Subject: Re: [AIW Submission] Neutral Trust Infrastructure (NTI)

Hi Alan,

Thank you for the reply and for sharing Asiri Dalugoda's HDP draft. I just
read through it. It's an excellent, highly rigorous piece of work,
particularly the append-only, offline-verifiable chain-of-custody mechanism.

However, reviewing it against the NTI framework I submitted highlights
exactly why we need a layered approach for the Agentic Web:

1. Audit vs. Enforcement:
In Section 1.1 of the HDP draft, it explicitly states: "HDP is not an
authorization protocol... An HDP token MUST NOT be used as an input to any
access decision." It is a post-incident audit trail.
NTI is an active, fail-closed execution layer. We intercept the tool call
and block it if the signature is invalid. Enterprise CISOs cannot deploy
agents with just an audit log; they need prevention at the execution
boundary.

2. Classical vs. Post-Quantum:
HDP relies on Ed25519. While standard today, it is vulnerable to
Store-Now-Decrypt-Later attacks. NTI uses Dilithium5 (ML-DSA) to ensure the
delegation chain survives the quantum transition.

I actually see these protocols as highly complementary. HDP is the perfect
"provenance receipt" that can travel alongside an NTI enforcement header.
NTI provides the cryptographic bouncer at the door; HDP provides the
immutable ledger of who came in.

@Kaliya, I would love to frame the NTI paper for the AIW Book of
Proceedings around this synthesis: How do we bridge post-incident
provenance (like HDP) with execution-time enforcement (like NTI)?

Best,
Abisheak

On Tue, 27 Oct, 2026, 7:30 pm Alan Karp, <alanhkarp@gmail.com> wrote:

> There are other projects in this space, too.  One of them is
> https://datatracker.ietf.org/doc/draft-helixar-hdp-agentic-delegation/.
>
> --------------
> Alan Karp
>
>
> On Tue, Oct 27, 2026 at 5:13 AM Abisheak P <abisheakp197@gmail.com> wrote:
>
>> Hi Xinghua,
>>
>> I completely agree with your Topic 2 regarding revocable, auditable
>> authority for agent chains. I'm the founder of NTI (Neutral Trust
>> Infrastructure), a W3C participant.
>>
>> We actually have a working implementation for this. We use Merkle-chained
>> proofs and Dilithium5 signatures to cryptographically bind execution-time
>> consent to tool calls, preventing agents from exceeding their mandate.
>>
>> If someone is attending AIW in person and raises this, please point them
>> to our live leaderboard (https://nti-leaderboard.vercel.app). I would
>> love to collaborate with you on pushing this as the standard.
>>
>> Best,
>> Abisheak
>>
>> On Tue, 27 Oct, 2026, 12:23 pm Steven Zhao, <zhaoxinghua07@126.com>
>> wrote:
>>
>>> Hi all,
>>>
>>> I'm Xinghua Zhao, an independent researcher working on lifecycle
>>> governance of delegated agents — provenance, scope boundaries and
>>> revocation (ORCID 0009-0001-0512-1237). I've been following this CG's work
>>> on agent discovery, identification and collaboration protocols.
>>>
>>> Next week (November 6), Agentic Internet Workshop #3 takes place at the
>>> Computer History Museum in Mountain View — the open-space event in the IIW
>>> tradition, where people building MCP / A2A / UCP / AP2 and the adjacent W3C
>>> / IETF / OIDF / DIF work meet in person. I can't attend (I'm based in
>>> Beijing), so I'd like to propose two topics through this list, and to ask a
>>> favor: if anyone on this list is attending in person, would you be willing
>>> to raise them in the opening circle?
>>>
>>> **Topic 1 — Identity and delegation chains across MCP and A2A: aligning
>>> W3C, IETF and OIDF work.**
>>> The AIW topics page identifies delegation and authorization as its
>>> largest cluster: how authority passes from humans or organizations to
>>> agents and stays bounded, revocable and auditable. My interest is where the
>>> "each hop individually compliant, but the whole chain exceeding its
>>> mandate" problem actually sits in the stack, and how the tracks converge or
>>> diverge: this CG and the Agent Identity Registry / Memory Interop groups on
>>> the W3C side; CATALIST, the OAuth-on-behalf-of-user and GNAP-based
>>> delegation drafts, DAWN and webbotauth on the IETF side; and AIIM on the
>>> OIDF side. A shared vocabulary for delegation chains that cross MCP and A2A
>>> — and for what a revocation boundary looks like at each hop — would be the
>>> outcome I'd hope for.
>>>
>>> **Topic 2 — Revocable, auditable authority for agent chains:
>>> machine-speed, execution-time consent.**
>>> Long-running agent chains accumulate authority far beyond the moment of
>>> consent. The questions I'd bring: where do execution-time consent
>>> checkpoints belong (MCP tool calls, A2A handoffs); what audit logs and
>>> telemetry must capture to make delegation auditable across protocol
>>> boundaries; and how a human — or a policy layer — retains the ability to
>>> pause, halt and revoke a running agent, including when intent drifts from
>>> the original mandate.
>>>
>>> I'd be glad to have notes from these sessions folded into the public
>>> Book of Proceedings, and to follow up with authors whose work touches agent
>>> identity and authorization afterward.
>>>
>>> If you're attending AIW #3 and happy to raise either topic on my behalf,
>>> please reply here or off-list — much appreciated.
>>>
>>> Best regards,
>>> Xinghua Zhao
>>> Independent researcher (SynomosAI initiative)
>>> ORCID: 0009-0001-0512-1237
>>>
>>> [Disclosure: drafting of this message was assisted by AI; all positions
>>> reviewed and approved by me.]
>>>
>>