The principles of
a verifiable agent OS.

RISC processors proved that a small, well-defined instruction set outperforms bloated architectures across almost every metric. The same logic applies to agentic systems. When an agent's behavioural surface is small, every deviation is visible.

selfdriven.computer proposes five core primitives: Perceive, Reason, Decide, Act, and Attest. Every observable agent behaviour is a composition of these five. Higher-order capabilities emerge from composition, not from expanding the primitive set.

This means an auditor reviewing an agent's KEL doesn't need to understand the full complexity of the agent's internal model. They need to understand the semantics of five operations and the sequence in which they were invoked.

The dominant trust model in software is attestation by authority: a certificate authority says a server is legitimate; a platform says an app is safe; an operator says their AI is aligned. These chains of assertion are only as strong as their weakest link — and the weakest link is always human.

selfdriven.computer inverts this. Every claim is a proof. An ACDC credential asserts what an agent is authorised to do, and that assertion is cryptographically bound to the agent's KERI AID. The verifier needs only the agent's inception event and the credential schema — both of which are public and independently verifiable.

This isn't a subtle improvement. It's an architectural shift. When trust doesn't require trusting anyone, the trust ecosystem scales without introducing new points of failure.

KERI AIDs are self-certifying. The identifier itself — derived from the cryptographic material used to control it — carries its own proof of origin. There is no registration authority. No central directory. No dependency on DNS, PKI, or any infrastructure that can be compromised, abandoned, or politicised.

For AI agents, this is transformative. Every agent gets a persistent, portable, verifiable identity from the moment of its instantiation. Every interaction that agent participates in — with humans, other agents, or services — is cryptographically attributed to that identity. Accountability becomes structural, not contractual.

This also means that when an agent's keys are compromised, rotation is deterministic. The pre-rotation commitment made at inception allows the agent to recover its identity without losing its history.

KERI's delegation model uses dip (delegated inception) events to create child AIDs that operate under the authority of a parent AID. This creates a hierarchical trust chain that mirrors how organisations actually work: humans at the top, agents operating under human-granted authority at each level below.

Crucially, delegation in KERI is bilateral. The delegated AID must commit to the delegator in its inception event, and the delegator must confirm the delegation in its own key event log. Neither party can claim delegation without the other's cryptographic commitment.

This prevents the most dangerous failure mode in agentic systems: an agent that accumulates authority beyond what was intended, either through design or through prompt injection. The delegation chain is structural, not conversational.

When two agents interact, neither should need to trust the other's operator. They need only verify each other's AID and the credentials attached to it. This is the same principle that makes HTTPS work across the entire internet — a shared cryptographic standard that lets unknown parties establish trust without prior relationship.

selfdriven.computer extends this to agent-to-agent interaction via SKILL.MD protocols. Each agent advertises its capabilities as a structured, versioned document that other agents can verify. Composition of capabilities follows the same delegation model as authority — explicit, scoped, and auditable.

The result is an ecosystem where composability is a security property, not just an engineering convenience. Safe composition means each participant knows exactly what they agreed to — and that agreement is recorded in the KEL.

"Human in the loop" is often a euphemism for a human rubber-stamping agent decisions at high volume. The human sees a stream of requests, approves most of them, and provides a false sense of oversight. This is worse than no oversight — it creates accountability without attention.

The Human Conductor model inverts this. Agents handle volume. Humans handle judgment. Each area of focus — from direction to accountability — has a human conductor who sets strategy, resolves exceptions, and governs the agent ecosystem that operates beneath them. Agents report upward; humans decide downward.

Critically, the conductor's authority is cryptographically anchored. When a human makes a strategic decision that agents must respect, that decision is recorded as a KERI interaction event — signed by the human's passkey-linked AID. Agents cannot deviate from it without creating a verifiable discrepancy in their KEL.