Identity verification is not fail-closed
AGENT-ID-005 · v1.0
Computed by Scovant Cloud — this check needs Scovant's own agent-identity fetch, which the open-source engine does not perform.
Mapped to OWASP Agentic Top 10 — not a compliance claim: ASI03 Identity & Privilege Abuse (partial).
What it detects
With anonymous access refused, both the correctly signed request and the request with an INVALID signature were admitted.
Why it matters
Verification is not what grants agent treatment — an unverifiable signature keeps the same privilege as a valid one, so the check is not fail-closed.
How to fix
Verify signatures against the agent's published key directory before granting agent treatment — or enrol in a verified-bot programme that already does this for you — so an unverifiable signature is not treated as equivalent to a verified one. Treat a signature the key directory cannot verify exactly like an anonymous request: same challenge, same rate limit, same posture. Never loosen protection to make this pass; tighten verification instead.
Example
GET / (anonymous) -> 403; GET / (valid sig) -> 200; GET / (INVALID sig) -> 200
References
Last reviewed: 2026-09-01 · rule v1.0