How to Use Solid

Why Integrate Your Agent with Solid? Developer

Autonomous agents -- systems that act persistently on behalf of users across platforms -- create a structural accountability problem: what did the agent do, with what authorisation, and where is the record? Without an answer to these questions, your agent is a liability for your users and for you.

Solid gives you a ready-made answer: every agent action can be written to the user's Pod as a linked data record, under access controls the user sets, in a store the agent cannot tamper with retrospectively. This gives you audit trails, consent management, and revocation -- for free, on open standards.

Authentication Developer

Solid uses Solid-OIDC -- an extension of OpenID Connect where the user's Pod is the identity provider. Your agent authenticates using the user's WebID credentials, not a username/password in your database.

Using @inrupt/solid-client-authn-node

javascript -- agent authentication
import { Session } from "@inrupt/solid-client-authn-node";

const session = new Session();

// Authenticate using client credentials
// (user grants your app a client ID during onboarding)
await session.login({
  oidcIssuer: "https://solidcommunity.net",
  clientId: process.env.CLIENT_ID,
  clientSecret: process.env.CLIENT_SECRET,
});

// session.fetch is now an authenticated fetch
// Use it exactly like the standard fetch API
const response = await session.fetch(podUrl);

Read Data from a Pod Developer

javascript -- read user data from Pod
import {
  getSolidDataset,
  getThing,
  getStringNoLocale
} from "@inrupt/solid-client";
import { FOAF } from "@inrupt/vocab-common-rdf";

// Read user profile from their Pod
const profileUrl = "https://user.solidcommunity.net/profile/card";

const dataset = await getSolidDataset(profileUrl, {
  fetch: session.fetch  // authenticated fetch from login step
});

const profile = getThing(dataset, profileUrl + "#me");
const name = getStringNoLocale(profile, FOAF.name);

console.log(`Hello, ${name}`);

Write Data to a Pod Developer

Writing creates or updates a resource in the user's Pod. Use saveSolidDatasetAt for structured linked data, or a plain PUT for files.

javascript -- write structured data to Pod
import {
  createSolidDataset,
  createThing,
  setStringNoLocale,
  setDatetime,
  setThing,
  saveSolidDatasetAt
} from "@inrupt/solid-client";
import { SCHEMA_INRUPT } from "@inrupt/vocab-common-rdf";

// Create a new record -- e.g. a calendar event
let event = createThing({ name: "appointment-2026-03-11" });

event = setStringNoLocale(event, SCHEMA_INRUPT.name, "Meeting with collaborator");
event = setDatetime(event, SCHEMA_INRUPT.startDate, new Date("2026-03-11T14:00:00Z"));

let dataset = createSolidDataset();
dataset = setThing(dataset, event);

// Save to user's Pod
await saveSolidDatasetAt(
  "https://user.solidcommunity.net/calendar/2026-03-11.ttl",
  dataset,
  { fetch: session.fetch }
);

Audit Logging for Agent Actions Developer

This is the critical pattern for safe agent architecture: every action your agent takes is written to the user's Pod before execution, as an append-only record. The user's ACL on the log container is set to append-only for the agent -- meaning the agent can add records but cannot modify or delete them.

javascript -- write action to audit log before executing
async function logAndExecute(action, podUrl, session) {

  // 1. Build the audit record
  const logEntry = {
    "@context": "https://schema.org/",
    "@type": "Action",
    "name": action.description,
    "target": action.target,
    "instrument": "OpenClaw/1.0",
    "startTime": new Date().toISOString(),
    "actionStatus": "PotentialActionStatus",  // pre-execution
    "agent": { "@type": "SoftwareApplication", "name": "MyAgent" }
  };

  // 2. Write to Pod BEFORE executing
  const logUrl = `${podUrl}agent-logs/${Date.now()}.json`;
  await session.fetch(logUrl, {
    method: "PUT",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(logEntry)
  });

  // 3. Execute the action
  const result = await action.execute();

  // 4. Update log with outcome (append new record, don't modify old)
  await session.fetch(`${podUrl}agent-logs/${Date.now()}-result.json`, {
    method: "PUT",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ ...logEntry, actionStatus: "CompletedActionStatus", result })
  });

  return result;
}

Machine-Readable Consent Tokens Developer

Before executing any sensitive action, your agent checks for a current consent record in the user's Pod that explicitly authorises that action type. If no valid consent record exists, the agent pauses and notifies the user rather than proceeding.

javascript -- check consent before acting
async function checkConsent(actionType, podUrl, session) {
  const consentUrl = `${podUrl}consent/agent-permissions.json`;

  try {
    const res = await session.fetch(consentUrl);
    const consent = await res.json();

    const permission = consent.permissions?.[actionType];
    if (!permission) return false;

    // Check expiry
    const now = new Date();
    const expiry = new Date(permission.expiresAt);
    return now < expiry && permission.granted === true;

  } catch {
    return false; // no consent record = no action
  }
}

// Usage in agent action loop
if (!(await checkConsent("send-email", userPodUrl, session))) {
  await notifyOwner("Consent required for send-email action");
  return;
}
// proceed only if consent confirmed
await logAndExecute(sendEmailAction, userPodUrl, session);

Why You Need a Pod if You Use AI Agents User

If you use an AI agent -- any system that acts autonomously on your behalf, reading your email, sending messages, managing your calendar, browsing the web -- you have a problem you may not have noticed yet: you probably have no reliable record of what it did.

The agent's logs, if they exist, live on the developer's servers. You cannot read them independently. You cannot verify them. If something goes wrong -- an email sent you didn't authorise, a message posted in your name, a file deleted -- you have no sovereign evidence of what happened.

A Solid Pod gives you that. It is a place on the web that you control, where a well-built agent writes a record of every action it takes on your behalf, before it takes it. You can read that record. You can audit it. You can revoke the agent's access at any time.

Set Up Your Pod User

Grant an Agent Access to Your Pod User

When you connect an agent to your Pod, you are giving it a WebID credential -- a key that lets it read or write specific containers. The key principle: grant the minimum necessary access.

In Penny or the Mashlib data browser: navigate to the container, open its access settings, add the agent's WebID, and set the permission level. Changes take effect immediately.

Read Your Agent's Audit Log User

If your agent is writing to /agent-logs/, you can browse those records at any time in Penny or the Mashlib browser. Each record should tell you: what action was taken, when, against what target, and what the outcome was.

What to look for:

Revoke Agent Access User

This is the most important capability Solid gives you. Revoking an agent's access to your Pod does not require contacting the developer, deleting an account, or changing passwords. You remove the agent's WebID from your Pod's ACL. The agent loses access immediately -- to everything you granted, across all containers.