Agent Trust Kit - PoC Use Cases

using System.Security.Cryptography;
using Microsoft.IdentityModel.Tokens;
using SdJwt.Net.AgentTrust.Core;
using SdJwt.Net.AgentTrust.Policy;

// === SETUP: Agent-Side (Issuer) ===

// Create agent signing key (use KMS/HSM in production)
using var agentEcdsa = ECDsa.Create(ECCurve.NamedCurves.nistP256);
var agentKey = new ECDsaSecurityKey(agentEcdsa) { KeyId = "agent-key-1" };

// Initialize nonce store and receipt writer
var nonceStore = new MemoryNonceStore(new MemoryCache(new MemoryCacheOptions()));
var receiptWriter = new LoggingReceiptWriter(logger);

// Create capability token issuer
var issuer = new CapabilityTokenIssuer(
    agentKey,
    SecurityAlgorithms.EcdsaSha256,
    nonceStore);

// === MINT: Create a scoped capability token ===

var tokenResult = issuer.Mint(new CapabilityTokenOptions
{
    Issuer = "agent://procurement-service",
    Audience = "tool://member-lookup-service",
    Capability = new CapabilityClaim
    {
        Tool = "MemberLookup",
        Action = "GetFees",
        Resource = "member:12345",
        Limits = new CapabilityLimits { MaxResults = 50 }
    },
    Context = new CapabilityContext
    {
        CorrelationId = Guid.NewGuid().ToString(),
        WorkflowId = "procurement-workflow-001",
        StepId = "step-3-fee-lookup"
    },
    Lifetime = TimeSpan.FromSeconds(60),
    // Only disclose tool, action, limits to the tool server
    DisclosableClaims = new[] { "cap.tool", "cap.action", "cap.limits" }
});

Console.WriteLine($"Token ID: {tokenResult.TokenId}");
Console.WriteLine($"Expires: {tokenResult.ExpiresAt}");

// === CALL: Attach token to HTTP request ===

using var httpClient = new HttpClient();
httpClient.DefaultRequestHeaders.Add("Authorization", $"SdJwt {tokenResult.Token}");
var response = await httpClient.GetAsync("https://tool-server/api/members/12345/fees");

// === VERIFY: Tool-Side ===

var verifier = new CapabilityTokenVerifier(nonceStore);
var verifyResult = await verifier.VerifyAsync(
    tokenResult.Token,
    new CapabilityVerificationOptions
    {
        ExpectedAudience = "tool://member-lookup-service",
        TrustedIssuers = new Dictionary<string, SecurityKey>
        {
            ["agent://procurement-service"] = agentKey  // public key only in production
        },
        EnforceReplayPrevention = true
    });

if (verifyResult.IsValid)
{
    Console.WriteLine($"Verified! Tool={verifyResult.Capability!.Tool}, " +
                      $"Action={verifyResult.Capability.Action}");

    // Enforce limits in query
    var maxRows = verifyResult.Capability.Limits?.MaxResults ?? 100;

    // Emit audit receipt
    await receiptWriter.WriteAsync(new AuditReceipt
    {
        TokenId = verifyResult.TokenId!,
        Timestamp = DateTimeOffset.UtcNow,
        Decision = ReceiptDecision.Allow,
        Tool = verifyResult.Capability.Tool,
        Action = verifyResult.Capability.Action,
        CorrelationId = verifyResult.Context!.CorrelationId
    });
}
else
{
    Console.WriteLine($"Verification failed: {verifyResult.Error}");
}

using SdJwt.Net.AgentTrust.Maf;

var builder = Host.CreateApplicationBuilder(args);

// Register Agent Trust services
builder.Services.AddAgentTrust(options =>
{
    options.KeyCustodyProviderType = typeof(InMemoryKeyCustodyProvider);
    options.NonceStoreType = typeof(MemoryNonceStore);
    options.ReceiptWriterType = typeof(LoggingReceiptWriter);
    options.PolicyEngineType = typeof(DefaultPolicyEngine);
});

