A Universal Agent ID binds an agent's DID to its delegator, its scopes, a hard limit, and an expiry — ES256-signed. Any party verifies it offline (no callback to the issuer): first the signature against the issuer's JWKS, then a requested action against the claims. Drag time across the validity window and watch the gate.
Honest scope. A deterministic, signable governance primitive. EcoCloud already ships the ES256/JWKS signing + verifyEnvelope crypto; this kernel is the claims half — the canonical signing payload (so everyone hashes the same bytes) and the offline capability check once the signature is verified. The agent's scopes/limit here are a grant that the authority kernel still bounds by the delegator. It issues no money and trusts no caller. Primitive + demo. Source: flowdesk-uaid-kernel.js.