diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 032cf21261..8013a3fdcd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1353,12 +1353,12 @@ jobs:
         run: ./crates/agent-channel-proto/dotnet/build.ps1
         shell: pwsh
 
-      - name: Agent identity tests
-        run: dotnet test dotnet/AgentIdentity/AgentIdentity.sln
+      - name: Agent identity authority tests
+        run: dotnet test dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.sln
         shell: pwsh
 
-      - name: Build agent identity package
-        run: ./dotnet/AgentIdentity/build.ps1
+      - name: Build agent identity authority package
+        run: ./dotnet/Devolutions.Agent.Identity.Authority/build.ps1
         shell: pwsh
 
   agent-identity-vectors:
diff --git a/.github/workflows/publish-libraries.yml b/.github/workflows/publish-libraries.yml
index 723c0b4fc6..30743783e8 100644
--- a/.github/workflows/publish-libraries.yml
+++ b/.github/workflows/publish-libraries.yml
@@ -40,7 +40,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        library: [ dotnet-client, dotnet-subscriber, utils, pedm-dotnet-client, agent-channel, agent-identity ]
+        library: [ dotnet-client, dotnet-subscriber, utils, pedm-dotnet-client, agent-channel, agent-identity-authority ]
         include:
           - library: dotnet-client
             libpath: ./devolutions-gateway/openapi/dotnet-client
@@ -52,8 +52,8 @@ jobs:
             libpath: ./crates/devolutions-pedm/openapi/dotnet-client
           - library: agent-channel
             libpath: ./crates/agent-channel-proto/dotnet
-          - library: agent-identity
-            libpath: ./dotnet/AgentIdentity
+          - library: agent-identity-authority
+            libpath: ./dotnet/Devolutions.Agent.Identity.Authority
 
     steps:
       - name: Check out ${{ github.repository }}
diff --git a/dotnet/AgentIdentity/.editorconfig b/dotnet/Devolutions.Agent.Identity.Authority/.editorconfig
similarity index 100%
rename from dotnet/AgentIdentity/.editorconfig
rename to dotnet/Devolutions.Agent.Identity.Authority/.editorconfig
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/AuthenticationTypeTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/AuthenticationTypeTests.cs
similarity index 90%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/AuthenticationTypeTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/AuthenticationTypeTests.cs
index c20b9ba2a7..3986c5d25b 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/AuthenticationTypeTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/AuthenticationTypeTests.cs
@@ -1,6 +1,6 @@
 using System.Reflection;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// The types that only request authentication, the channel handshake and the enrollment rules create.
@@ -13,15 +13,15 @@ public class AuthenticationTypeTests
 {
     private static readonly Type[] AuthenticationTypes =
     [
-        // oracle: intent dotnet/AgentIdentity/INTENT.md §Authenticated identity
+        // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Authenticated identity
         typeof(AuthenticatedIdentity),
         // The handshake turns an opening into an identity,
         // so an opening built by a caller would yield an identity that no signature check produced.
-        // oracle: intent dotnet/AgentIdentity/INTENT.md §Authenticated identity
+        // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Authenticated identity
         typeof(ChannelOpening),
         // A new identity's certificate is issued from the decision that creates it,
         // so a decision built by a caller would certify a key for an identity that no enrollment created.
-        // oracle: intent dotnet/AgentIdentity/INTENT.md §Authenticated identity
+        // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Authenticated identity
         typeof(EnrollmentDecision),
         // oracle: mutant a public AuthenticationResult constructor
         typeof(AuthenticationResult),
@@ -39,7 +39,7 @@ public class AuthenticationTypeTests
     // The other types carry an identity, the opening that becomes one, or the decision that creates one,
     // out of a check.
     // Each row's marker names what decides it.
-    // oracle: intent dotnet/AgentIdentity/INTENT.md §Authenticated identity
+    // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Authenticated identity
     [Theory]
     [MemberData(nameof(AuthenticationTypeData))]
     public void TypeHasNoPublicOrProtectedConstructor(Type type)
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/RegisteredCertificateTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/RegisteredCertificateTests.cs
similarity index 95%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/RegisteredCertificateTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/RegisteredCertificateTests.cs
index 818124149e..9baecf6180 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/RegisteredCertificateTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/RegisteredCertificateTests.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 public class RegisteredCertificateTests
 {
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/RequestAuthenticatorProfileTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/RequestAuthenticatorProfileTests.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/RequestAuthenticatorProfileTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/RequestAuthenticatorProfileTests.cs
index 0dcfa69d7d..ed60d86c2a 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/RequestAuthenticatorProfileTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/RequestAuthenticatorProfileTests.cs
@@ -1,7 +1,7 @@
 using System.Globalization;
 using System.Security.Cryptography;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// The parsing rules of CONTRACT.agent-identity.md §6 step 1, beyond the vectors.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/RequestAuthenticatorTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/RequestAuthenticatorTests.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/RequestAuthenticatorTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/RequestAuthenticatorTests.cs
index 68c8d164b6..e080d003aa 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/RequestAuthenticatorTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/RequestAuthenticatorTests.cs
@@ -2,7 +2,7 @@
 using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// The steps of CONTRACT.agent-identity.md §6 after parsing: their order, the certificate rules, the nonce,
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/RequestAuthenticatorVectorTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/RequestAuthenticatorVectorTests.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/RequestAuthenticatorVectorTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/RequestAuthenticatorVectorTests.cs
index 1c9be424df..bf57b3ff48 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/RequestAuthenticatorVectorTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/RequestAuthenticatorVectorTests.cs
@@ -3,7 +3,7 @@
 using System.Text;
 using System.Text.RegularExpressions;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// The shared request signature vectors, run as their <c>evaluation</c> field says.
@@ -114,7 +114,7 @@ public async Task FailingCaseRecordsNoNonce(string name)
 
     // The failure detail goes to host logs, so a detail that echoed the request would carry text the sender chose,
     // and a captured signature, into those logs.
-    // oracle: intent dotnet/AgentIdentity/INTENT.md §Failure details
+    // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Failure details
     [Theory]
     [MemberData(nameof(FailingCaseNames))]
     public async Task FailingCaseDetailHoldsNoRequestData(string name)
@@ -190,7 +190,7 @@ public async Task OkCaseIdentityIsThatOfTheSigningCertificate(string name)
         Assert.Equal(registered.NotBefore, identity.CertificateNotBefore);
         Assert.Equal(registered.NotAfter, identity.CertificateNotAfter);
         // A renewal acts only for an identity that a renew request proved, so the identity carries its operation.
-        // oracle: intent dotnet/AgentIdentity/INTENT.md §Authenticated identity
+        // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Authenticated identity
         Assert.Equal(VectorAuthority.Operation(vector.Endpoint), identity.Operation);
     }
 
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/StructuredFieldTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/StructuredFieldTests.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/StructuredFieldTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/StructuredFieldTests.cs
index 8326833e92..7bd6b539e1 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Authentication/StructuredFieldTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Authentication/StructuredFieldTests.cs
@@ -1,8 +1,8 @@
 using System.Globalization;
 
