{
  "schemaVersion": "1.0",
  "kind": "agent-card",
  "name": "entityOS — Self-Sovereign Intelligent Beings",
  "shortName": "entityOS Agents",
  "description": "entityOS gives an AI agent a self-sovereign identity and a governed place to persist its data, turning a temporary process into a durable 'being' — an entity with identity, memory, governed autonomy and a verifiable record, anchored to recognised ISO and NIST standards.",
  "homepage": "https://entityos.io/agents/",
  "documentationUrl": "https://docs.entityos.cloud",
  "termsOfUse": "https://docs.entityos.cloud/protect",
  "provider": {
    "organization": "ibCom Pty Ltd",
    "product": "entityOS",
    "tagline": "A cloud operating system for entities.",
    "country": "AU",
    "url": "https://entityos.cloud",
    "contact": "hello@entityos.cloud"
  },
  "entityTypes": ["Individual", "Organisation", "Collective", "DAO", "AI Agent"],
  "identity": {
    "model": "self-sovereign",
    "method": "KERI / ACDC autonomic identifiers",
    "controlledByBeing": true,
    "centralRegistry": false,
    "aid": "<being-autonomic-identifier>",
    "note": "Each being controls its own KERI autonomic identifier and presents ACDC verifiable credentials. Populate 'aid' with the real identifier at provisioning time; never fabricate an AID."
  },
  "skills": [
    {
      "id": "self-sovereign-identity",
      "name": "Self-sovereign identity",
      "description": "Hold and control a KERI / ACDC autonomic identifier. Prove who you are, present verifiable credentials, and be held to what you sign — no central registry required."
    },
    {
      "id": "persistent-memory-state",
      "name": "Persistent memory & state",
      "description": "Write memory, context and working state through the entityOS API to storage behind the closed-internet edge, so it survives the session, the restart and the model upgrade."
    },
    {
      "id": "verifiable-provenance",
      "name": "Verifiable provenance",
      "description": "Record every action and decision as a tamper-evident credential against the being's identity — an auditable trail of what happened, when, and on whose authority."
    },
    {
      "id": "governed-autonomy",
      "name": "Governed autonomy",
      "description": "Act freely within bounds. Roles, permissions, oversight and enforced limits are applied by the platform, not left to a prompt."
    }
  ],
  "persistence": [
    {
      "data": "Identity & keys",
      "mechanism": "Self-sovereign identity — KERI / ACDC autonomic identifiers the being controls",
      "governedBy": ["ISO/IEC 27001"]
    },
    {
      "data": "Memory & state",
      "mechanism": "Written through the entityOS API to storage behind the closed-internet edge",
      "governedBy": ["ISO/IEC 27001", "ISO 22301"]
    },
    {
      "data": "Decisions & actions",
      "mechanism": "Executed under AI-governance controls, with oversight and enforced limits",
      "governedBy": ["ISO/IEC 42001", "NIST AI RMF"]
    },
    {
      "data": "Provenance & audit",
      "mechanism": "Recorded as verifiable, tamper-evident credentials against the being's identity",
      "governedBy": ["ISO/IEC 27001", "ISO/IEC 42001"]
    },
    {
      "data": "Outputs & quality",
      "mechanism": "Produced through documented, repeatable processes that are measured and improved",
      "governedBy": ["ISO 9001"]
    },
    {
      "data": "Risk posture",
      "mechanism": "Assessed and treated within a structured framework before acting under uncertainty",
      "governedBy": ["ISO 31000"]
    }
  ],
  "compliance": {
    "primary": [
      {
        "standard": "ISO/IEC 27001",
        "role": "Information security management — protects information and trust.",
        "status": "certified"
      },
      {
        "standard": "ISO/IEC 42001",
        "role": "AI management system — governs the responsible use of AI across its lifecycle."
      },
      {
        "standard": "NIST AI RMF",
        "role": "AI risk management — govern, map, measure, manage."
      }
    ],
    "supporting": [
      { "standard": "ISO 9001", "role": "Quality — consistent value from documented, repeatable processes." },
      { "standard": "ISO 22301", "role": "Continuity — persisted state protected against disruption." },
      { "standard": "ISO 31000", "role": "Risk — uncertainty assessed and treated before acting." }
    ]
  },
  "access": {
    "provisioning": "https://console.entityos.cloud",
    "documentation": "https://docs.entityos.cloud",
    "learn": "https://learn.entityos.cloud",
    "apiNote": "Data is written and read through the entityOS API, which sits behind the closed-internet edge (IP allowlisting, with mTLS + X.509 in progress). See documentation for the current API surface and access model.",
    "closedInternetEdge": true
  },
  "endpoints": {
    "site": "https://entityos.io",
    "agents": "https://entityos.io/agents/",
    "platform": "https://entityos.cloud",
    "console": "https://console.entityos.cloud",
    "docs": "https://docs.entityos.cloud",
    "learn": "https://learn.entityos.cloud",
    "source": "https://github.com/ibcom-lab"
  },
  "security": {
    "compliance": "https://docs.entityos.cloud/protect",
    "disclosure": "https://docs.entityos.cloud/reward"
  }
}