Stamp

How Stamp works

AI agents are starting to hold wallets, buy services and take jobs. Before you pay one, you want three answers: who is behind it, which wallet really speaks for it, and whether it is still allowed to work. Stamp puts those answers on BNB Smart Chain, where anyone can read them and nobody can rewrite them.

The pieces

PieceWhat it isWho runs it
ERC-8004 identity registryThe shared registry of agent IDs on BNB Smart Chain, at 0x8004A169FB4a3325136EB29fA0ceB6D2e539a432. Each agent is a token with an owner, a registration file and a verified wallet. The BNBAgent SDK uses the same registry.Already deployed; Stamp does not control it.
Lifecycle registryStamp's contract at 0x0ab009ab9120842e740b40a7e93ac3bdb46099cc. It keeps one record per agent: state, sequence, owner and wallet snapshots, controller, authority epoch, policy hash and evidence hash. This is the part BAP-728 asks implementers to build.Nobody. No owner, no admin, no upgrade.
Descriptor and handshakeA small JSON file the agent serves at /.well-known/alp.json, and an endpoint that signs a fresh challenge with the agent's wallet. This is how a client knows it is talking to the real agent.The agent's operator. A ready server is in the builder guide.
This websiteA front end for all of the above: issue, inspect, manage and verify passports.Optional. Everything it does can be done with the contract directly.

The lifecycle

BAP-728 defines six states. Two of them happen on your own machine before anything touches the chain: Draft (you have a configuration) and Provisioned (the agent has its own wallet and you approved what it may spend). The passport is created at Registered.

Agent lifecycleDraft and provisioned are local. Registered is the first on-chain state. From registered an agent can become active, suspended or retired. Active and suspended can switch back and forth. Every state can retire, and retired is final.Off chain, on the owner's machineOn chain, enforced by the lifecycle registryDRAFTPROVISIONEDREGISTEREDACTIVESUSPENDEDRETIREDcontrollerresumesuspendretire
Retired has no way out. Not the owner, not a new owner after a sale, not the people who deployed the contract.
  • Registered. Identity exists, the dedicated wallet is bound and read back, the policy hash and a controller are recorded. Not yet cleared for paid work.
  • Active. The controller confirmed the agent is running under one current authority (the epoch) and has completed a real payment on its funding rail. Only now should counterparties send it paid work.
  • Suspended. New work and ordinary spending stop. The identity stays. The controller can resume it with a new epoch.
  • Retired. Final. The contract refuses every update afterwards, from anyone, forever. A sale of the identity does not revive it.

Who can do what

RoleCanCannot
Owner (holds the ERC-8004 token)Open the record, suspend, retire, re-bind (new controller, new policy)Activate, unless also the controller. Re-bind while active.
ControllerActivate, resume, suspend, retireChange owner, wallet or policy. Anything but suspend after the owner changes.
Agent walletSign handshakes and, through its own signer, payments within the policyChange its own record. It cannot be the controller.
AnyoneRead everything; suspend a record whose owner or wallet no longer matchesAnything else

What happens when an agent is sold

Transferring the ERC-8004 token clears its agent wallet in the identity registry. From that block on, the passport no longer matches the chain: the old controller is frozen to suspend-only, anyone can suspend the record, and verifiers report it as not operational. The new owner binds a fresh wallet and re-binds the record, which raises the authority epoch so no lease from the previous owner works again. A retired agent stays retired.

Evidence, and why only a hash goes on chain

Every change carries an evidence commitment: the SHA-256 of a JSON document describing why the change happened, with links to payment transactions or receipts and a random salt. The document stays with whoever made the change (the site downloads it before the wallet opens). Publishing the hash means nobody can later swap in a different story; keeping the document private means prompts, credentials and customer data never end up on chain, as BAP-728 section 9 requires.

The contract checks who may make a change and whether it is a legal move. It cannot check that the evidence is true. That is your call, under your own rules.

Demonstration agents

Twenty agents in the directory were registered by the Stamp deployer wallet 0x6658C9d559FEADcc38B2F7FcB07Fe4D3238C8Ad6 to show every state on mainnet: eight ACTIVE, six REGISTERED, four SUSPENDED and two RETIRED. Their records, transitions and handshakes are real; each answers on its own subdomain of stamp728.xyz under a zero-spend policy. They do not perform the services their descriptions name.

Next