS 1.3 · mTLS OAuth 2.0 OpenID Connect RFC 8705 OCSP · CRL PKCS #11 v3 FIPS 203 ML-KEM FIPS 204 ML-DSA JOSE / JWS / JWT
1999

Backed by 25 years of WISeKey PKI.

WISeKey has operated commercial certificate authorities, root-of-trust services, and identity infrastructure since 1999 — for governments, enterprises, and critical infrastructure. WISeID Keystone brings that same rigor to AI.

25+Years in PKI
SwissSovereign roots
PubliclyTraded (NASDAQ: WKEY)
ISO 27001Certified operations
Keystone extends — it does not rebuild
KYC-backed identityReal persons bound to verified digital credentials.
PKI Trust CenterThe CA hierarchy AgentID chains to.
WISeID OIDCSSO and the consumer login — no new account.
Encrypted vaultAES-256 personal vault, already in production.
My WISeID appReused for agent-approval push — no new app.
The trust foundation comes free — no competitor starting from scratch has it.
Us vs the field

The diagonal no one else can hold.

The 2026 agent-identity market is forming around five camps that overlap. Keystone sits at the intersection of three of them — and is the only platform that scores full marks across the entire architectural diagonal. No competitor lights up the whole column.

A · Workforce / CIAM IdPs — Entra, Okta, Ping
B · Workload / NHI / secrets — Akeyless, CyberArk
C · Privileged access / PAM
D · Identity-aware proxies — Teleport, RunLayer
E · Hyperscaler control planes — AWS AgentCore
Strong / shipped Partial / via workaround Absent / not in scope
Source · Keystone competitive analysis · 2026

One column. Full marks.

Keystone is the only player scoring three dots across the diagonal of PKI identity · MCP control plane · credential injection · per-call approval · tamper-evident audit · vendor-neutral · on-prem · dual delegation · PQC roadmap. The deficit rows — pre-built connectors, brand reach, pricing model — are real, and every one of them is addressable with execution and partnerships, not architecture.

Development roadmap

In beta now · full platform by Q4 2026.

Seven phases from working proof-of-concept to a sovereign, on-premise, post-quantum-ready platform.

PHASE 0
Q2 2026

MVP

Software CA · registries · OAuth2 · MCP server · basic ABAC · executors.

✓ DELIVERED
PHASE 1
Q2–Q3 2026

Foundation

HSM-backed CA · full ABAC · production vault · consent UI.

▶ YOU ARE HERE
PHASE 2
Q3 2026

Full Platform

mTLS-bound tokens · hybrid PQC TLS · multi-org SaaS v1.

PHASE 3
Q3–Q4 2026

Enterprise Auth

Full OIDC + PKCE · Keycloak broker · enterprise UI federation.

PHASE 4
Q4 2026

Keystone Consumer

My WISeID integration · agent directory · pre-built integrations.

PHASE 5
Q1 2027

On-Premise

Helm / Terraform packaging · multi-tenant isolation · SOC 2 Type II.

PHASE 6
Q2 2027

Ecosystem

DID/VC interop · blockchain audit anchoring · agent-to-agent delegation.

Frequently asked

Questions, answered.

Short, specific, and honest — including what Keystone doesn't do.

How is Keystone different from an API gateway or SSO provider?
API gateways authenticate traffic; SSO authenticates people. Keystone authenticates agents — autonomous software acting on behalf of a human — and mediates what they're allowed to do under a named delegation. It complements your gateway and IdP, it doesn't replace them.
Do agents need to be written against a new protocol?
No. Agents keep using MCP, OpenAPI, or whatever transport they already speak. They authenticate once to the Keystone Control Plane (over Streamable HTTP with OAuth 2.1) using a Keystone Identity–issued credential and call the six wiseid_* tools; the rest is invisible.
Can I run it on-prem or in a sovereign cloud?
Yes. The Keystone Control Plane is packaged as Docker / Kubernetes; Keystone Identity runs alongside with HSM or SoftHSM support. Phase 3 adds multi-region HA and federation. All WISeID components are certified for sovereign deployment.
What happens to agent access if a credential is compromised?
Revoke the agent in the dashboard (or via POST /revoke). The CRL updates immediately; the Control Plane evicts every active session for that agent; downstream calls fail fast with a structured error — not silently.
Is the consumer version a separate product?
No. It's the same architecture, accessed from the existing My WISeID portal at wiseid.com. Users who already trust WISeID for certificates, signing, and their encrypted vault get the agent permission layer as an integrated feature — no new account, no new app.
What's the post-quantum story?
Cryptographic agility is a design principle. The CA, JWT layer, and Credential Vault are parameterized so algorithms are runtime configuration, not hardcoded. Phase 2 targets hybrid TLS (X25519 + ML-KEM768) for executor mTLS — the highest HNDL-risk path — and dual-stack JWKS for ML-DSA signatures.
How is audit tamper-evidence handled?
Every audit entry carries the SHA-256 hash of the previous entry. Any modification invalidates the chain from that point forward. Audit is append-only at the storage layer and can be periodically anchored to an external notary — and exported as a signed pack the keystone-audit-verify CLI checks offline.
Talk to us

Give your agents
a name, and a leash.

Keystone is in active private beta with WISeKey partners. We're onboarding the next cohort of early-access partners now — enterprises, agent builders, and integrators. Partners get hands-on beta access, a direct line to the engineering team, and a real say in the roadmap.

Request early access Read the spec