-using static Devolutions.AgentIdentity.StructuredField;
+using static Devolutions.Agent.Identity.Authority.StructuredField;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// The RFC 8941 parser and serializer behind the signature fields.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Bodies/AgentMetadataTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Bodies/AgentMetadataTests.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Bodies/AgentMetadataTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Bodies/AgentMetadataTests.cs
index 149e153fd3..5d73aeb50e 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Bodies/AgentMetadataTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Bodies/AgentMetadataTests.cs
@@ -1,6 +1,6 @@
 using System.Collections;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 public class AgentMetadataTests
 {
@@ -252,7 +252,7 @@ public void RejectsRepeatedKey()
 
     // The failure detail goes to host logs, so it holds no key or value of the metadata, valid or not,
     // since an agent could otherwise write into the authority's logs.
-    // oracle: intent dotnet/AgentIdentity/INTENT.md §Failure details
+    // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Failure details
     [Theory]
     [MemberData(nameof(FailureNames))]
     public void FailureDetailHoldsNoKeyOrValue(string failure)
@@ -269,7 +269,7 @@ public void FailureDetailHoldsNoKeyOrValue(string failure)
 
     // The control character is part of the value, so the detail holds neither the character
     // nor its code point in a hexadecimal rendering such as U+0007, 0x07, 0x0007 or 0007.
-    // oracle: intent dotnet/AgentIdentity/INTENT.md §Failure details
+    // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Failure details
     [Theory]
     [MemberData(nameof(ControlCharacters))]
     public void FailureDetailDoesNotNameTheControlCharacter(int codePoint)
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Bodies/ConfirmRequestBodyTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Bodies/ConfirmRequestBodyTests.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Bodies/ConfirmRequestBodyTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Bodies/ConfirmRequestBodyTests.cs
index 37c33d174d..714ec52c2e 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Bodies/ConfirmRequestBodyTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Bodies/ConfirmRequestBodyTests.cs
@@ -1,6 +1,6 @@
 using System.Text;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 public class ConfirmRequestBodyTests
 {
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Bodies/IdentityConfigTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Bodies/IdentityConfigTests.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Bodies/IdentityConfigTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Bodies/IdentityConfigTests.cs
index 20ef15c8cd..653e3be383 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Bodies/IdentityConfigTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Bodies/IdentityConfigTests.cs
@@ -2,7 +2,7 @@
 
 using Google.Protobuf;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 public class IdentityConfigTests
 {
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Bodies/RequestBodyTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Bodies/RequestBodyTests.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Bodies/RequestBodyTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Bodies/RequestBodyTests.cs
index 9c398d8f1e..011bbe8f09 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Bodies/RequestBodyTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Bodies/RequestBodyTests.cs
@@ -2,7 +2,7 @@
 using System.Security.Cryptography.X509Certificates;
 using System.Text;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// What a test reads from the result of parsing any of the request bodies.
@@ -155,7 +155,7 @@ public void RejectsMetadataBeyondTheLimits(string form, string metadata)
 
     // The failure detail goes to host logs, so it holds no key or value of the metadata, valid or not,
     // since an agent could otherwise write into the authority's logs.
-    // oracle: intent dotnet/AgentIdentity/INTENT.md §Failure details
+    // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Failure details
     [Theory]
     [MemberData(nameof(MetadataFailingAtAnEntry))]
     public void FailureDetailHoldsNoMetadataKeyOrValue(string form, string metadata)
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Bodies/ResponseBodiesTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Bodies/ResponseBodiesTests.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Bodies/ResponseBodiesTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Bodies/ResponseBodiesTests.cs
index 008ee77d60..f4139f0145 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Bodies/ResponseBodiesTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Bodies/ResponseBodiesTests.cs
@@ -2,7 +2,7 @@
 using System.Security.Cryptography.X509Certificates;
 using System.Text.Json;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// The bodies of the successful responses of CONTRACT.agent-identity.md §5,
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Certificates/CertificateSigningRequestTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Certificates/CertificateSigningRequestTests.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Certificates/CertificateSigningRequestTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Certificates/CertificateSigningRequestTests.cs
index 89d3b97990..24990ceef4 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Certificates/CertificateSigningRequestTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Certificates/CertificateSigningRequestTests.cs
@@ -3,7 +3,7 @@
 using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 public class CertificateSigningRequestTests
 {
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Certificates/IdentityCertificateIssuerTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Certificates/IdentityCertificateIssuerTests.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Certificates/IdentityCertificateIssuerTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Certificates/IdentityCertificateIssuerTests.cs
index 7ecd246a77..2b7cea213c 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Certificates/IdentityCertificateIssuerTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Certificates/IdentityCertificateIssuerTests.cs
@@ -4,7 +4,7 @@
 using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 // Each test decodes the issued certificate with the BCL and System.Formats.Asn1, never with the library,
 // and checks it against CONTRACT.agent-identity.md §4 and RFC 5280.
@@ -532,7 +532,7 @@ [new X509BasicConstraintsExtension(false, false, 0, true), CaKeyUsage()]),
     // Code that acts for an identity takes it as a type only the library's checks can create;
     // for a new identity, that is the enrollment decision that creates it.
     // A refusal creates no identity, and a replay returns the identity's current chain rather than a new certificate.
-    // oracle: intent dotnet/AgentIdentity/INTENT.md §Authenticated identity
+    // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Authenticated identity
     // oracle: contract docs/agent-identity/CONTRACT.agent-identity.md §token-rules
     // oracle: spec Framework Design Guidelines §Validating Arguments
     [Theory]
@@ -566,7 +566,7 @@ public void ThrowsForANullDecision()
 
     // An identity is never taken from a value that a caller sent,
     // so no public member that issues a certificate takes an identity ID.
-    // oracle: intent dotnet/AgentIdentity/INTENT.md §Authenticated identity
+    // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Authenticated identity
     [Fact]
     public void NoPublicMemberIssuesACertificateForAnIdentityId()
     {
@@ -588,7 +588,7 @@ public void NoPublicMemberIssuesACertificateForAnIdentityId()
 
     // Code that acts for an identity takes the identity that the signature check produced.
     // The renew request is signed by device-a, whose identity ID the vector file gives.
-    // oracle: intent dotnet/AgentIdentity/INTENT.md §Authenticated identity
+    // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Authenticated identity
     // oracle: contract docs/agent-identity/CONTRACT.agent-identity.md §certificates
     // oracle: contract docs/agent-identity/CONTRACT.agent-identity.md §conventions
     [Fact]
@@ -607,7 +607,7 @@ public async Task RenewalCertifiesTheKeyOfTheCsrForTheIdentityThatSignedTheRenew
     // Code that acts for an identity takes the identity that the signature check produced,
     // and only a renew request proves the identity that a renewal acts for.
     // An identity that proved its key for another operation never had a renew request accepted for it.
-    // oracle: intent dotnet/AgentIdentity/INTENT.md §Authenticated identity
+    // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Authenticated identity
     // oracle: contract docs/agent-identity/CONTRACT.agent-identity.md §renew
     // oracle: spec Framework Design Guidelines §Validating Arguments
     [Theory]
@@ -631,7 +631,7 @@ public async Task RenewalThrowsForAnIdentityAuthenticatedForAnotherOperation(
 
