Optional agentIdentity config for runTeam() — verifiable agent trust

[piiiico]

Why now?

open-multi-agent is 19 days old. The runTeam() API contract is still being shaped. This is the exact moment to sketch an optional identity hook — costs nothing for users who don't need it, and establishes a clean integration surface before external services start making assumptions.

The problem

As runTeam() gets adopted in production, teams will hit three questions that the framework currently can't answer:

1. Attribution: "Which agent produced this output?" — needed for audit trails, debugging cascades, and compliance (EU AI Act full enforcement: August 2026)
2. Inter-org trust: "Can the external API verify who is calling it?" — without a verifiable identity token, tool calls are anonymous from the receiver's perspective
3. Impersonation prevention: "Is the agent that claimed to be 'researcher' actually authorized?" — OWASP Agentic AI Top 10 ASI03 (Identity & Privilege Abuse) names this as the top cross-agent attack vector

Proposed: optional agentIdentity field

import { runTeam } from "@jackchen_me/open-multi-agent";

const result = await runTeam(
  [researchAgent, writerAgent],
  "Write a report on quantum computing",
  {
    // Optional — zero behavior change when absent
    agentIdentity: {
      provider: "agentlair",          // or any JWT provider
      aat: process.env.AGENTLAIR_AAT,  // EdDSA JWT, 1h TTL
      jwksUri: "https://agentlair.dev/.well-known/jwks.json",
    }
  }
);

When set, each agent action carries a signed JWT assertion. External services receiving tool calls can verify:

1. The token was issued by a known provider (JWKS key discovery, RFC 7517 — same mechanism as OAuth 2.0)
2. The token is fresh (standard exp claim)
3. The token belongs to the correct agent (standard sub claim)

What this does NOT mean

• Not required. Zero behavior change when agentIdentity is absent.
• Not AgentLair-specific. The interface accepts any JWT provider — the field name is provider for this reason.
• Not a new dependency. The JWKS discovery is a one-line fetch; verification is a single call to any JWT library.

API shape options

I see a few natural places this could live:

Option A — Global in runTeam() options (above): one identity for the whole team

Option B — Per-agent in AgentConfig:

const team = [
  { ...researchAgent, identity: { aat: "..." } },
  { ...writerAgent,   identity: { aat: "..." } },  // different identity per agent
];

Option C — Lifecycle hook (aligned with open-multi-agent's existing hook system):

runTeam(team, goal, {
  hooks: {
    beforeToolCall: async (agent, tool, args) => {
      tool.headers["Authorization"] = `Bearer ${process.env.AGENTLAIR_AAT}`;
    }
  }
});

Option C requires zero framework changes and works today with the existing hook system. Options A/B are cleaner DX for the common case.

Existing implementation

AgentLair provides the token infrastructure: EdDSA JWT per agent session, JWKS endpoint, did:web identity resolution, and behavioral trust scoring. Happy to contribute a reference integration or adapt based on whatever API shape you settle on.

cc @JackChen-me — would love to hear your thinking on where identity belongs in the framework's philosophy.

[JackChen-me]

not now. Thanks.