--- title: "Platform · The Agent Control Fabric · Highflame" description: "Every agent needs a verifiable identity, every action it takes needs an authorization decision. Highflame provides both by enforcing identity, authority, delegation, and revocation at every boundary, in real time." doc_version: "0.1.0" last_updated: "2026-07-27T05:42:48.105Z" canonical: "https://www.highflame.com/platform" --- ▸ PLATFORM # The Agent Control Fabric Every agent needs a verifiable identity, every action it takes needs an authorization decision. Highflame provides both by enforcing identity, authority, delegation, and revocation at every boundary, in real time. [Book a Demo](/contact.md) Read the white paper ## Identity answers who, Authorization answers what Two questions, answered together: who is this agent, and on whose behalf does it act, and for this action, right now, is it allowed? [PILLAR I · WHO ### Agent Identity Every agent carries a verifiable credential: owner, trust tier, framework, delegation depth, and the chain back to a named human. - Verifiable, agent-shaped credentials - Delegation & scope attenuation - Just-in-time, ephemeral access - Cascade revocation in seconds Go deeper →](#identity) [PILLAR II · WHAT ### Agent Authorization Every action (tool call, model request, A2A hop) is checked against one policy and 150+ live signals, then allowed, shaped, paused, or blocked. - One Cedar policy, every boundary - 150+ typed signals per run - Adaptive guardrails & breakout controls - Out-of-band enforcement, fail posture per surface Go deeper →](#authorization) WHY BOTH Identity without authorization is just an inventory. Authorization without identity is a guess. The fabric is both. ## Identity built for agents, not retrofitted from humans or machines Human IAM was built for users. NHI was built for services, workloads, and machines. Agents introduce a different identity problem: they act on behalf of people, delegate work, call tools, and change context over time. Highflame gives every agent a verifiable, agent-shaped credential that can be governed at every boundary. SPIFFE · WIMSE ### Agent-shaped credentials A stable, verifiable identity carrying owner, framework, trust tier, and delegation depth, not a shared key or a borrowed role. RFC 8693 ### Delegated authority An unbroken on-behalf-of chain, where an agent always holds strictly less authority than the principal that authorized it. least privilege ### Scope attenuation Permissions narrow at every hop. A sub-agent can never out-scope the agent that delegated to it. ephemeral ### Just-in-time access Short-lived, task-scoped credentials minted on demand and expired when the work is done. No standing access to leak. DPoP · RFC 9449 ### Proof-of-possession Tokens bind to a proof key, so a stolen token is inert without it. seconds ### Cascade revocation Revoke a parent and the whole delegation tree collapses with it: instantly, not at token expiry. OPEN BY CONSTRUCTION All of it ships open source as Highflame ZeroID: OAuth 2.1, SPIFFE/WIMSE, RFC 8693, DPoP. Trusted by inspection, not reputation. ## One policy, 150+ signals: decided before the action lands Agents drift, get manipulated, and chain calls no one anticipated, so a static gate won’t hold. Every action is checked in-line against one policy and a live stream of signals, out-of-band, with the fail posture you set. Cedar ### One policy, every boundary One Cedar policy, authored once, enforced across model traffic, the IDE, the tool gateway, and A2A, not three languages for three products. 30+ detectors · 150+ signals · <10 ms ### The signal engine 30+ prebuilt detectors emit 150+ typed signals per run (across prompts, tool calls, and responses), mapped to one taxonomy and fed to the policy. Detection and decision stay decoupled. runtime ### Adaptive guardrails Controls tighten as new signals and attack patterns emerge, instead of static rules someone has to keep rewriting. on-mission ### Breakout & mission drift Each agent’s mission is tracked at runtime; when it drifts or is steered off, the fabric contains or stops it before the action lands. OpenID CIBA ### Human-in-the-loop High-consequence actions pause for attributable human approval, then resume, without blocking the routine 99%. < 1 ms ### Out-of-band enforcement Enforcement sits outside the model’s control path. The engine denies unless a policy permits; a per-surface switch chooses whether unmatched traffic fails open (the default, so onboarding never blocks traffic) or fails closed. ### Tiered detection with early-exit Tier Method What it catches Fast <5 ms · rules Secrets, PII, injection, tool-risk, MCP poisoning, runaway loops. Standard 10–200 ms · ML Prompt injection, toxicity, hallucination, and intent drift, across the full session. Deep 50–500 ms · cloud DLP, content safety, phishing, and custom webhook detectors. A fast block skips the slower tiers, and a failed detector fails safe: never a false deny. ONE DECISION SURFACE Deterministic rules and probabilistic signals resolve in the same policy. Blocking an injection and pausing a drifting agent are the same kind of decision. ## Authorization is only as real as the wire it runs on The Highflame Agent Gateway is the data plane that enforces every decision: a Rust gateway for LLM, MCP, and A2A traffic that binds each request to a verifiable agent identity at the wire. Policy runs inline and out-of-band, never advisory. WIMSE · RFC 8707 ### Identity bound at the wire Every request carries a verifiable agent or NHI credential, audience-bound to the exact tool it was minted for. A token lifted from one surface is inert on another. Cedar ### Per-method scope & trust gates The gateway evaluates identity type, trust tier, scopes, and delegation depth on every call. An agent can read a tool but not invoke it, and an unverified agent never reaches a destructive method. RFC 8693 ### Delegated tokens downstream Gateway-side token exchange means each downstream tool call carries a delegated token with a provable on-behalf-of chain, so the tool sees who it is really acting for. ONE CHOKE POINT Revoke