Register an agent under its own DID, with a name and a kind, so that every action resolves to one agent.
identity.enrollPut admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abuseA shared service account hides which agent did what. Give each agent a DID of its own.
The code reads the key from INTRAMEDIAL_KEY. Keep it in your shell or your secret store, never in a file you commit. Calls that need a signed-in person cannot use a key: the console makes them.
Send the did, a displayName and a kind of house, customer or partner; the kind defaults to customer. owner names the account to notify when its trust tier changes.
The ledger is append-only and sealed under Merkle roots. The time on an entry is Intramedial's own clock, and a signed bundle can be checked offline with the published key.
A Trustvice Product
identity.enrollidentity-enroll
curl -sS -X POST https://api.intramedial.com/api/v1/acp/identity/enroll \
-H "Authorization: Bearer $INTRAMEDIAL_KEY" \
-H "Content-Type: application/json" \
-d '{
"did": "did:web:acme.example:agent:billing",
"displayName": "Billing agent",
"kind": "customer"
}'const res = await fetch("https://api.intramedial.com/api/v1/acp/identity/enroll", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.INTRAMEDIAL_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
did: "did:web:acme.example:agent:billing",
displayName: "Billing agent",
kind: "customer",
}),
});
console.log(res.status, await res.json());import os, requests
res = requests.post(
"https://api.intramedial.com/api/v1/acp/identity/enroll",
headers={"Authorization": "Bearer " + os.environ["INTRAMEDIAL_KEY"]},
json={
"did": "did:web:acme.example:agent:billing",
"displayName": "Billing agent",
"kind": "customer",
},
timeout=30,
)
print(res.status_code, res.json())agent is the registry record. skipped is true only when no DID was issued, as on a worker with no identity runtime.
{
"agent": {
"did": "did:web:acme.example:agent:billing",
"displayName": "Billing agent",
"kind": "customer",
"enrolledAt": "2026-11-01T09:12:44.000Z",
"issuedDid": "did:web:id.example:agent:billing",
"workspaceId": "ws_acme"
},
"skipped": false
}Enrolling grants nothing. Grants come from mandates compiled with mandates.compile, so write a mandate that names this DID next, and preview it first.
Copied from: /docs/identity-enroll
Read an agent's trust profile and autonomy tier, and the fixed point values and decay behind both of them.
trust.getRead the callers the MCP gateway has seen, then sanction one as an identity or keep it tracked as a shadow.
mcp.shadowidentity.enrollCompile a mandate with apply: false, read the grants it would make and its previewDigest, then apply exactly what you previewed.
mandates.compileOne short email when we add recipes to the cookbook. No other mail, and you can unsubscribe from any message.
No key or account: Try it on the coordination.admit module page runs the real kernel in your browser. Use a workspace key for your own workspace.