Workload identity — the discipline of giving software processes cryptographically verifiable identities — grew up in the data center, where the credential authority is a service a few network hops away and "unreachable" means an incident, not an operating condition. Short credential lifetimes are a real security feature: a token that expires in hours limits the blast radius of theft, provided the workload can return to its issuer for a fresh one.
Autonomous agent meshes break that proviso. An agent cluster at a remote site loses its WAN link for an hour. A convoy in a contested environment sees its uplink jammed. An edge deployment keeps coordinating locally while its trust-domain credential service is unreachable. In each case the agents are healthy, mutually authenticated, and mid-task — and their credentials are counting down toward an expiry the architecture never decided how to handle.
This is not an oversight in any one system. Fast revocation assumes revocation messages can be delivered. Timely rotation assumes the rotation endpoint answers. No normative guidance exists — not in the IETF's WIMSE architecture, not in SPIFFE/SPIRE, not in physical-AI mission authorities, not in agent registry systems such as the NANDA Index — for what a healthy-but-severed workload should do when its credential expires.
The naive answers occupy the two ends of a spectrum, and both are wrong. Fail-closed makes partition a weapon: an adversary who can keep a link down for one TTL disables an agent without touching it. Fail-open makes compromise permanent: a node that can renew itself needs no issuer, and therefore answers to none.
AgentClock closes that gap by making the extension itself a verifiable object. A severed agent broadcasts a signed request; a quorum of peers who have observed its recent health, and who hold issuer-anchored credentials of their own, each independently verify that the request only extends existing authority — never widens it — and return a signed attestation. Two design choices carry the weight. The extension is bounded: a ceiling measured from original issuance, never reset by a later round, so a partition that never heals still terminates on a known schedule. And it is superseded on sight — the moment the issuer is reachable again, its own credential replaces whatever the peers attested to, and the full chain of attestations is handed over for audit.