4-Day Course · Hands-on
AgentPass Architect Track · 4-Day

AgentPass Certified Architect

The flagship architect course. Over four hands-on days you design, secure, deploy, scale and prove production AgentPass agent estates end to end: agent identity and PKI, MCPS message signing on every action, OFAC and sanctions checks, autonomous payments, key management and rotation, a hardware kill switch, and non-repudiable evidence of everything an agent did. Built on the open agent-trust standards authored by your instructor. The 1-day AgentPass Agent Deployment course is the hands-on foundation; this is where you go deeper.

Reserve a Place See the Syllabus
Grounded in the standards

Built on the open agent-trust standards

AgentPass implements the agent-trust standards your instructor authors: MCPS for per-message signing of every agent action, ATTP for agent trust transport, the OpenAPI x-agent-trust extension, and payment trust via draft-sharif-agent-payment-trust. Mapped to the OWASP MCP Top 10 and AISVS.

Protocols for human interaction are not enough on their own. A human-in-the-loop approval flow gates the actions a person happens to see; an autonomous agent takes thousands it does not. Only cryptographic signing of every action gives you a provable record of what the agent actually did. That is why AgentPass signs first and asks a human only where it matters. See the MCPS Internet-Draft.

MCP 2026-07 update -- why per-message signing still matters

The 2026-07-28 MCP release candidate makes the protocol stateless: the initialize/initialized handshake and the Mcp-Session-Id header are removed, so every request stands alone, and the new Mcp-Method / Mcp-Name routing headers (SEP-2243) are unauthenticated. Its six authorization SEPs harden OAuth 2.0 / OpenID Connect -- issuer validation per RFC 9207 (SEP-2468), OIDC application_type in Dynamic Client Registration (SEP-837), and issuer-bound credentials (SEP-2352) -- but they still rely on bearer tokens. Sender-constrained tokens (DPoP, RFC 9449) and hardware attestation remain a proposal -- SEP #1461, "Attested Client Registration and Proof-of-Possession" -- and did not ship in this release candidate. Until that lands, a stolen access token is replayable and no individual message is authenticated. That is exactly the gap AgentPass and MCPS close: every agent action is signed with a nonce and timestamp. OAuth authenticates the client; MCPS authenticates every message.

You will be able to

What you can do after the course

AGPASS-601. The syllabus

Four days, from architecture to proof

Classes are custom built from the following learning modules. The recommended 4-day format is shown. (Times are approximate.)

Architecture Foundations

Principles, Components and Decisions

60-00 Agent Estate Architecture Principles 1 hr

What makes agent estate architecture different from traditional service architecture. The six properties every agent estate must have: identity, trust scoring, per-action signing, payment controls, audit and kill switches. Why missing any one of them leaves a gap that cannot be closed later.

60-01 The Agent Protocol Landscape (Review) 1 hr

A review of the protocol landscape: OAuth limitations for agents, agent-as-itself identity, Cross-App Access, ID-JAG, AAuth, DPoP, SPIFFE and MCP authorization. For delegates who completed AGPASS-531 this is a refresher. For those who did not, it brings them up to speed. We focus on how each protocol shapes architecture decisions.

60-02 AgentPass Component Architecture 1.5 hrs

Deep walkthrough of every AgentPass component: the identity service, trust engine, ledger, payment gateway, MCPS signing proxy and the admin API. How they interact, what state each holds, and the failure modes when any component goes down.

60-03 Architecture Decision Records 1 hr

How to write architecture decisions that a security review board, a regulator or a future architect can follow. The ADR format, what to include, and how to document tradeoffs. Every design decision in this course produces an ADR.

Identity Architecture at Scale

Multi-Tenant, PKI, SPIFFE and Automation

61-00 Multi-Tenant Agent Identity 1.5 hrs

Designing identity for multiple teams, business units or customers sharing one agent estate. Tenant isolation, namespace design, credential scoping and the boundary between shared infrastructure and tenant-specific policy.

61-01 PKI Design for Agent Estates 1.5 hrs

Root key placement (HSM, cloud KMS, on-prem), intermediate CA hierarchy, certificate lifetime policy and the rotation calendar. Designing a PKI that scales to thousands of agents without becoming a single point of failure or an operational burden.

61-02 SPIFFE at Estate Scale 1 hr

Trust domains, federation between trust domains, SPIRE server topology (nested vs federated) and the tradeoffs. When to use a single trust domain and when to federate.

61-03 Credential Lifecycle Automation 1 hr

Automating issuance, rotation and revocation. Integration with CI/CD pipelines so new agents get credentials at deploy time and retired agents lose them at teardown. Zero standing credentials.

