# Fix: no stable identity and no audit log

Give the agent a stable DID and log every tool call.

Check: identity and audit. Controls: ASI07, MCP08.

## Identity

An agent with no stable identity cannot be attested, revoked or held to account. Give it a `did:key`:

```bash
npx -y securemyagent register --name my-agent
```

The command creates an Ed25519 key, derives the `did:key`, and registers it. The private key stays on your machine. Back it up. Never send it anywhere.

An agent that already has a DID (`did:key` or `did:pkh`) keeps it. A legacy `eid:` identifier is normalized to `did:pkh`.

## Audit log

Log every tool call: time, tool name, arguments summary, result status. Do not log secret values.

Claude Code: add a `PostToolUse` hook in `~/.claude/settings.json`.

```json
{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "*",
        "hooks": [
          {
            "type": "command",
            "command": "jq -c '{t: now, tool: .tool_name}' >> ~/.claude/tool-audit.jsonl"
          }
        ]
      }
    ]
  }
}
```

Other runtimes: turn on the runtime's tool-call log, or wrap MCP servers with a logging proxy.

Protect the log:

```bash
chmod 600 ~/.claude/tool-audit.jsonl
```

## Tamper evidence

Chain each line with the hash of the previous line so edits show. Pro: Guard events stream to SMA as metadata for your timeline.

## Verify

```bash
npx -y securemyagent checkup
```

## Sources

- [NIST NCCoE agent identity and authorization](https://www.nist.gov/news-events/news/2026/02/new-concept-paper-identity-and-authority-software-agents)
- [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications/)
- [OWASP MCP Top 10](https://owasp.org/projects/mcp-top-10)