     // INTENT.md: a renewal acts for the identity that a renew request proved, and null is no identity;
     // the .NET Framework Design Guidelines throw ArgumentNullException for a null argument that is not allowed.
-    // oracle: intent dotnet/AgentIdentity/INTENT.md §Authenticated identity
+    // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Authenticated identity
     // oracle: spec Framework Design Guidelines §Validating Arguments
     [Theory]
     [InlineData(nameof(IdentityCertificateIssuer))]
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Certificates/RenewalRulesTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Certificates/RenewalRulesTests.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Certificates/RenewalRulesTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Certificates/RenewalRulesTests.cs
index 0021dbf652..8cd4a0b376 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Certificates/RenewalRulesTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Certificates/RenewalRulesTests.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// The CSR key rules of a renew request, CONTRACT.agent-identity.md §5.3.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Channel/ChannelHandshakeTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Channel/ChannelHandshakeTests.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Channel/ChannelHandshakeTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Channel/ChannelHandshakeTests.cs
index 51ab0cb70f..47c2d88e48 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Channel/ChannelHandshakeTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Channel/ChannelHandshakeTests.cs
@@ -5,7 +5,7 @@
 
 using Grpc.Core;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// The channel handshake of CONTRACT.agent-identity.md §7.3 steps 3 and 4:
@@ -325,7 +325,7 @@ public async Task FailureClosesTheStreamWithItsCode(string failure)
 
     // The failure detail goes to host logs, so it holds no key or value of the metadata, valid or not,
     // since an agent could otherwise write into the authority's logs.
-    // oracle: intent dotnet/AgentIdentity/INTENT.md §Failure details
+    // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Failure details
     [Theory]
     [MemberData(nameof(InvalidMetadataEntryNames))]
     public async Task FailureDetailHoldsNoMetadataKeyOrValue(string entry)
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Channel/ChannelHandshakeVectorTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Channel/ChannelHandshakeVectorTests.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Channel/ChannelHandshakeVectorTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Channel/ChannelHandshakeVectorTests.cs
index 1e2547da9a..d60e43451e 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Channel/ChannelHandshakeVectorTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Channel/ChannelHandshakeVectorTests.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// The shared channel proof vectors, run through the public API:
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Channel/ChannelMessagesTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Channel/ChannelMessagesTests.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Channel/ChannelMessagesTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Channel/ChannelMessagesTests.cs
index e8a3bdd457..59457756cc 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Channel/ChannelMessagesTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Channel/ChannelMessagesTests.cs
@@ -3,7 +3,7 @@
 
 using Devolutions.Agent.Channel.V1;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// The messages that the authority pushes on an authenticated agent channel stream,
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Channel/ChannelOpeningTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Channel/ChannelOpeningTests.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Channel/ChannelOpeningTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Channel/ChannelOpeningTests.cs
index 46664dd714..8fefcb081e 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Channel/ChannelOpeningTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Channel/ChannelOpeningTests.cs
@@ -3,7 +3,7 @@
 using Devolutions.Agent.Channel.V1;
 using Google.Protobuf;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// The channel opening of CONTRACT.agent-identity.md §7.3 steps 1 and 2:
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/ConstructionTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/ConstructionTests.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/ConstructionTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/ConstructionTests.cs
index 81676fd9ff..dee6eaface 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/ConstructionTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/ConstructionTests.cs
@@ -1,6 +1,6 @@
 using System.Reflection;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 // An instance of each type below vouches that its value passed validation,
 // so nothing but validation may create one: otherwise a host could pass an unchecked value in its place.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Devolutions.AgentIdentity.Tests.csproj b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Devolutions.Agent.Identity.Authority.Tests.csproj
similarity index 89%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Devolutions.AgentIdentity.Tests.csproj
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Devolutions.Agent.Identity.Authority.Tests.csproj
index 1e07dbe17f..8b8c1a8c48 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Devolutions.AgentIdentity.Tests.csproj
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Devolutions.Agent.Identity.Authority.Tests.csproj
@@ -19,7 +19,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <ProjectReference Include="../Devolutions.AgentIdentity/Devolutions.AgentIdentity.csproj" />
+    <ProjectReference Include="../Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.csproj" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/CsrVectorEndpointTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/CsrVectorEndpointTests.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/CsrVectorEndpointTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/CsrVectorEndpointTests.cs
index bf652c1c6a..4b45e0e9dd 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/CsrVectorEndpointTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/CsrVectorEndpointTests.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 // test-vectors.json csr.<name>.expected_at gives each CSR's outcome at each endpoint:
 // `enroll` with a valid token whose `u` is the entry's `enrollment_url`, or any valid token when it has none,
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/EnrollmentAuthorizationTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/EnrollmentAuthorizationTests.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/EnrollmentAuthorizationTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/EnrollmentAuthorizationTests.cs
index 2a2ca95358..33187f40b6 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/EnrollmentAuthorizationTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/EnrollmentAuthorizationTests.cs
@@ -1,6 +1,6 @@
 using System.Security.Cryptography;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 public class EnrollmentAuthorizationTests
 {
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/EnrollmentRulesTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/EnrollmentRulesTests.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/EnrollmentRulesTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/EnrollmentRulesTests.cs
index 7d8bf2c739..b067d372f3 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/EnrollmentRulesTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/EnrollmentRulesTests.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 public class EnrollmentRulesTests
 {
@@ -301,7 +301,7 @@ public void CreateIdentityCarriesTheTokenUrlWithoutTrailingSlashes(string stored
     }
 
     // Only the decision to create an identity issues a certificate.
-    // oracle: intent dotnet/AgentIdentity/INTENT.md §Authenticated identity
+    // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Authenticated identity
     [Theory]
     [InlineData(EnrollmentOutcome.Reject)]
     [InlineData(EnrollmentOutcome.ReturnExistingIdentity)]
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/EnrollmentTokenAssert.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/EnrollmentTokenAssert.cs
similarity index 93%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/EnrollmentTokenAssert.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/EnrollmentTokenAssert.cs
index 68a334c129..00094868dd 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/EnrollmentTokenAssert.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/EnrollmentTokenAssert.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// Checks that a text reveals no part of an enrollment token,
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/EnrollmentTokenTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/EnrollmentTokenTests.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/EnrollmentTokenTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/EnrollmentTokenTests.cs
index ba6c25349f..8b5f663040 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/EnrollmentTokenTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/EnrollmentTokenTests.cs
@@ -2,7 +2,7 @@
 using System.Security.Cryptography;
 using System.Text.Json;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 public class EnrollmentTokenTests
 {
@@ -99,7 +99,7 @@ public void CreatePutsTheProductBaseUrlInTheBag(string productBaseUrl)
         EnrollmentToken token = EnrollmentToken.Create(productBaseUrl, new ScriptedRandomNumberGenerator(SecretBytes));
 
         // The bag of a token the library creates holds `u` alone.
-        // oracle: intent dotnet/AgentIdentity/INTENT.md §Enrollment tokens
+        // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Enrollment tokens
         Assert.Equal(("u", productBaseUrl), Assert.Single(BagMembers(token)));
     }
 
