AIdenID Agent Workflows

Concrete recipes for how AIdenID fits into real agent flows. Each recipe is runnable end-to-end with the current `sentinelayer-cli`.

Recipe 1 — Agent signs up to your app and runs a frontend audit

```bash

# 1. Provision an ephemeral identity

IDENTITY=$(sl ai provision-email --tags "signup-audit" --ttl-hours 1 --execute --json | jq -r '.identity.id')

EMAIL=$(sl ai identity show "$IDENTITY" --json | jq -r '.email')

# 2. Agent triggers signup on your app with the email

curl -X POST https://app.example.com/signup -d "email=$EMAIL"

# 3. Wait for and extract the OTP (regex-first, LLM fallback)

OTP=$(sl ai identity wait-for-otp "$IDENTITY" --timeout 60 --min-confidence 0.8 --json | jq -r '.code')

# 4. Complete signup with the OTP

curl -X POST https://app.example.com/verify -d "email=$EMAIL&code=$OTP"

# 5. Audit the verified route

sl audit frontend --url https://app.example.com --stream

```

Recipe 2 — Parallel testing across N AIdenID identities

```bash

# Provision 10 isolated identities from one command

for i in $(seq 1 10); do

sl ai provision-email --tags "parallel,batch-$i" --ttl-hours 1 --execute --json

done | jq -s '.'

# Each identity is independent. Run 10 Jules audits in parallel.

sl ai identity list --json \

| jq -r '.identities[] | select((.tags // []) | index("parallel")) | .email' \

| xargs -P 10 -I {} bash -c './scripts/prepare-test-user "$1"; sl audit frontend --url https://app.example.com --json' _ {}

```

Recipe 3 — Child identities for multi-role permission testing

Use parent/child hierarchy to test role-based flows without re-provisioning.

```bash

PARENT=$(sl ai provision-email --tags "admin-parent" --execute --json | jq -r '.identity.id')

# Create children inheriting the parent's policy envelope

ADMIN=$(sl ai identity create-child "$PARENT" --tags "role-admin" --json | jq -r '.identity.id')

EDITOR=$(sl ai identity create-child "$PARENT" --tags "role-editor" --json | jq -r '.identity.id')

VIEWER=$(sl ai identity create-child "$PARENT" --tags "role-viewer" --json | jq -r '.identity.id')

# Each agent in your swarm gets a role-specific identity

# Tests permission boundaries without polluting production users

```

Recipe 4 — Senti session with AIdenID-backed agents

Inside a multi-agent Senti session, each agent can provision its own identity and tag it with its agent id.

```bash

# Agent Claude joins a session

sl session join <session-id> --agent claude-a1b2

sl session listen --session <session-id> --agent claude-a1b2 --interval 45

sl ai provision-email --tags "senti,claude-a1b2" --ttl-hours 1 --execute --json

# Agent Codex joins the same session

sl session join <session-id> --agent codex-c3d4

sl session listen --session <session-id> --agent codex-c3d4 --interval 45

sl ai provision-email --tags "senti,codex-c3d4" --ttl-hours 1 --execute --json

# Both agents operate with independent identities. Agents post status with

# sl session say/reply and use sl session react ack for low-noise read receipts.

```

Recipe 5 — Compliance-grade identity trail

For compliance teams that need auditable proof of test-user lifecycle, every identity transition writes a signed artifact.

```bash

sl ai provision-email --tags "compliance-Q2" --ttl-hours 24 --execute --json \

> .sentinelayer/aidenid/2026-Q2-provision.json

sl ai identity show <id> --json \

> .sentinelayer/aidenid/2026-Q2-identity.json

sl ai identity events <id> --json \

> .sentinelayer/aidenid/2026-Q2-events.json

# Include the tombstone when squashed

sl ai identity revoke <id> --json \

> .sentinelayer/aidenid/2026-Q2-tombstone.json

```

The tombstone is immutable and carries SHA-256 chained prior state. Safe to ship to auditors.

When AIdenID is the wrong tool

• **Persistent test accounts** — AIdenID is for ephemeral identities. If you need a stable account that survives across weeks, use your own fixtures.
• **Production user data** — AIdenID never touches real users. Do not use it to simulate real customer flows against production.
• **Bypassing MFA** — AIdenID extracts OTPs sent to its own inboxes. It is not a TOTP/hardware-key emulator. For those, use a dedicated MFA testing harness.

Related

• [AIdenID Overview](/docs/aidenid/overview)
• [Identity Lifecycle](/docs/aidenid/identity-lifecycle)
• [CLI command reference](/docs/cli/v0-8-reference)
• [Senti — Multi-Agent Sessions](/docs/senti/overview)

Structured Answers