// Register policy rules
builder.Services.AddSingleton<IReadOnlyList<PolicyRule>>(
    new PolicyBuilder()
        .Allow("agent://procurement-*", "MemberLookup", "*",
            c => c.WithMaxResults(100).WithMaxTokenLifetime(TimeSpan.FromSeconds(60)))
        .Allow("agent://procurement-*", "FeeCalculator", "Calculate",
            c => c.WithMaxTokenLifetime(TimeSpan.FromSeconds(30)))
        .Deny("*", "AdminConsole", "*")
        .Build());

// Build MAF agent with trust middleware
var agent = builder.Services
    .AddAgent("procurement-agent")
    .UseAgentTrust(options =>
    {
        options.AgentId = "agent://procurement-service";
        options.ToolAudienceMapping = new Dictionary<string, string>
        {
            ["MemberLookup"] = "tool://member-lookup-service",
            ["FeeCalculator"] = "tool://fee-calculator-service"
        };
    })
    .AddTool("MemberLookup", memberLookupTool)
    .AddTool("FeeCalculator", feeCalculatorTool)
    .Build();

// When the agent calls a tool, the middleware automatically:
// 1. Evaluates policy (is this agent allowed to call this tool?)
// 2. Mints a scoped capability token
// 3. Attaches the token to the outbound request
// 4. Emits an audit receipt after the call completes

using SdJwt.Net.AgentTrust.AspNetCore;

var builder = WebApplication.CreateBuilder(args);

// Add Agent Trust verification
builder.Services.AddAgentTrustVerification(options =>
{
    options.Audience = "tool://member-lookup-service";
    options.TrustedIssuers = new Dictionary<string, SecurityKey>
    {
        ["agent://procurement-service"] = agentPublicKey,
        ["agent://hr-service"] = hrAgentPublicKey
    };
    options.ExcludedPaths = new[] { "/health", "/ready" };
    options.EnforceActionConstraints = true;
    options.EnforceLimits = true;
    options.EmitReceipts = true;
});

var app = builder.Build();

// Add verification middleware (after routing, before authorization)
app.UseRouting();
app.UseAgentTrustVerification();
app.UseAuthorization();

// Endpoint with specific capability requirement
app.MapGet("/api/members/{id}/fees",
    [RequireCapability("MemberLookup", "GetFees")]
    async (string id, HttpContext ctx) =>
    {
        var capability = ctx.GetVerifiedCapability();
        var limits = capability?.Limits;
        var maxRows = limits?.MaxResults ?? 100;
        var correlationId = ctx.GetCapabilityContext()?.CorrelationId;

        var fees = await feeService.GetFeesAsync(id, maxRows);

        return Results.Ok(new
        {
            MemberId = id,
            Fees = fees,
            CorrelationId = correlationId,
            LimitApplied = maxRows
        });
    });

// Endpoint requiring different action
app.MapPost("/api/members/{id}/update",
    [RequireCapability("MemberLookup", "UpdateMember")]
    async (string id, MemberUpdateRequest request) =>
    {
        // Only agents with explicit UpdateMember capability reach here
        return Results.Ok(new { Updated = true });
    });

// Health check (excluded from verification)
app.MapGet("/health", () => Results.Ok("healthy"));

app.Run();

using SdJwt.Net.AgentTrust.Core;
using SdJwt.Net.AgentTrust.Policy;

// === Orchestrator: Create delegation for specialist ===

var delegationRules = new PolicyBuilder()
    .AllowDelegation(
        fromAgent: "agent://orchestrator",
        toAgent: "agent://claims-specialist",
        maxDepth: 1,
        constraints: d => d.WithAllowedActions("ProcessClaim", "GetClaimStatus"))
    .Build();

var policyEngine = new DefaultPolicyEngine(delegationRules);

// Orchestrator evaluates delegation policy
var delegationDecision = await policyEngine.EvaluateAsync(new PolicyRequest
{
    AgentId = "agent://orchestrator",
    Tool = "a2a://claims-specialist",
    Action = "ProcessClaim",
    Context = new CapabilityContext
    {
        CorrelationId = Guid.NewGuid().ToString(),
        WorkflowId = "insurance-claim-2024-001"
    },
    DelegationChain = new DelegationChain
    {
        DelegatedBy = "agent://orchestrator",
        Depth = 0,
        MaxDepth = 1,
        AllowedActions = new[] { "ProcessClaim", "GetClaimStatus" }
    }
});

if (delegationDecision.IsPermitted)
{
    // Mint delegation token
    var delegationToken = issuer.Mint(new CapabilityTokenOptions
    {
        Issuer = "agent://orchestrator",
        Audience = "a2a://claims-specialist",
        Capability = new CapabilityClaim
        {
            Tool = "ClaimsProcessing",
            Action = "ProcessClaim",
            Resource = "claim:INS-2024-00542"
        },
        Context = new CapabilityContext
        {
            CorrelationId = "corr-123",
            WorkflowId = "insurance-claim-2024-001",
            StepId = "delegate-to-specialist"
        },
        Lifetime = TimeSpan.FromMinutes(5)
    });