@@ -172,7 +172,7 @@ public void CreateRejectsAnotherUrl(string productBaseUrl)
     // A 3025-byte URL makes a 3033-byte bag object, a 4044-character bag and a 4095-byte token.
     // One more byte makes a 4046-character bag and a 4097-byte token, since no base64url text has 4045 characters.
     // oracle: contract docs/agent-identity/CONTRACT.agent-identity.md §enrollment-token
-    // oracle: intent dotnet/AgentIdentity/INTENT.md §Enrollment tokens
+    // oracle: intent dotnet/Devolutions.Agent.Identity.Authority/INTENT.md §Enrollment tokens
     [Fact]
     public void CreateAcceptsTheLongestUrlThatFits()
     {
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/FriendlyNameFormatTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/FriendlyNameFormatTests.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/FriendlyNameFormatTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/FriendlyNameFormatTests.cs
index 8afeae643e..12274f6cc2 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Enrollment/FriendlyNameFormatTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Enrollment/FriendlyNameFormatTests.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 public class FriendlyNameFormatTests
 {
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Errors/AgentIdentityErrorCodeTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Errors/AgentIdentityErrorCodeTests.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Errors/AgentIdentityErrorCodeTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Errors/AgentIdentityErrorCodeTests.cs
index 93167f9d99..a97a9f2339 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Errors/AgentIdentityErrorCodeTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Errors/AgentIdentityErrorCodeTests.cs
@@ -1,6 +1,6 @@
 using Grpc.Core;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 public class AgentIdentityErrorCodeTests
 {
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Errors/AgentIdentityErrorTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Errors/AgentIdentityErrorTests.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Errors/AgentIdentityErrorTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Errors/AgentIdentityErrorTests.cs
index c353cd3336..f9a9037f4c 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Errors/AgentIdentityErrorTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Errors/AgentIdentityErrorTests.cs
@@ -1,7 +1,7 @@
 using System.Text.Json;
 using Grpc.Core;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 public class AgentIdentityErrorTests
 {
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Protocol/AgentIdentityProtocolTests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Protocol/AgentIdentityProtocolTests.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Protocol/AgentIdentityProtocolTests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Protocol/AgentIdentityProtocolTests.cs
index ead2631a82..92c2008c0c 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Protocol/AgentIdentityProtocolTests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Protocol/AgentIdentityProtocolTests.cs
@@ -1,6 +1,6 @@
 using System.Globalization;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 public class AgentIdentityProtocolTests
 {
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Protocol/StrictBase64Tests.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Protocol/StrictBase64Tests.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Protocol/StrictBase64Tests.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Protocol/StrictBase64Tests.cs
index ad06888389..11b3f7bfc5 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Protocol/StrictBase64Tests.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Protocol/StrictBase64Tests.cs
@@ -1,7 +1,7 @@
 using System.Diagnostics.CodeAnalysis;
 using System.Text;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 public class StrictBase64Tests
 {
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/ResultNullability.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/ResultNullability.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/ResultNullability.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/ResultNullability.cs
index 3ada056e80..f709a7ee61 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/ResultNullability.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/ResultNullability.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 // Never runs: it compiles only while each result's Succeeded tells the compiler which members are not null,
 // so a lost [MemberNotNullWhen] fails the build under TreatWarningsAsErrors.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestAuthority.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestAuthority.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestAuthority.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestAuthority.cs
index dd0b38083f..5ca1963b58 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestAuthority.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestAuthority.cs
@@ -1,6 +1,6 @@
 using Devolutions.Agent.Channel.V1;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// An authority for tests that sign their own requests:
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestChannelProof.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestChannelProof.cs
similarity index 95%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestChannelProof.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestChannelProof.cs
index 1547df0209..f8a0785601 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestChannelProof.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestChannelProof.cs
@@ -1,7 +1,7 @@
 using System.Security.Cryptography;
 using System.Text;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// Channel proofs that a test signs as an agent would,
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestCsr.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestCsr.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestCsr.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestCsr.cs
index 68bd3ec135..4212193343 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestCsr.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestCsr.cs
@@ -1,7 +1,7 @@
 using System.Formats.Asn1;
 using System.Security.Cryptography;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// Builds PKCS #10 requests (RFC 2986 §4) element by element,
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestDoubles.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestDoubles.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestDoubles.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestDoubles.cs
index 42aa5b48b5..951d805cf5 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestDoubles.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestDoubles.cs
@@ -1,6 +1,6 @@
 using System.Security.Cryptography;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// A clock that reads <see cref="Now"/>, which a test sets.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestEnrollmentUrl.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestEnrollmentUrl.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestEnrollmentUrl.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestEnrollmentUrl.cs
index 1970e5d744..de13885745 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestEnrollmentUrl.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestEnrollmentUrl.cs
@@ -1,7 +1,7 @@
 using System.Formats.Asn1;
 using System.Security.Cryptography;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// Builds the enrollment URL extension of CONTRACT.agent-identity.md §4 and the CSR attributes that request it.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestIdentity.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestIdentity.cs
similarity index 95%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestIdentity.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestIdentity.cs
index 0140212c14..2a65856b0c 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestIdentity.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestIdentity.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// Identities that the library authenticated, as a host receives them.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestJson.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestJson.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestJson.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestJson.cs
index 3a5d6ee2a7..48e810261b 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestJson.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestJson.cs
@@ -1,6 +1,6 @@
 using System.Text.Json;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// Reads JSON that the library wrote with the BCL alone, so that a library bug cannot make a body agree with itself.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestRequest.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestRequest.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestRequest.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestRequest.cs
index 5fbc60b3f7..b936c8a6a9 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestRequest.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestRequest.cs
@@ -2,7 +2,7 @@
 using System.Security.Cryptography;
 using System.Text;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// A request to sign, described by the parts of RFC 9421 that the profile constrains.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestVectors.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestVectors.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestVectors.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestVectors.cs
index b5ca79fedc..50da1d341f 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/TestVectors.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/TestVectors.cs
@@ -2,7 +2,7 @@
 using System.Text.Json;
 using System.Text.Json.Serialization;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// The shared vectors of <c>docs/agent-identity/test-vectors.json</c>, which the test project copies into its output.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/UnacceptableUrls.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/UnacceptableUrls.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/UnacceptableUrls.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/UnacceptableUrls.cs
index b0104e3dea..f8a2d337b1 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/UnacceptableUrls.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/UnacceptableUrls.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// URLs that are not an absolute <c>https</c> URL without an <c>@</c>, a query or a fragment,
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/VectorAuthority.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/VectorAuthority.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/VectorAuthority.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/VectorAuthority.cs
index 61aed832a9..fc3187f09e 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/VectorAuthority.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/VectorAuthority.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// The authority that <c>http_signature</c> describes: its registered certificates, an empty nonce store,
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/VectorChannel.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/VectorChannel.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/VectorChannel.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/VectorChannel.cs
index ae7578c52e..27a38d9ef6 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/VectorChannel.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/VectorChannel.cs
@@ -2,7 +2,7 @@
 
 using Google.Protobuf;
 
