Re: Subject: Re: [AIW Submission] Neutral Trust Infrastructure (NTI)

Hi Alan,

Thank you for the clarification. That makes perfect sense.

This distinction—audit vs. enforcement—is exactly the gap NTI is designed
to fill. As you noted, OAuth and UCAN handle access control, and HDP
provides the audit trail. But neither enforces cryptographic
non-repudiation at the execution boundary (e.g., AI agents calling tools or
handing off tasks).

In the NTI architecture, we don't try to replace HDP or UCAN. We act as the
fail-closed cryptographic bouncer. NTI wraps the execution loop, verifies
the post-quantum (Dilithium5) signature of the request, and then generates
the audit trail (which could easily be formatted as HDP metadata or an HDP
token).

If OAuth is the ID check at the door, and HDP is the security camera
recording what happens inside, NTI is the physical lock on the vault that
won't open without the right cryptographic key.

I will be sure to highlight this synthesis—HDP for audit, NTI for
post-quantum execution-time enforcement—in my paper for the AIW Book of
Proceedings.

Best,
Abisheak


On Tue, 27 Oct, 2026, 9:30 pm Alan Karp, <alanhkarp@gmail.com> wrote:

> You correctly summarized HDP.  It is intended as an audit framework for
> access control mechanisms that don't have a place for audit information,
> such as OAuth.  Other systems, such as zcaps and UCAN only need to add a
> few pieces of metadata to include the audit function of HDP with their
> native access controls.
>
> --------------
> Alan Karp
>
>
> On Tue, Oct 27, 2026 at 8:11 AM Abisheak P <abisheakp197@gmail.com> wrote:
>
>> Hi Alan,
>>
>> Thank you for the reply and for sharing Asiri Dalugoda's HDP draft. I
>> just read through it. It's an excellent, highly rigorous piece of work,
>> particularly the append-only, offline-verifiable chain-of-custody mechanism.
>>
>> However, reviewing it against the NTI framework I submitted highlights
>> exactly why we need a layered approach for the Agentic Web:
>>
>> 1. Audit vs. Enforcement:
>> In Section 1.1 of the HDP draft, it explicitly states: "HDP is not an
>> authorization protocol... An HDP token MUST NOT be used as an input to any
>> access decision." It is a post-incident audit trail.
>> NTI is an active, fail-closed execution layer. We intercept the tool call
>> and block it if the signature is invalid. Enterprise CISOs cannot deploy
>> agents with just an audit log; they need prevention at the execution
>> boundary.
>>
>> 2. Classical vs. Post-Quantum:
>> HDP relies on Ed25519. While standard today, it is vulnerable to
>> Store-Now-Decrypt-Later attacks. NTI uses Dilithium5 (ML-DSA) to ensure the
>> delegation chain survives the quantum transition.
>>
>> I actually see these protocols as highly complementary. HDP is the
>> perfect "provenance receipt" that can travel alongside an NTI enforcement
>> header. NTI provides the cryptographic bouncer at the door; HDP provides
>> the immutable ledger of who came in.
>>
>> @Kaliya, I would love to frame the NTI paper for the AIW Book of
>> Proceedings around this synthesis: How do we bridge post-incident
>> provenance (like HDP) with execution-time enforcement (like NTI)?
>>
>> Best,
>> Abisheak
>>
>> On Tue, 27 Oct, 2026, 7:30 pm Alan Karp, <alanhkarp@gmail.com> wrote:
>>
>>> There are other projects in this space, too.  One of them is
>>> https://datatracker.ietf.org/doc/draft-helixar-hdp-agentic-delegation/.
>>>
>>> --------------
>>> Alan Karp
>>>
>>>
>>> On Tue, Oct 27, 2026 at 5:13 AM Abisheak P <abisheakp197@gmail.com>
>>> wrote:
>>>
>>>> Hi Xinghua,
>>>>
>>>> I completely agree with your Topic 2 regarding revocable, auditable
