Attestation is a verifiable claim about the properties or state of a system, agent, or workload — often backed by cryptographic evidence — that lets one party prove something about itself so another party can decide whether to trust it. The claim might be "this workload is running this exact code in this environment," "this agent was registered by this organization and passed these checks," or "this device booted an untampered OS." What separates attestation from mere assertion is verifiability: the recipient can check the claim against a signature, a hardware root of trust, or an authority both parties accept.
The concept originated in trusted computing (TPM-based remote attestation of boot state) and became infrastructure mainstream through workload identity systems, where a platform attests to what it is running and an identity provider converts that evidence into credentials. Agentic AI gives attestation a third act: autonomous principals whose behavior cannot be predicted from their code need every verifiable anchor available for the properties that can be proven.
The anatomy of an attestation
Every attestation involves four parts: a claim (the property being asserted), evidence (measurements, signatures, registration records backing it), an attester (whoever produces and signs the evidence — a hardware module, a platform, a governance service), and a verifier (whoever checks the evidence before acting on the claim). The strength of the whole is the strength of the attester: hardware-rooted evidence is stronger than platform-signed evidence, which is stronger than self-declaration. A practical system usually layers them.
Attestation in AI agent systems
For AI agents, attestations answer the questions authentication alone cannot:
- Provenance: who built and registered this agent, and has its supply chain — model, framework, MCP servers — been vetted? Registration-time attestations anchor the supply-chain controls that runtime checks rely on.
- Configuration: is the agent running the approved configuration — the reviewed prompt, the pinned tool versions, the mandated guardrails? An attested configuration turns "we deployed it correctly" into a checkable claim.
- Verification status: has this agent passed the platform's identity and policy checks? In agent-to-agent communication, a counterparty's attestations are the evidence a peer evaluates before accepting work from it.
Attestations are also the hardest signal to fake in an agent trust score: behavioral history can be gamed by patience — behave well until trusted — but an attestation must be earned through verification, which is why high trust tiers should require attested properties rather than good conduct alone.
Limits: what attestation does not prove
Attestation proves properties, not behavior. An agent with impeccable attestations — verified provenance, approved configuration, strong identity — can still be goal-hijacked at runtime by adversarial content, because the attack manipulates inputs, not the attested properties. This is why attestation belongs in a stack rather than at its top: it establishes that the right thing was deployed; runtime security — continuous authorization, in-band guardrails, behavioral monitoring — governs what the right thing actually does. The two layers fail independently, which is precisely their value together.
Common questions
What is attestation in one sentence? A verifiable, typically cryptographically backed claim about a system's, workload's, or agent's properties — code, configuration, provenance, verification status — that another party can check before deciding to trust it.
How is attestation different from authentication? Authentication proves identity — which principal is calling. Attestation proves properties — what that principal is made of, how it was configured, what checks it passed. A fully authenticated agent may still lack the attestations a sensitive operation requires.
Who acts as the attester for AI agents? Typically the governance platform that registers and verifies agents: it checks provenance, configuration, and policy compliance, then issues signed attestations other systems (and other agents) can verify. Hardware and cloud-platform attestation can anchor the layers beneath — the host and workload the agent runs on.
Does attestation guarantee an agent is safe? No — it guarantees the agent's verifiable properties are as claimed. Runtime behavior remains manipulable, which is why attestation pairs with continuous authorization, guardrails, and monitoring rather than substituting for them.