an identity and its token dies at the gateway in under a second, not at JWT expiry. One auditable choke point for every agent-to-tool call across LLM, MCP, and A2A, deployable as SaaS, in your private cloud, or fully on-prem. Run it as your gateway, or attach the fabric to the LLM and MCP gateway you already operate. Enforcement goes where your agent traffic already flows. [See the AI gateway benchmarks under load →](/benchmarks.md) ## Every decision becomes a queryable trace Built on OpenTelemetry and ClickHouse: posture, correlation, and audit you query, not logs you reassemble after an incident. ### Security posture score One decomposable score across every agent, control, and tenant. ### Cross-product correlation Identity events, detections, and decisions on one timeline: the whole run in one place. ### Blast-radius graph See what a compromised agent could reach, and what revocation just contained. ### Entity risk & drift Risk scoring on every agent identity, plus drift monitoring on the detectors themselves. ## Governance and spend, from the same policy that authorizes Every decision is already an attributable, policy-bound event, so compliance evidence and cost controls fall out of the same substrate, not a second program. ### GRC · evidence by construction Policy outcomes carry their framework mapping, so evidence is continuous, not assembled for an audit. EU AI Act · Art. 14 Demonstrable human oversight for high-risk systems: live August 2026. SEC · 4-day reporting Material incidents evidenced within the reporting window. ISO 42001 / NIST Every decision carries its control mapping: no separate program. Audit on demand Any action back to a named human, full chain, in one query. ### Cost controls · spend as a policy The same engine that authorizes an action also meters it, because fleets burn tokens at machine speed. Token-budget overrun Per-agent and per-tenant ceilings enforced in-line. A runaway loop is denied, not invoiced. Quota & rate Scoped quotas on tool calls, spend, and rate by identity and trust tier. Cost attribution Every token and call attributes to an agent, owner, and project. Anomaly cutoffs Spend that deviates from mission trips a guardrail, like any signal. ## One substrate for governing agents at enterprise scale 1. 01 ### Verifiable identity Every agent gets one durable identity, recognized at every boundary. 2. 02 ### Unified policy Policy is authored once and enforced everywhere, not rewritten across tools, gateways, and point products. 3. 03 ### Human attribution The on-behalf-of chain travels with the credential, so every action can be traced back to the human authority behind it. 4. 04 ### Instant cascading revocation Revoke a parent agent and its whole delegation tree collapses with it: instantly, not at token expiry. ## At the identity layer, trust isn’t a feature. It’s the whole system If the identity backbone is a black box, every claim above it is unverifiable. So the identity layer ships open source; the security stack stays commercial. SPIFFE / WIMSEOAuth 2.1RFC 8693DPoPOpenID CIBACedarCAE / SSF OPEN SOURCE · APACHE 2.0 · ZEROID Highflame ZeroID uses SPIFFE subjects, OAuth 2.1 grants, RFC 8693 token exchange, DPoP-bound tokens, CIBA approval, and CAE/SSF cascade revocation to make agent authority verifiable, delegated, bound, and revocable. Inspect it. Deploy it. Trust it. COMMERCIAL · HIGHFLAME PLATFORM Everything enterprises need to operate agents at scale: signal engine, governance UI, managed attestation, policy packs, evidence exports, cost controls, and enterprise integrations. [github.com/highflame-ai/zeroid ↗](https://github.com/highflame-ai/zeroid) Get the Agent Identity white paper ✕ ▸ TECHNICAL WHITE PAPER ## Agent Identity: A Technical White Paper The full design for verifiable, delegated, revocable agent identity. Tell us where to send it. Name Work email Company Email it to me We'll use this only to send the paper and the occasional product update. Unsubscribe anytime. ## Platform FAQ What is an agent control fabric? One identity, policy, and enforcement layer that governs every AI agent and authorizes every action it takes. Agents get verifiable identities, each action is checked against Cedar policy before it executes, and the decision is recorded as evidence. How does Highflame authorize an agent's action? Every request carries the agent's identity at the wire. The fabric evaluates Cedar policy against the agent's claims, its owner, trust tier, and delegation depth, before the action lands. Policy runs inline and out-of-band, never advisory. Does it cover agents we bought or downloaded, not just ones we built? Yes. Trust tiers gate what vendor and marketplace agents are eligible for, and a lower tier means tighter policy. Every action is still authorized per request, so there is no implicit trust. What standards does the identity layer use? The identity core is open source as ZeroID: SPIFFE identities, OAuth 2.1, RFC 8693 token exchange, and Cedar policy, deployable in your own VPC. Does inline enforcement slow agents down? Detection is tiered with early-exit: fast rule checks in under 5 ms catch secrets, PII, and injection; ML detectors run in 10 to 200 ms; deep cloud detectors only when needed. A fast block skips the slower tiers, and a failed detector fails safe, never a false deny. THE ARCHITECTURAL ARGUMENT ## Agent governance requires an authority layer.This is the fabric. Every agent needs a verifiable identity. Every action needs an authorization decision. Both must persist across prompts, tools, delegations, systems, and audit trails. Anything less is just a feature. [Book a demo](/contact.md) [See it by team](/security.md) ✕ ▸ WHITE PAPER ## The Agent Control Fabric Identity, authorization, and enforcement for production agents. Tell us where to send it. Name Work email Company Email me the white paper We'll use this only to send the paper and the occasional product update. Unsubscribe anytime. ## Sitemap Full site map: [/sitemap.md](https://www.highflame.com/sitemap.md). Machine index: [/sitemap-index.xml](https://www.highflame.com/sitemap-index.xml).