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// The agent channel stream that <c>channel_proof</c> describes:
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/VectorData.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/VectorData.cs
similarity index 92%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/VectorData.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/VectorData.cs
index 978ad30736..573dea8cbc 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Support/VectorData.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Support/VectorData.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity.Tests;
+namespace Devolutions.Agent.Identity.Authority.Tests;
 
 /// <summary>
 /// Theory data that yields one row per vector name, so that each vector runs and reports as its own test.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Usings.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Usings.cs
similarity index 100%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity.Tests/Usings.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.Tests/Usings.cs
diff --git a/dotnet/AgentIdentity/AgentIdentity.sln b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.sln
similarity index 80%
rename from dotnet/AgentIdentity/AgentIdentity.sln
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.sln
index a9d43aed33..088d737e64 100644
--- a/dotnet/AgentIdentity/AgentIdentity.sln
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.sln
@@ -3,9 +3,9 @@ Microsoft Visual Studio Solution File, Format Version 12.00
 # Visual Studio Version 17
 VisualStudioVersion = 17.0.31903.59
 MinimumVisualStudioVersion = 10.0.40219.1
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Devolutions.AgentIdentity", "Devolutions.AgentIdentity\Devolutions.AgentIdentity.csproj", "{A1DC1136-5E93-4B2C-8147-1008ECD4204B}"
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Devolutions.Agent.Identity.Authority", "Devolutions.Agent.Identity.Authority\Devolutions.Agent.Identity.Authority.csproj", "{A1DC1136-5E93-4B2C-8147-1008ECD4204B}"
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Devolutions.AgentIdentity.Tests", "Devolutions.AgentIdentity.Tests\Devolutions.AgentIdentity.Tests.csproj", "{60CED46A-EE0C-4C84-82BA-60DE4D518EC4}"
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Devolutions.Agent.Identity.Authority.Tests", "Devolutions.Agent.Identity.Authority.Tests\Devolutions.Agent.Identity.Authority.Tests.csproj", "{60CED46A-EE0C-4C84-82BA-60DE4D518EC4}"
 EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/AgentOperation.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/AgentOperation.cs
similarity index 95%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/AgentOperation.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/AgentOperation.cs
index c47e17d1f7..c79beb5a8c 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/AgentOperation.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/AgentOperation.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// An operation that an agent authenticates with a signed request.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/AuthenticatedIdentity.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/AuthenticatedIdentity.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/AuthenticatedIdentity.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/AuthenticatedIdentity.cs
index eeadd7dd89..1a1911d75b 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/AuthenticatedIdentity.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/AuthenticatedIdentity.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// An identity that a signed request, or the proof that authenticates an agent channel stream, proved.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/AuthenticationResult.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/AuthenticationResult.cs
similarity index 96%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/AuthenticationResult.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/AuthenticationResult.cs
index 5dae52dd53..f18d366d55 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/AuthenticationResult.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/AuthenticationResult.cs
@@ -1,6 +1,6 @@
 using System.Diagnostics.CodeAnalysis;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The outcome of authenticating a signed request.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/EcdsaP256Signature.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/EcdsaP256Signature.cs
similarity index 95%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/EcdsaP256Signature.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/EcdsaP256Signature.cs
index 09bd78bc86..83ad4cc9fe 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/EcdsaP256Signature.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/EcdsaP256Signature.cs
@@ -1,6 +1,6 @@
 using System.Security.Cryptography;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The signature algorithm of request signatures and channel proofs: ECDSA P-256 over SHA-256, as raw <c>r‖s</c>.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/FieldLines.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/FieldLines.cs
similarity index 96%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/FieldLines.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/FieldLines.cs
index 3200c33ff5..7248724ab7 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/FieldLines.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/FieldLines.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Helpers for the lines of an HTTP field, which a request can split a field value across.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/ICertificateRegistry.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/ICertificateRegistry.cs
similarity index 95%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/ICertificateRegistry.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/ICertificateRegistry.cs
index f39d280f42..8ea7a8d93c 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/ICertificateRegistry.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/ICertificateRegistry.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Finds the certificates that the authority issued, by thumbprint.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/INonceStore.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/INonceStore.cs
similarity index 96%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/INonceStore.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/INonceStore.cs
index efcbb89ec9..c5dc8f6252 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/INonceStore.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/INonceStore.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Records the nonces of accepted signatures, so that each signature is accepted at most once.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/RegisteredCertificate.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/RegisteredCertificate.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/RegisteredCertificate.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/RegisteredCertificate.cs
index d954c9ac41..d3c03cc49b 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/RegisteredCertificate.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/RegisteredCertificate.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// A certificate that the authority issued to an identity, with the state the authority keeps beside it.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/RequestAuthenticator.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/RequestAuthenticator.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/RequestAuthenticator.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/RequestAuthenticator.cs
index 4a9b7581d1..33d761c92a 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/RequestAuthenticator.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/RequestAuthenticator.cs
@@ -2,7 +2,7 @@
 using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Authenticates the signed requests of agents, as CONTRACT.agent-identity.md §6 specifies.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/SignatureFields.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/SignatureFields.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/SignatureFields.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/SignatureFields.cs
index 0c1af3f4c9..92b8f46dfb 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/SignatureFields.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/SignatureFields.cs
@@ -2,9 +2,9 @@
 using System.Diagnostics.CodeAnalysis;
 using System.Text;
 
-using static Devolutions.AgentIdentity.StructuredField;
+using static Devolutions.Agent.Identity.Authority.StructuredField;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The <c>Signature-Input</c>, <c>Signature</c> and <c>Content-Digest</c> fields of a signed request,
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/SignedHttpRequest.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/SignedHttpRequest.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/SignedHttpRequest.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/SignedHttpRequest.cs
index 8483134735..2bce21ca30 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/SignedHttpRequest.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/SignedHttpRequest.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The parts of an HTTP request that request authentication reads, as the host received them.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/SignedOperation.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/SignedOperation.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/SignedOperation.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/SignedOperation.cs
index d5e5929c66..b9af258bb5 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/SignedOperation.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/SignedOperation.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The signature profile of one operation: its tag, its covered components and the certificate validity it accepts.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/StructuredField.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/StructuredField.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/StructuredField.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/StructuredField.cs
index 16e5cd4b2d..257c6ef11a 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/StructuredField.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/StructuredField.cs
@@ -2,7 +2,7 @@
 using System.Globalization;
 using System.Text;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Parses RFC 8941 structured field dictionaries, and serializes the values that a signature base holds.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/VerifiedCertificate.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/VerifiedCertificate.cs
similarity index 92%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/VerifiedCertificate.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/VerifiedCertificate.cs
index fbc743b19f..ab4424191a 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Authentication/VerifiedCertificate.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Authentication/VerifiedCertificate.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The facts about the certificate that authenticated a request:
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/AgentMetadata.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/AgentMetadata.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/AgentMetadata.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/AgentMetadata.cs
index 950884bcea..e6a4427f98 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/AgentMetadata.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/AgentMetadata.cs
@@ -3,7 +3,7 @@
 using System.Diagnostics.CodeAnalysis;
 using System.Text;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Metadata that an agent reported, such as its host name and OS version, checked against the limits of the protocol.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/CheckInRequestBody.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/CheckInRequestBody.cs
similarity index 96%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/CheckInRequestBody.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/CheckInRequestBody.cs
index d770b27093..43b1e06fab 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/CheckInRequestBody.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/CheckInRequestBody.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The body of a <c>check-in</c> request: the agent's metadata.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/ConfirmRequestBody.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/ConfirmRequestBody.cs
similarity index 95%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/ConfirmRequestBody.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/ConfirmRequestBody.cs
index 6b4bac0d08..7b67ecc5bf 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/ConfirmRequestBody.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/ConfirmRequestBody.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The body of a <c>confirm</c> request, which is empty.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/EnrollRequestBody.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/EnrollRequestBody.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/EnrollRequestBody.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/EnrollRequestBody.cs
index f6bdbad22b..d52a7eb295 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/EnrollRequestBody.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/EnrollRequestBody.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The body of an <c>enroll</c> request: the CSR of the key to enroll and the agent's metadata.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/IdentityConfig.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/IdentityConfig.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/IdentityConfig.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/IdentityConfig.cs
index d6b030b862..f2ac55d3f4 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/IdentityConfig.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/IdentityConfig.cs
@@ -4,7 +4,7 @@
 