Trust Architecture

Scoring, Policy and Multi-Agent Trust

62-00 Trust Scoring Design 1 hr

Designing the trust model for your organisation. Which actions sit at which level. How trust is earned, how it degrades, and the signals that trigger demotion. The policy document that governs all of it.

62-01 Trust Policy as Code 1.5 hrs

Hands on: write trust policies in OPA Rego. Express your organisation's trust rules as testable, version-controlled code. Deploy policy changes without redeploying agents.

62-02 Graduated Escalation Architecture 1 hr

Designing the escalation ladder: which actions proceed autonomously, which notify, which block for human approval, and which require hardware approval. How to avoid both "everything needs approval" (unusable) and "nothing needs approval" (unsafe).

62-03 Trust in Multi-Agent Topologies 1 hr

When agents delegate to other agents, how does trust propagate? Scope attenuation by design, depth limits, and what happens when a high-trust agent delegates to a low-trust agent. Patterns that prevent privilege laundering.

Payment and Compliance Architecture

Rails, Sanctions, Regulation and Data Residency

63-00 Payment Rail Design 1 hr

Choosing payment rails for agent estates: Stripe for card payments, Lightning for micropayments, and the abstraction layer that lets you switch without re-architecting. Settlement timing, reconciliation and the evidence each rail produces.

63-01 Sanctions and AML Architecture 1 hr

Where to place sanctions screening in the architecture. Pre-payment vs pre-action screening. List update frequency, caching strategy and the latency budget. Designing for the case where the screening service is down (answer: block, not bypass).

63-02 Regulatory Mapping 1 hr

Mapping your agent estate architecture to AISVS (C05, C09, C12), EU AI Act (Articles 12, 13, 14, 15, 50), NIST AI RMF and sector-specific requirements. Producing the compliance evidence pack from your architecture documentation.

63-03 Multi-Region and Data Residency 1 hr

Agents that operate across jurisdictions. Where credentials are issued, where payments are processed, where logs are stored. Data residency constraints and how they shape the architecture. GDPR, Saudi PDPL and other territorial requirements.

Monitoring, Audit and Incident Architecture

Ledger, Observability, IR and Forensic Readiness

64-00 Ledger Architecture 1.5 hrs

Designing the audit ledger for an agent estate. Hash chain integrity, dual-signature strategy (ECDSA + ML-DSA-65), storage backend selection, retention policy and the query patterns auditors and incident responders need. Backup and disaster recovery for the ledger.

64-01 Observability Architecture 1 hr

Metrics, logs and traces for agent estates. What to instrument, what to alert on, and the dashboards that operations and security teams each need. Integration with existing SIEM and observability stacks.

64-02 Incident Response Architecture 1 hr

Designing the incident response path for agent incidents. Detection, containment (credential revocation, swarm kill), investigation (ledger queries, timeline reconstruction) and recovery.

64-03 Forensic Readiness by Design 0.5 hr

Designing the estate so that when an incident occurs, the evidence is already there. Logging requirements, evidence retention and the infrastructure that makes forensic investigation possible without scrambling.

Threat Modeling and Security Architecture

Model the Threats, Design the Defenses

65-00 Threat Modeling the Agent Estate 2 hrs

Hands on: build a threat model for a complete agent estate. Identify trust boundaries, enumerate threats (credential theft, trust escalation, payment fraud, delegation abuse, log tampering), and map each threat to an architectural control. Produce a threat model document.

65-01 Resilience and Failure Design 1 hr

What happens when each component fails. AgentPass down, ledger unreachable, payment provider timeout, SPIRE unavailable, hardware approval device offline. Designing for graceful degradation where safe and hard stop where not.

65-02 Post-Quantum Readiness 0.5 hr

The agent estate will outlive current cryptography. ML-DSA-65 dual signing in the ledger, ML-KEM key exchange readiness and the migration path. What to do now and what to wait on.

The Architecture Exam

Earn the CyberSecAI ACA Credential

66-00 Exam Briefing 0.5 hr

Exam rules, deliverables, time limit and marking criteria.

66-01 Architecture Exam 6 hrs

Each delegate receives a scenario: an organisation with a specific agent population, regulatory environment, payment requirements and risk profile. Design the full agent estate architecture: identity, trust, payments, audit, monitoring and incident response. Produce ADRs, a threat model, a deployment diagram and a compliance mapping. Present and defend your design.

66-02 Exam Debrief and Certification 1.5 hrs

Walkthrough of the reference architecture, discussion of design choices, common mistakes and marking criteria. Delegates who demonstrate competence receive the CyberSecAI ACA credential.