    // Send delegation token to specialist agent
    await specialistAgent.InvokeAsync("ProcessClaim", delegationToken.Token);
}

// === Specialist: Use delegation to call downstream tools ===

// Specialist verifies the delegation token
var delegationVerify = await verifier.VerifyAsync(
    delegationToken.Token,
    new CapabilityVerificationOptions
    {
        ExpectedAudience = "a2a://claims-specialist",
        TrustedIssuers = orchestratorKeys
    });

if (delegationVerify.IsValid)
{
    // Specialist mints a sub-capability token (bounded by delegation)
    var subToken = issuer.Mint(new CapabilityTokenOptions
    {
        Issuer = "agent://claims-specialist",
        Audience = "tool://claims-database",
        Capability = new CapabilityClaim
        {
            Tool = "ClaimsDatabase",
            Action = "ProcessClaim",
            Resource = "claim:INS-2024-00542",
            Limits = new CapabilityLimits { MaxInvocations = 1 }
        },
        Context = delegationVerify.Context!,
        Lifetime = TimeSpan.FromSeconds(30)
    });

    // Call downstream tool with sub-capability
    var result = await claimsDb.ProcessAsync(subToken.Token);

    // Receipt ties the full chain: orchestrator -> specialist -> tool
    await receiptWriter.WriteAsync(new AuditReceipt
    {
        TokenId = subToken.TokenId,
        Timestamp = DateTimeOffset.UtcNow,
        Decision = ReceiptDecision.Allow,
        Tool = "ClaimsDatabase",
        Action = "ProcessClaim",
        CorrelationId = delegationVerify.Context!.CorrelationId
    });
}

// === Scenario A: Expired token is rejected ===

var shortLivedToken = issuer.Mint(new CapabilityTokenOptions
{
    Issuer = "agent://test-agent",
    Audience = "tool://test-tool",
    Capability = new CapabilityClaim { Tool = "Test", Action = "Read" },
    Context = new CapabilityContext { CorrelationId = "test-1" },
    Lifetime = TimeSpan.FromSeconds(2) // Very short for demo
});

// Wait for expiry
await Task.Delay(TimeSpan.FromSeconds(3));

var expiredResult = await verifier.VerifyAsync(
    shortLivedToken.Token,
    verificationOptions);

Console.WriteLine($"Expired token valid: {expiredResult.IsValid}");
// Output: Expired token valid: False
Console.WriteLine($"Error: {expiredResult.ErrorCode}");
// Output: Error: token_expired

// === Scenario B: Replayed token is rejected ===

var token = issuer.Mint(new CapabilityTokenOptions
{
    Issuer = "agent://test-agent",
    Audience = "tool://test-tool",
    Capability = new CapabilityClaim { Tool = "Test", Action = "Read" },
    Context = new CapabilityContext { CorrelationId = "test-2" },
    Lifetime = TimeSpan.FromSeconds(60)
});

// First use: accepted
var firstUse = await verifier.VerifyAsync(token.Token, verificationOptions);
Console.WriteLine($"First use valid: {firstUse.IsValid}");
// Output: First use valid: True

// Replay: rejected
var replay = await verifier.VerifyAsync(token.Token, verificationOptions);
Console.WriteLine($"Replay valid: {replay.IsValid}");
// Output: Replay valid: False
Console.WriteLine($"Error: {replay.ErrorCode}");
// Output: Error: token_replayed

// === Scenario C: Key rotation invalidates old tokens ===

// Rotate agent key
await keyCustody.RotateKeyAsync("agent-key-1");
// Remove old key from trusted issuers
// All tokens signed with old key are now untrusted