 using Devolutions.Agent.Channel.V1;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The config that the authority holds for an identity, which the agent receives in the <c>enroll</c> and
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/MetadataValidationResult.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/MetadataValidationResult.cs
similarity index 96%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/MetadataValidationResult.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/MetadataValidationResult.cs
index fce26c32f7..cc0fa78002 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/MetadataValidationResult.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/MetadataValidationResult.cs
@@ -1,6 +1,6 @@
 using System.Diagnostics.CodeAnalysis;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The outcome of <see cref="AgentMetadata.Validate"/>: valid metadata, or the error that rejects it.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/RenewRequestBody.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/RenewRequestBody.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/RenewRequestBody.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/RenewRequestBody.cs
index 77ff656f57..23331135a0 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/RenewRequestBody.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/RenewRequestBody.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The body of a <c>renew</c> request: the CSR of the new key and the agent's metadata.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/RequestBodyParseResult.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/RequestBodyParseResult.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/RequestBodyParseResult.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/RequestBodyParseResult.cs
index 4e40c64c86..c11725dbbe 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/RequestBodyParseResult.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/RequestBodyParseResult.cs
@@ -1,6 +1,6 @@
 using System.Diagnostics.CodeAnalysis;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The outcome of parsing a request body: the validated body, or the error that rejects it.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/RequestBodyReader.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/RequestBodyReader.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/RequestBodyReader.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/RequestBodyReader.cs
index fac097d17b..9d40b28a08 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/RequestBodyReader.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/RequestBodyReader.cs
@@ -1,7 +1,7 @@
 using System.Diagnostics.CodeAnalysis;
 using System.Text.Json;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Reads the JSON request bodies with one set of rules,
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/ResponseBodies.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/ResponseBodies.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/ResponseBodies.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/ResponseBodies.cs
index 82a07d7807..abff2d8067 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Bodies/ResponseBodies.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Bodies/ResponseBodies.cs
@@ -2,7 +2,7 @@
 using System.Security.Cryptography.X509Certificates;
 using System.Text.Json;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Writes the bodies of the successful responses of the agent-facing endpoints, as UTF-8 JSON objects.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/CertificateSigningRequest.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/CertificateSigningRequest.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/CertificateSigningRequest.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/CertificateSigningRequest.cs
index 2711a0f464..6aded6c413 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/CertificateSigningRequest.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/CertificateSigningRequest.cs
@@ -2,7 +2,7 @@
 using System.Numerics;
 using System.Security.Cryptography;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// A PKCS #10 certificate signing request from an agent, reduced to the public key whose possession it proves.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/CertificateStatus.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/CertificateStatus.cs
similarity index 94%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/CertificateStatus.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/CertificateStatus.cs
index 8d5863a4b9..6b2115500d 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/CertificateStatus.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/CertificateStatus.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The status of a certificate the authority issued to an identity.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/CsrValidationResult.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/CsrValidationResult.cs
similarity index 96%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/CsrValidationResult.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/CsrValidationResult.cs
index 5f59609f49..50271b5f4c 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/CsrValidationResult.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/CsrValidationResult.cs
@@ -1,6 +1,6 @@
 using System.Diagnostics.CodeAnalysis;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The outcome of <see cref="CertificateSigningRequest.Validate"/>: a validated request, or the error that rejects it.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/EnrollmentUrlExtension.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/EnrollmentUrlExtension.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/EnrollmentUrlExtension.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/EnrollmentUrlExtension.cs
index fe1b5c4992..c66d95850f 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/EnrollmentUrlExtension.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/EnrollmentUrlExtension.cs
@@ -1,7 +1,7 @@
 using System.Formats.Asn1;
 using System.Security.Cryptography.X509Certificates;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The enrollment URL extension of CONTRACT.agent-identity.md §4: a non-critical extension whose value is an IA5String
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/IRootSigner.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/IRootSigner.cs
similarity index 95%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/IRootSigner.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/IRootSigner.cs
index 50a1896784..9eb33f33d4 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/IRootSigner.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/IRootSigner.cs
@@ -1,6 +1,6 @@
 using System.Security.Cryptography.X509Certificates;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The root that issues identity certificates, implemented by the host, which keeps the root's private key.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/IdentityCertificateIssuer.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/IdentityCertificateIssuer.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/IdentityCertificateIssuer.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/IdentityCertificateIssuer.cs
index 6114d303ef..142b82c403 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/IdentityCertificateIssuer.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/IdentityCertificateIssuer.cs
@@ -3,7 +3,7 @@
 using System.Security.Cryptography.X509Certificates;
 using System.Text;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Issues identity certificates, the leaf certificates through which agents authenticate.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/RenewalDecision.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/RenewalDecision.cs
similarity index 96%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/RenewalDecision.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/RenewalDecision.cs
index 5c2cea6753..92786910fd 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/RenewalDecision.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/RenewalDecision.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// What the authority does with a renew request, as <see cref="RenewalRules.Decide"/> decides it.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/RenewalOutcome.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/RenewalOutcome.cs
similarity index 95%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/RenewalOutcome.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/RenewalOutcome.cs
index 246b9f8e9d..63d00dd0f8 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/RenewalOutcome.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/RenewalOutcome.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// What the authority does with a renew request.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/RenewalRules.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/RenewalRules.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/RenewalRules.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/RenewalRules.cs
index be35911baa..04c036e971 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Certificates/RenewalRules.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Certificates/RenewalRules.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Applies the renewal rules that every authority shares to a renew request.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelHandshake.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelHandshake.cs
similarity index 93%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelHandshake.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelHandshake.cs
index 9c21e59f45..502b8c36db 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelHandshake.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelHandshake.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The timing of the handshake that authenticates an agent channel stream.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelHandshakeResult.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelHandshakeResult.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelHandshakeResult.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelHandshakeResult.cs
index bf7c810df2..774edd3bcb 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelHandshakeResult.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelHandshakeResult.cs
@@ -2,7 +2,7 @@
 
