Certifier: The Ambient Attestation Engine
Certifier is a language-agnostic, zero-trust envelope for verifying every action an autonomous agent takes—before, during, and after execution. Think of it as a transaction ledger for infrastructure mutation: each attempted change carries an unforgeable certificate of intent, scope, and reversibility. No agent touches production surfaces without leaving a signed, verifiable receipt.
Built from the ground up as a dependency-free trust gate, Certifier reimagines the relationship between AI-driven automation and operational safety. Rather than bolting on audit logs after the fact, it weaves proof-carrying semantics into the very fabric of every mutation request.
🌐 Overview
Modern agentic systems can write code, reconfigure firewalls, push Intune policies, or adjust Kubernetes replicas—all at machine speed. The problem is not that they act quickly; the problem is that they act without a verifiable promise. Certifier solves this by requiring each proposed change to carry a cryptographic receipt that answers three questions:
- Who authorized the action? (identity attestation via ephemeral signing keys)
- What is the blast radius? (scoped resource descriptors, not free-form payloads)
- How do you roll back? (precomputed reverse operations, sealed alongside the forward action)
The engine does not block—it chains permission to provable reversibility. If an edit cannot produce a valid rollback receipt, the gate remains closed.
⚙️ Core Architecture
Proof-Carrying Envelope (PCE)
Every agent-originated change request is wrapped in a Certifier Envelope—a tamper-evident structure that embeds:
- Agent Identity Token — ephemeral, session-bound signing key pair
- Resource Scope — a parsed, normalized descriptor of what the change touches (e.g., network:aws:sg-123:port-443, code:file:/etc/nginx/conf.d/default.conf)
- Forward Action Hash — the mutation payload itself, committed to the envelope
- Rollback Blueprint — a precomputed inverse operation (e.g., revert file, restore previous ACL, reset config value)
- Validity Window — time-bound lease; after expiry, the envelope becomes void
Zero-Dependency Runtime
The attestation logic runs in a tiny, statically linked binary (under 2MB). No Python runtime, no Node modules, no JDK. The envelope format is TLV (type-length-value) serialized over a compact binary protocol, making it embeddable in CI pipelines, shell scripts, or sidecar processes.
Blast Radius Computation
Before any change is accepted, Certifier evaluates the influence set — the set of all resources that could be indirectly affected. If the influence set intersects with any blacklisted or protected resource label, the envelope is rejected at the proposal stage. The user sees a structured refusal reason, not a silent failure.
🔐 Identity & Attestation Mode
Certifier does not store long-term secrets. Every agent session generates a fresh Ed25519 keypair. The agent signs the PCE with its private half; the public half is broadcast to the trusted gate. Verification is purely asymmetric and stateless.
- No central authority — trust emerges from ephemeral pairwise agreement
- Optional multi-party countersigning — for high-risk scopes (e.g., production databases), the envelope requires N-of-M additional signatures before execution
- Clock-independent — envelope validity is checked against monotonic sequence numbers, not wall-clock time, preventing drift attacks