Re: AIW #3 (Nov 6, Mountain View) — two proposed topics for the opening circle, and a request

Hi Xinghua,

I completely agree with your Topic 2 regarding revocable, auditable
authority for agent chains. I'm the founder of NTI (Neutral Trust
Infrastructure), a W3C participant.

We actually have a working implementation for this. We use Merkle-chained
proofs and Dilithium5 signatures to cryptographically bind execution-time
consent to tool calls, preventing agents from exceeding their mandate.

If someone is attending AIW in person and raises this, please point them to
our live leaderboard (https://nti-leaderboard.vercel.app). I would love to
collaborate with you on pushing this as the standard.

Best,
Abisheak

On Tue, 27 Oct, 2026, 12:23 pm Steven Zhao, <zhaoxinghua07@126.com> wrote:

> Hi all,
>
> I'm Xinghua Zhao, an independent researcher working on lifecycle
> governance of delegated agents — provenance, scope boundaries and
> revocation (ORCID 0009-0001-0512-1237). I've been following this CG's work
> on agent discovery, identification and collaboration protocols.
>
> Next week (November 6), Agentic Internet Workshop #3 takes place at the
> Computer History Museum in Mountain View — the open-space event in the IIW
> tradition, where people building MCP / A2A / UCP / AP2 and the adjacent W3C
> / IETF / OIDF / DIF work meet in person. I can't attend (I'm based in
> Beijing), so I'd like to propose two topics through this list, and to ask a
> favor: if anyone on this list is attending in person, would you be willing
> to raise them in the opening circle?
>
> **Topic 1 — Identity and delegation chains across MCP and A2A: aligning
> W3C, IETF and OIDF work.**
> The AIW topics page identifies delegation and authorization as its largest
> cluster: how authority passes from humans or organizations to agents and
> stays bounded, revocable and auditable. My interest is where the "each hop
> individually compliant, but the whole chain exceeding its mandate" problem
> actually sits in the stack, and how the tracks converge or diverge: this CG
> and the Agent Identity Registry / Memory Interop groups on the W3C side;
> CATALIST, the OAuth-on-behalf-of-user and GNAP-based delegation drafts,
> DAWN and webbotauth on the IETF side; and AIIM on the OIDF side. A shared
> vocabulary for delegation chains that cross MCP and A2A — and for what a
> revocation boundary looks like at each hop — would be the outcome I'd hope
> for.
>
> **Topic 2 — Revocable, auditable authority for agent chains:
> machine-speed, execution-time consent.**
> Long-running agent chains accumulate authority far beyond the moment of
> consent. The questions I'd bring: where do execution-time consent
> checkpoints belong (MCP tool calls, A2A handoffs); what audit logs and
> telemetry must capture to make delegation auditable across protocol
> boundaries; and how a human — or a policy layer — retains the ability to
> pause, halt and revoke a running agent, including when intent drifts from
> the original mandate.
>
> I'd be glad to have notes from these sessions folded into the public Book
> of Proceedings, and to follow up with authors whose work touches agent
> identity and authorization afterward.
>
> If you're attending AIW #3 and happy to raise either topic on my behalf,
> please reply here or off-list — much appreciated.
>
> Best regards,
> Xinghua Zhao
> Independent researcher (SynomosAI initiative)
> ORCID: 0009-0001-0512-1237
>
> [Disclosure: drafting of this message was assisted by AI; all positions
> reviewed and approved by me.]
>