Agent Identity

Policy evaluation and runtime execution resolve agent identity from the input context. Workspace settings can require agent identity on every request.

Identity fields

• agent_id — UUID of the registered agent
• agent / agent_name — display name match
• agent_slug — slug match

Agent key verification

When an agent has api_key_hash set, requests must include X-KorClaw-Agent-Key with the matching secret. The SDK sends this via the agentKey option on evaluate, enforce, and runtime.execute.

Environment binding

If the resolved agent has an environment set, the input environment must match. Mismatches return environment_mismatch (400). Environment-scoped policies require environment in the input.