# Registering agents Create identities in the directory, bind sponsors, and declare the scopes an agent may ever hold. ## One identity per agent Register a distinct identity for every agent, including short-lived and experimental ones. Reusing an identity across agents collapses attribution — the whole point of the directory is that every action names exactly one actor. An identity carries a stable id, a human-readable name, its sponsor, and the ceiling of scopes it is allowed to request. ## Binding a sponsor Every identity needs an accountable human sponsor at creation time. The sponsor must be a real person in your directory, not a shared mailbox — they receive escalations and answer for the agent in an incident. Re-assign a sponsor when ownership changes. The change is logged, so the record always shows who was accountable at any point in time. ## Declaring the scope ceiling The scopes you declare at registration are a ceiling, not a grant. They bound what the Issuance Engine will ever mint for this identity; individual credentials are always narrower and short-lived. Keep the ceiling tight. An agent that only reads one system should never be registered with write scopes it might later be issued by mistake. ## Lifecycle Suspend an identity to pause issuance without deleting its history. Revoke it to invalidate everything at once. Retire it when the agent is decommissioned; the audit trail survives the identity.