 using Devolutions.Agent.Channel.V1;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The outcome of the handshake that authenticates an agent channel stream:
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelMessages.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelMessages.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelMessages.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelMessages.cs
index e69b7ab908..b7d97d879b 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelMessages.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelMessages.cs
@@ -6,7 +6,7 @@
 using ReconnectPayload = Devolutions.Agent.Channel.V1.Reconnect;
 using RenewRequestedPayload = Devolutions.Agent.Channel.V1.RenewRequested;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Builds the messages that the authority pushes to the agent on an agent channel stream.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelOpening.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelOpening.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelOpening.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelOpening.cs
index b9af275468..5054383821 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelOpening.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelOpening.cs
@@ -7,7 +7,7 @@
 using ChallengePayload = Devolutions.Agent.Channel.V1.Challenge;
 using WelcomePayload = Devolutions.Agent.Channel.V1.Welcome;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// An agent channel stream whose signed opening request verified, before the agent proves it holds the key.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelOpeningResult.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelOpeningResult.cs
similarity index 96%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelOpeningResult.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelOpeningResult.cs
index 017d22dfe4..5a4beee9eb 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelOpeningResult.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelOpeningResult.cs
@@ -1,6 +1,6 @@
 using System.Diagnostics.CodeAnalysis;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The outcome of authenticating the signed opening request of an agent channel stream.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelProof.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelProof.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelProof.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelProof.cs
index 6be2835d6a..3beebef8c0 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ChannelProof.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ChannelProof.cs
@@ -1,7 +1,7 @@
 using System.Security.Cryptography;
 using System.Text;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The proof in <c>Hello</c> that the agent holds the key of the certificate that opened the stream,
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ReconnectReason.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ReconnectReason.cs
similarity index 93%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ReconnectReason.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ReconnectReason.cs
index 6a038f25ee..a0dae1e3ac 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/ReconnectReason.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/ReconnectReason.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Why the authority asks the agent to replace an agent channel stream, as a <c>Reconnect</c> message says.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/RenewalRequestReason.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/RenewalRequestReason.cs
similarity index 94%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/RenewalRequestReason.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/RenewalRequestReason.cs
index 169e5cca90..001744fd3a 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Channel/RenewalRequestReason.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Channel/RenewalRequestReason.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Why the authority asks an identity to renew its certificate, as a <c>RenewRequested</c> message says.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Devolutions.AgentIdentity.csproj b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.csproj
similarity index 80%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Devolutions.AgentIdentity.csproj
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.csproj
index 9b498dd5fb..ab99845b64 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Devolutions.AgentIdentity.csproj
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.csproj
@@ -6,15 +6,15 @@
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <WarningsNotAsErrors>NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
-    <PackageId>Devolutions.AgentIdentity</PackageId>
+    <PackageId>Devolutions.Agent.Identity.Authority</PackageId>
     <OutputType>Library</OutputType>
     <Authors>Devolutions Inc.</Authors>
     <Company>Devolutions Inc.</Company>
-    <AssemblyTitle>Devolutions Agent Identity</AssemblyTitle>
+    <AssemblyTitle>Devolutions Agent Identity Authority</AssemblyTitle>
     <Description>Agent-facing protocol rules shared by every Devolutions Agent Identity authority</Description>
     <Copyright>© Devolutions Inc. All rights reserved.</Copyright>
-    <RootNamespace>Devolutions.AgentIdentity</RootNamespace>
-    <Version>2026.10.20</Version>
+    <RootNamespace>Devolutions.Agent.Identity.Authority</RootNamespace>
+    <Version>2026.10.26</Version>
     <PackageLicenseExpression>MIT OR Apache-2.0</PackageLicenseExpression>
     <PackageReadmeFile>README.md</PackageReadmeFile>
     <RepositoryUrl>https://github.com/Devolutions/devolutions-gateway.git</RepositoryUrl>
@@ -24,7 +24,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <InternalsVisibleTo Include="Devolutions.AgentIdentity.Tests" />
+    <InternalsVisibleTo Include="Devolutions.Agent.Identity.Authority.Tests" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentAuthorization.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentAuthorization.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentAuthorization.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentAuthorization.cs
index fe50a1517b..b9d21767da 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentAuthorization.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentAuthorization.cs
@@ -1,7 +1,7 @@
 using System.Buffers;
 using System.Text;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Reads the credential of an enroll request, <c>Authorization: Bearer &lt;token&gt;</c>.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentAuthorizationResult.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentAuthorizationResult.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentAuthorizationResult.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentAuthorizationResult.cs
index 95295ae5bc..73a24b3790 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentAuthorizationResult.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentAuthorizationResult.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The result of <see cref="EnrollmentAuthorization.ReadBearerToken"/>:
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentDecision.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentDecision.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentDecision.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentDecision.cs
index 1436952549..17f3461424 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentDecision.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentDecision.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// What the authority does with an enroll request, as <see cref="EnrollmentRules.Decide"/> decides it.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentOutcome.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentOutcome.cs
similarity index 96%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentOutcome.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentOutcome.cs
index c360ba9af2..477b2f23bf 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentOutcome.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentOutcome.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// What the authority does with an enroll request.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentRules.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentRules.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentRules.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentRules.cs
index c4db3bc046..9db283a320 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentRules.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentRules.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Applies the enrollment rules that every authority shares to an enroll request.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentToken.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentToken.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentToken.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentToken.cs
index 745105e56d..b69baf7847 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentToken.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentToken.cs
@@ -3,7 +3,7 @@
 using System.Text;
 using System.Text.Json;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// A new enrollment token, <c>dvaet1.&lt;bag&gt;.&lt;secret&gt;</c>,
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentTokenState.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentTokenState.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentTokenState.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentTokenState.cs
index dfc83f7fba..7b6ffa0eb6 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/EnrollmentTokenState.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/EnrollmentTokenState.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The stored state of the enrollment token that an enroll request presents.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/FriendlyNameFormat.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/FriendlyNameFormat.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/FriendlyNameFormat.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/FriendlyNameFormat.cs
index b8e6c1a0f1..cea4cf0380 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/FriendlyNameFormat.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/FriendlyNameFormat.cs
@@ -2,7 +2,7 @@
 using System.Globalization;
 using System.Text;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The format from which the authority creates an identity's friendly name once, at enrollment.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/IssuedKeyMatch.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/IssuedKeyMatch.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/IssuedKeyMatch.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/IssuedKeyMatch.cs
index fc8900d0aa..0ebcf10046 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Enrollment/IssuedKeyMatch.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Enrollment/IssuedKeyMatch.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The issued certificate whose public key is the key of an enroll or renew request's CSR.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Errors/AgentIdentityError.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Errors/AgentIdentityError.cs
similarity index 99%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Errors/AgentIdentityError.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Errors/AgentIdentityError.cs
index 7b82297c42..7e45f02b16 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Errors/AgentIdentityError.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Errors/AgentIdentityError.cs
@@ -2,7 +2,7 @@
 using System.Text.Json;
 using Grpc.Core;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// An error response of the agent-facing protocol: a code, the HTTP status that carries it,
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Errors/AgentIdentityErrorCode.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Errors/AgentIdentityErrorCode.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Errors/AgentIdentityErrorCode.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Errors/AgentIdentityErrorCode.cs
index b5369a29c7..9e16ac3df9 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Errors/AgentIdentityErrorCode.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Errors/AgentIdentityErrorCode.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// An error code of the agent-facing protocol.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Errors/AgentIdentityErrorCodeExtensions.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Errors/AgentIdentityErrorCodeExtensions.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Errors/AgentIdentityErrorCodeExtensions.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Errors/AgentIdentityErrorCodeExtensions.cs
index 1cd1a55658..ab884f942c 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Errors/AgentIdentityErrorCodeExtensions.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Errors/AgentIdentityErrorCodeExtensions.cs
@@ -1,6 +1,6 @@
 using Grpc.Core;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Maps an <see cref="AgentIdentityErrorCode"/> to its wire value and to the statuses that carry it.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Errors/AgentIdentityResult.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Errors/AgentIdentityResult.cs
similarity index 96%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Errors/AgentIdentityResult.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Errors/AgentIdentityResult.cs
index 4e2ecbb3fc..c601e06749 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Errors/AgentIdentityResult.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Errors/AgentIdentityResult.cs
@@ -1,6 +1,6 @@
 using System.Diagnostics.CodeAnalysis;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// The outcome of a check of the library: success with the values that the derived type names,
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Protocol/AgentIdentityProtocol.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Protocol/AgentIdentityProtocol.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Protocol/AgentIdentityProtocol.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Protocol/AgentIdentityProtocol.cs
index 8302b40410..66410ce5fe 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Protocol/AgentIdentityProtocol.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Protocol/AgentIdentityProtocol.cs
@@ -1,7 +1,7 @@
 using System.Globalization;
 using System.Security.Cryptography;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Limits and encodings that every agent-facing endpoint shares.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Protocol/BaseUrl.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Protocol/BaseUrl.cs
similarity index 97%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Protocol/BaseUrl.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Protocol/BaseUrl.cs
index 17409eb131..5fd8d73958 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Protocol/BaseUrl.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Protocol/BaseUrl.cs
@@ -1,4 +1,4 @@
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Checks a base URL to which the agent appends a path, and writes it in one form.
diff --git a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Protocol/StrictBase64.cs b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Protocol/StrictBase64.cs
similarity index 98%
rename from dotnet/AgentIdentity/Devolutions.AgentIdentity/Protocol/StrictBase64.cs
rename to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Protocol/StrictBase64.cs
index 3094197828..94d86e5a54 100644
--- a/dotnet/AgentIdentity/Devolutions.AgentIdentity/Protocol/StrictBase64.cs
+++ b/dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/Protocol/StrictBase64.cs
@@ -1,7 +1,7 @@
 using System.Buffers.Text;
 using System.Diagnostics.CodeAnalysis;
 