>>>> authority for agent chains. I'm the founder of NTI (Neutral Trust
>>>> Infrastructure), a W3C participant.
>>>>
>>>> We actually have a working implementation for this. We use
>>>> Merkle-chained proofs and Dilithium5 signatures to cryptographically bind
>>>> execution-time consent to tool calls, preventing agents from exceeding
>>>> their mandate.
>>>>
>>>> If someone is attending AIW in person and raises this, please point
>>>> them to our live leaderboard (https://nti-leaderboard.vercel.app). I
>>>> would love to collaborate with you on pushing this as the standard.
>>>>
>>>> Best,
>>>> Abisheak
>>>>
>>>> On Tue, 27 Oct, 2026, 12:23 pm Steven Zhao, <zhaoxinghua07@126.com>
>>>> wrote:
>>>>
>>>>> Hi all,
>>>>>
>>>>> I'm Xinghua Zhao, an independent researcher working on lifecycle
>>>>> governance of delegated agents — provenance, scope boundaries and
>>>>> revocation (ORCID 0009-0001-0512-1237). I've been following this CG's work
>>>>> on agent discovery, identification and collaboration protocols.
>>>>>
>>>>> Next week (November 6), Agentic Internet Workshop #3 takes place at
>>>>> the Computer History Museum in Mountain View — the open-space event in the
>>>>> IIW tradition, where people building MCP / A2A / UCP / AP2 and the adjacent
>>>>> W3C / IETF / OIDF / DIF work meet in person. I can't attend (I'm based in
>>>>> Beijing), so I'd like to propose two topics through this list, and to ask a
>>>>> favor: if anyone on this list is attending in person, would you be willing
>>>>> to raise them in the opening circle?
>>>>>
>>>>> **Topic 1 — Identity and delegation chains across MCP and A2A:
>>>>> aligning W3C, IETF and OIDF work.**
>>>>> The AIW topics page identifies delegation and authorization as its
>>>>> largest cluster: how authority passes from humans or organizations to
>>>>> agents and stays bounded, revocable and auditable. My interest is where the
>>>>> "each hop individually compliant, but the whole chain exceeding its
>>>>> mandate" problem actually sits in the stack, and how the tracks converge or
>>>>> diverge: this CG and the Agent Identity Registry / Memory Interop groups on
>>>>> the W3C side; CATALIST, the OAuth-on-behalf-of-user and GNAP-based
>>>>> delegation drafts, DAWN and webbotauth on the IETF side; and AIIM on the
>>>>> OIDF side. A shared vocabulary for delegation chains that cross MCP and A2A
>>>>> — and for what a revocation boundary looks like at each hop — would be the
>>>>> outcome I'd hope for.
>>>>>
>>>>> **Topic 2 — Revocable, auditable authority for agent chains:
>>>>> machine-speed, execution-time consent.**
>>>>> Long-running agent chains accumulate authority far beyond the moment
>>>>> of consent. The questions I'd bring: where do execution-time consent
>>>>> checkpoints belong (MCP tool calls, A2A handoffs); what audit logs and
>>>>> telemetry must capture to make delegation auditable across protocol
>>>>> boundaries; and how a human — or a policy layer — retains the ability to
>>>>> pause, halt and revoke a running agent, including when intent drifts from
>>>>> the original mandate.
>>>>>
>>>>> I'd be glad to have notes from these sessions folded into the public
>>>>> Book of Proceedings, and to follow up with authors whose work touches agent
>>>>> identity and authorization afterward.
>>>>>
>>>>> If you're attending AIW #3 and happy to raise either topic on my
>>>>> behalf, please reply here or off-list — much appreciated.
>>>>>
>>>>> Best regards,
>>>>> Xinghua Zhao
>>>>> Independent researcher (SynomosAI initiative)
>>>>> ORCID: 0009-0001-0512-1237
>>>>>
>>>>> [Disclosure: drafting of this message was assisted by AI; all
>>>>> positions reviewed and approved by me.]
>>>>>
>>>>