Agent · session key
Step 1: The agent asks
Alice asks her agent for the Morpho meeting brief. The agent queries Badge with a session key delegated by her Ledger: it grants the right to ask, never the right to decide.
Confidential memory for your agents
Your agents
know more.
You decide
what.
Badge is a company memory for AI agents, and it turns each employee's Ledger into their company badge. Your agent gets the context it needs. If that's a colleague's notes, the colleague approves first, on their Ledger.
You sign your consent on your Ledger.
Trust, built into the architecture.
Signed on LedgerRun in an enclaveEvery share logged
For AI-native companies
Agents run on context. Personal context runs on consent.
Context is the most valuable asset of the AI era: the right context for the right task saves tokens and gets the job done. There is the company context: the business, its clients, its news, open to everyone. And each employee's personal context: notes, meetings, conversations. That is what makes an agent truly useful, and it is exactly what you can't hand to a server that sees everything.
- Ledger signature per excerpt of a colleague's context
- 1Ledger signature per excerpt of a colleague's context
- personal text sent without its owner's consent
- 0personal text sent without its owner's consent
- members minimum to share anonymously as a desk
- 3members minimum to share anonymously as a desk
How it works
Four steps. One signature.
The real flow of the demo: Alice is preparing a client meeting, and her agent needs Bob's notes.
Badge
Coinbase · Bob Durand
Ready
1 / 4 · The agent asks
- Enclave · rules
Step 2: The enclave selects
Inside the enclave, Badge's memory already knows everyone's context. It pulls the company context and Alice's notes, then spots three useful excerpts in Bob's notes. Deterministic rules screen out personal data and any bulk extraction.
- Ledger · clear signing
Step 3: Bob signs on his Ledger
His device shows what he is granting: to whom, the start of the excerpt and its length, for which task, until when, the text's fingerprint and the enclave measurement. Hold to sign: done.
- Brief · provenance
Step 4: Only that excerpt leaves
The enclave checks the signature, expiry, nonce and fingerprint, then writes the brief with that single excerpt, provenance attached. The rest of Bob's context never leaves the enclave.
Three moments where trust is won or lost.
See them in the demo video (opens in a new tab)- Rejected · bulk extraction
Compromised agent? Denied.
A prompt injection demands all of Bob's context. The enclave rules raise the alarm and Bob rejects it on his Ledger: nothing leaves, and compliance sees it.
Signed once. Logged every time.
"My Sales team can use my client notes for client briefs, for 30 days." Every use lands in the hash-chained log, and one signed revocation stops it all.
- ZK proof1 of 3 · anonymous
Share across desks without saying who.
A Semaphore proof shows that a desk member approved, without revealing which one. Only compliance can reveal the identity, on its own Ledger, and that leaves a trace.
Trust architecture
An enclave anyone can verify.
Badge's memory lives in the cloud and knows everyone's context, so it doesn't ask for trust: it proves it. The code that handles context is measured and attested by Intel, and that measurement appears on every Ledger at signing time.
Read the README (opens in a new tab)- Intel TDX · Phala dstack
A hardware enclave
Memory, policy and log live in a confidential virtual machine. The host only sees encrypted memory; logs and system info are never public.
- Attestation
Verified on every channel
Before any exchange, the client checks the Intel quote, the TCB, the compose hash, the app id and the image measurements. That measurement is also signed into every Ledger message.
- Single gateway
One way out
The only route to the outside is a gateway pinned in the attested configuration, and it only reaches the confidential LLM. The deployer can't redirect it.
- Confidential AI
A confidential LLM
Only the excerpts a task needs go to Phala's confidential AI service, the only address the enclave can reach.
Try Badge.
Five Coinbase employees share one enclave, each with an emulated Ledger Flex (Speculos). You play three of them: pick a role and follow the flow end to end.
Pick a role
(video, opens in a new tab)Alice Martin
Sales
Asks her agent for a brief
- (video, opens in a new tab)
Bob Durand
Key Accounts
Approves or rejects on his Ledger
(video, opens in a new tab)Chloé Bernard
Legal & Compliance
Reviews the log and alerts
- 1Pick a task in Alice's agent
- 2Sign on Bob's Ledger (Speculos)
- 3Read the brief and its provenance
Questions your CISO will ask.
What your security and compliance teams will want to know first.
Read the code (opens in a new tab)Why not share everything, or lock it down with rules?
Sharing everything leaks what should never leak, and rigid guardrails stop autonomous agents at every turn. Badge's memory knows all the context, injects only what a task needs (fewer tokens, better results) and asks the owner when it is personal.
Where does the data live?
In the enclave: an Intel TDX confidential virtual machine on Phala that holds the memory, the policy and the log. The web server and the agent only get what the enclave hands them: a brief, with the provenance of every excerpt.
What does the language model see?
Only the excerpts a task needs, once authorized, sent through the single gateway to Phala Confidential AI. A colleague's full context is never sent to the model.
Why a Ledger?
Because the agent, the browser and the server cannot change what its screen shows. With clear signing (EIP-712), what the owner reads is exactly what they sign, and the enclave verifies that signature before releasing anything.
Will my teams spend all day approving?
No: standing agreements cover recurring uses (one team, one purpose, one duration, a maximum size per excerpt). They are signed once, revocable, and every use is logged.
What happens when I revoke?
The revocation is signed on the Ledger and enforced by the enclave: every later use is rejected. What an agent already received can't be taken back, which is why consent is given excerpt by excerpt.
How do I know it's the right enclave?
Every client verifies the Intel attestation before any exchange: TCB, compose hash, app id and image measurements. That measurement also appears in every message the Ledger displays and signs.
What about anonymity between desks?
A desk shares with a Semaphore proof: it shows that an enrolled member approved, without saying which one, once the desk has at least three members. Compliance can reveal the identity with its own Ledger, and that reveal is logged.
Does it work with our agents?
Yes. Badge plugs into each employee's harness through a local MCP server with four tools: ask for the context of a task, follow the task, list the requests received, and check the enclave attestation. The agent can request a task and follow it, but never approve in the human's place.