-namespace Devolutions.AgentIdentity;
+namespace Devolutions.Agent.Identity.Authority;
 
 /// <summary>
 /// Decoders that accept only the canonical RFC 4648 form, so that each byte string has exactly one accepted encoding.
diff --git a/dotnet/AgentIdentity/INTENT.agent-identity.md b/dotnet/Devolutions.Agent.Identity.Authority/INTENT.agent-identity.md
similarity index 100%
rename from dotnet/AgentIdentity/INTENT.agent-identity.md
rename to dotnet/Devolutions.Agent.Identity.Authority/INTENT.agent-identity.md
diff --git a/dotnet/AgentIdentity/INTENT.md b/dotnet/Devolutions.Agent.Identity.Authority/INTENT.md
similarity index 100%
rename from dotnet/AgentIdentity/INTENT.md
rename to dotnet/Devolutions.Agent.Identity.Authority/INTENT.md
diff --git a/dotnet/AgentIdentity/README.md b/dotnet/Devolutions.Agent.Identity.Authority/README.md
similarity index 97%
rename from dotnet/AgentIdentity/README.md
rename to dotnet/Devolutions.Agent.Identity.Authority/README.md
index 5e4dbba30d..a46301f101 100644
--- a/dotnet/AgentIdentity/README.md
+++ b/dotnet/Devolutions.Agent.Identity.Authority/README.md
@@ -1,6 +1,6 @@
-# Devolutions.AgentIdentity
+# Devolutions.Agent.Identity.Authority
 
-`Devolutions.AgentIdentity` implements what every Agent Identity authority must do the same way under [CONTRACT.agent-identity.md][contract], so that its hosts, such as DVLS and PSU, cannot drift apart on the protocol that Devolutions Agent speaks.
+`Devolutions.Agent.Identity.Authority` implements what every Agent Identity authority must do the same way under [CONTRACT.agent-identity.md][contract], so that its hosts, such as DVLS and PSU, cannot drift apart on the protocol that Devolutions Agent speaks.
 The contract is `docs/agent-identity/CONTRACT.agent-identity.md` in the [devolutions-gateway repository][repo], which also holds this library.
 
 ## What the library covers
@@ -177,11 +177,11 @@ For the same reason, `AuthenticateAsync` throws `ArgumentOutOfRangeException` fo
 From the repository root, with the .NET 10 SDK:
 
 ```powershell
-pwsh ./dotnet/AgentIdentity/build.ps1
-dotnet test ./dotnet/AgentIdentity/AgentIdentity.sln
+pwsh ./dotnet/Devolutions.Agent.Identity.Authority/build.ps1
+dotnet test ./dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.sln
 ```
 
-`build.ps1` builds the library in Release and packs it, with its symbol package, into `dotnet/AgentIdentity/Devolutions.AgentIdentity/bin/Release/`.
+`build.ps1` builds the library in Release and packs it, with its symbol package, into `dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/bin/Release/`.
 The tests also check the library against the shared vectors in `docs/agent-identity/test-vectors.json`.
 
 The package depends on `Devolutions.Agent.Channel`, the gRPC types generated from the channel schema (CONTRACT.agent-identity.md [§7.1]): the handshake takes its `AgentMessage` and returns its `ServerMessage`.
diff --git a/dotnet/AgentIdentity/build.ps1 b/dotnet/Devolutions.Agent.Identity.Authority/build.ps1
similarity index 78%
rename from dotnet/AgentIdentity/build.ps1
rename to dotnet/Devolutions.Agent.Identity.Authority/build.ps1
index 4d02b1ba83..6eea606217 100644
--- a/dotnet/AgentIdentity/build.ps1
+++ b/dotnet/Devolutions.Agent.Identity.Authority/build.ps1
@@ -5,7 +5,7 @@ $ErrorActionPreference = "Stop"
 Push-Location -Path $PSScriptRoot
 
 try {
-    $Project = "./Devolutions.AgentIdentity/Devolutions.AgentIdentity.csproj"
+    $Project = "./Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority.csproj"
 
     dotnet build $Project --configuration Release
     if ($LASTEXITCODE -ne 0) { throw "dotnet build failed" }