Labs (Days 1 to 3)

Hands-On Architecture Labs

67-00 Multi-Tenant Identity Lab 2 hrs

Design and deploy a multi-tenant agent identity structure. Issue credentials for agents in two tenants, verify isolation, test cross-tenant access (it must fail).

67-01 Trust Policy Lab 2 hrs

Write and deploy trust policies in OPA. Test graduated escalation: L0 through L4 actions, verify each fires at the correct threshold. Attempt trust escalation attacks.

67-02 Payment Architecture Lab 2 hrs

Deploy a payment flow with sanctions screening across two payment rails. Verify receipts, test screening against sanctioned entities, verify fail-closed on screening service failure.

67-03 Threat Model Lab 2 hrs

Build a threat model for a provided agent estate scenario. Identify threats, map to controls, identify gaps and propose mitigations. Peer review with another delegate.

67-04 Estate Resilience Lab 1.5 hrs

Simulate component failures across the estate. Verify fail-closed behaviour, verify the ledger integrity survives, verify agents stop acting when they should.

~48 hrs
Total instructional hours
36
Individual modules
4 days
Architect track
ACA
Credential on exam pass
Why signing is required

Sign every action, or you cannot prove any of them.

Cryptographic identity and signed actions give you three things a human-in-the-loop protocol cannot: control of your agent, non-repudiation of what it did, and a hard stop on IP and data leaking out through it. Approval flows alone do not scale to an agent taking thousands of autonomous actions a minute. AgentPass signs each one. See the MCPS Internet-Draft.

Money & compliance

OFAC, sanctions and agent payments

When an agent moves money, the same rules apply and the evidence has to hold. You wire OFAC and sanctions screening into the agent's decision path, apply AML controls to autonomous payments, and sign every payment into a record an auditor and a regulator will accept. Grounded in the OWASP cheat sheet on AML and sanctions for AI agent payments, authored by your instructor.

The hardware in the loop

AgentBee

AgentBee hardware human-approval key

AgentBee is the hardware kill switch you deploy in this course. Plug it in, and an AgentPass agent cannot move money, delete data, deploy, or take other high-stakes actions until a person physically approves on the device. It is human authority, in hardware.

Every approval is signed with FIDO-grade crypto (ECDSA P-256): a tamper-evident record of who authorised what. Signing on every action, hardware approval on the ones that matter, and instant revocation for the rest.

agentbee.co.uk →
Agentic forensics

Prove exactly what an agent did

Every action an AgentPass agent takes is signed, so when you need to reconstruct what happened you have provable evidence, not guesswork. This brings real forensic discipline to agent systems, taught by an instructor qualified in cyber-forensics.

SIGNED

Signed action records

Every tool call and action carries an MCPS signature you can verify later.

IDENTITY

Agent identity & PKI

Which agent acted, under whose authority, bound to a certificate.

NON-REPUDIATION

Non-repudiation

Signed actions and human approvals that cannot be denied later.

REPLAY

Replay protection

Nonces and verification that stop a captured action being replayed.

RECONSTRUCT

Incident reconstruction

Rebuild what an agent did from the tamper-evident, signed trail.

ADMISSIBILITY

Evidence that holds

A record an auditor, a court and a regulator will accept.

GPU-backed labs

Hands-on, deploying on live AgentPass

No slideware. You deploy real agents on a live AgentPass instance backed by cloud GPUs, sign their actions, wire the sanctions checks and the kill switch, and prove the controls hold.

Who it is for

Built for the people shipping agents

Architects

Design agent estates you can deploy, secure, scale and prove.

Platform & DevOps leads

Stand up and operate AgentPass across the estate.

Security engineers

Add agent identity, signing and kill switches to your remit.

Fintech & payments architects

Agents that move money, with OFAC, sanctions and AML built in.

GRC & risk

Govern autonomous action with signed evidence and control.

The certification

AgentPass Certified Architect — CyberSecAI ACA

This is the definitive architect course. The path is clear: complete the Enterprise course plus the AgentPass course, and you earn the AgentPass Certified Architect (CyberSecAI ACA) credential. Assessment is practical: over the four days you architect, deploy and operate a live AgentPass estate, sign its actions, wire the sanctions checks, payments and kill switch, and produce the evidence. On a passing result, the candidate is awarded the credential.

Prefer to start smaller? The 1-day AgentPass hands-on foundation course →

Reserve a place

Architect agent estates you can control and prove.

Four days, hands-on, deploying on live AgentPass, taught by the former OWASP-AISVS Co-Leader (v1.0) and the author of the MCPS, ATTP and agent-payment-trust Internet-Drafts. Places are limited.

4 days intensive, hands-on GPU-backed labs Private corporate cohorts available
Reserve a Place

Corporate & sovereign cohorts, and bespoke on-site delivery, on request.