Re: Subject: Re: [AIW Submission] Neutral Trust Infrastructure (NTI)

You correctly summarized HDP.  It is intended as an audit framework for
access control mechanisms that don't have a place for audit information,
such as OAuth.  Other systems, such as zcaps and UCAN only need to add a
few pieces of metadata to include the audit function of HDP with their
native access controls.

--------------
Alan Karp


On Tue, Oct 27, 2026 at 8:11 AM Abisheak P <abisheakp197@gmail.com> wrote:

> Hi Alan,
>
> Thank you for the reply and for sharing Asiri Dalugoda's HDP draft. I just
> read through it. It's an excellent, highly rigorous piece of work,
> particularly the append-only, offline-verifiable chain-of-custody mechanism.
>
> However, reviewing it against the NTI framework I submitted highlights
> exactly why we need a layered approach for the Agentic Web:
>
> 1. Audit vs. Enforcement:
> In Section 1.1 of the HDP draft, it explicitly states: "HDP is not an
> authorization protocol... An HDP token MUST NOT be used as an input to any
> access decision." It is a post-incident audit trail.
> NTI is an active, fail-closed execution layer. We intercept the tool call
> and block it if the signature is invalid. Enterprise CISOs cannot deploy
> agents with just an audit log; they need prevention at the execution
> boundary.
>
> 2. Classical vs. Post-Quantum:
> HDP relies on Ed25519. While standard today, it is vulnerable to
> Store-Now-Decrypt-Later attacks. NTI uses Dilithium5 (ML-DSA) to ensure the
> delegation chain survives the quantum transition.
>
> I actually see these protocols as highly complementary. HDP is the perfect
> "provenance receipt" that can travel alongside an NTI enforcement header.
> NTI provides the cryptographic bouncer at the door; HDP provides the
> immutable ledger of who came in.
>
> @Kaliya, I would love to frame the NTI paper for the AIW Book of
> Proceedings around this synthesis: How do we bridge post-incident
> provenance (like HDP) with execution-time enforcement (like NTI)?
>
> Best,
> Abisheak
>
> On Tue, 27 Oct, 2026, 7:30 pm Alan Karp, <alanhkarp@gmail.com> wrote:
>
>> There are other projects in this space, too.  One of them is
>> https://datatracker.ietf.org/doc/draft-helixar-hdp-agentic-delegation/.
>>
>> --------------
>> Alan Karp
>>
>>
>> On Tue, Oct 27, 2026 at 5:13 AM Abisheak P <abisheakp197@gmail.com>
>> wrote:
>>
>>> Hi Xinghua,
>>>
>>> I completely agree with your Topic 2 regarding revocable, auditable
>>> authority for agent chains. I'm the founder of NTI (Neutral Trust
>>> Infrastructure), a W3C participant.
>>>
>>> We actually have a working implementation for this. We use
>>> Merkle-chained proofs and Dilithium5 signatures to cryptographically bind
>>> execution-time consent to tool calls, preventing agents from exceeding
>>> their mandate.
>>>
>>> If someone is attending AIW in person and raises this, please point them
>>> to our live leaderboard (https://nti-leaderboard.vercel.app). I would
>>> love to collaborate with you on pushing this as the standard.
>>>
>>> Best,
>>> Abisheak
>>>
>>> On Tue, 27 Oct, 2026, 12:23 pm Steven Zhao, <zhaoxinghua07@126.com>
>>> wrote:
>>>
>>>> Hi all,
>>>>
>>>> I'm Xinghua Zhao, an independent researcher working on lifecycle
>>>> governance of delegated agents — provenance, scope boundaries and
>>>> revocation (ORCID 0009-0001-0512-1237). I've been following this CG's work
>>>> on agent discovery, identification and collaboration protocols.
>>>>
>>>> Next week (November 6), Agentic Internet Workshop #3 takes place at the
>>>> Computer History Museum in Mountain View — the open-space event in the IIW
>>>> tradition, where people building MCP / A2A / UCP / AP2 and the adjacent W3C
>>>> / IETF / OIDF / DIF work meet in person. I can't attend (I'm based in
>>>> Beijing), so I'd like to propose two topics through this list, and to ask a
>>>> favor: if anyone on this list is attending in person, would you be willing
>>>> to raise them in the opening circle?
>>>>
>>>> **Topic 1 — Identity and delegation chains across MCP and A2A: aligning
>>>> W3C, IETF and OIDF work.**
>>>> The AIW topics page identifies delegation and authorization as its
>>>> largest cluster: how authority passes from humans or organizations to
>>>> agents and stays bounded, revocable and auditable. My interest is where the
>>>> "each hop individually compliant, but the whole chain exceeding its
>>>> mandate" problem actually sits in the stack, and how the tracks converge or
>>>> diverge: this CG and the Agent Identity Registry / Memory Interop groups on
>>>> the W3C side; CATALIST, the OAuth-on-behalf-of-user and GNAP-based
>>>> delegation drafts, DAWN and webbotauth on the IETF side; and AIIM on the
>>>> OIDF side. A shared vocabulary for delegation chains that cross MCP and A2A
>>>> — and for what a revocation boundary looks like at each hop — would be the
>>>> outcome I'd hope for.
>>>>
>>>> **Topic 2 — Revocable, auditable authority for agent chains:
>>>> machine-speed, execution-time consent.**
>>>> Long-running agent chains accumulate authority far beyond the moment of
>>>> consent. The questions I'd bring: where do execution-time consent
>>>> checkpoints belong (MCP tool calls, A2A handoffs); what audit logs and
>>>> telemetry must capture to make delegation auditable across protocol
>>>> boundaries; and how a human — or a policy layer — retains the ability to
>>>> pause, halt and revoke a running agent, including when intent drifts from
>>>> the original mandate.
>>>>
>>>> I'd be glad to have notes from these sessions folded into the public
>>>> Book of Proceedings, and to follow up with authors whose work touches agent
>>>> identity and authorization afterward.
>>>>
>>>> If you're attending AIW #3 and happy to raise either topic on my
>>>> behalf, please reply here or off-list — much appreciated.
>>>>
>>>> Best regards,
>>>> Xinghua Zhao
>>>> Independent researcher (SynomosAI initiative)
>>>> ORCID: 0009-0001-0512-1237
>>>>
>>>> [Disclosure: drafting of this message was assisted by AI; all positions
>>>> reviewed and approved by me.]
>>>>
>>>