Re: Subject: Re: [AIW Submission] Neutral Trust Infrastructure (NTI)

Cryptographic non-repudiation is a laudable goal, but agents are
notoriously bad at keeping secrets.  Do you need some additional
infrastructure to ensure agents aren't sharing secret keys?

--------------
Alan Karp


On Tue, Oct 27, 2026 at 9:04 AM Abisheak P <abisheakp197@gmail.com> wrote:

> Hi Alan,
>
> Thank you for the clarification. That makes perfect sense.
>
> This distinction—audit vs. enforcement—is exactly the gap NTI is designed
> to fill. As you noted, OAuth and UCAN handle access control, and HDP
> provides the audit trail. But neither enforces cryptographic
> non-repudiation at the execution boundary (e.g., AI agents calling tools or
> handing off tasks).
>
> In the NTI architecture, we don't try to replace HDP or UCAN. We act as
> the fail-closed cryptographic bouncer. NTI wraps the execution loop,
> verifies the post-quantum (Dilithium5) signature of the request, and then
> generates the audit trail (which could easily be formatted as HDP metadata
> or an HDP token).
>
> If OAuth is the ID check at the door, and HDP is the security camera
> recording what happens inside, NTI is the physical lock on the vault that
> won't open without the right cryptographic key.
>
> I will be sure to highlight this synthesis—HDP for audit, NTI for
> post-quantum execution-time enforcement—in my paper for the AIW Book of
> Proceedings.
>
> Best,
> Abisheak
>
>
> On Tue, 27 Oct, 2026, 9:30 pm Alan Karp, <alanhkarp@gmail.com> wrote:
>
>> You correctly summarized HDP.  It is intended as an audit framework for
>> access control mechanisms that don't have a place for audit information,
>> such as OAuth.  Other systems, such as zcaps and UCAN only need to add a
>> few pieces of metadata to include the audit function of HDP with their
>> native access controls.
>>
>> --------------
>> Alan Karp
>>
>>
>> On Tue, Oct 27, 2026 at 8:11 AM Abisheak P <abisheakp197@gmail.com>
>> wrote:
>>
>>> Hi Alan,
>>>
>>> Thank you for the reply and for sharing Asiri Dalugoda's HDP draft. I
>>> just read through it. It's an excellent, highly rigorous piece of work,
>>> particularly the append-only, offline-verifiable chain-of-custody mechanism.
>>>
>>> However, reviewing it against the NTI framework I submitted highlights
>>> exactly why we need a layered approach for the Agentic Web:
>>>
>>> 1. Audit vs. Enforcement:
>>> In Section 1.1 of the HDP draft, it explicitly states: "HDP is not an
>>> authorization protocol... An HDP token MUST NOT be used as an input to any
>>> access decision." It is a post-incident audit trail.
>>> NTI is an active, fail-closed execution layer. We intercept the tool
>>> call and block it if the signature is invalid. Enterprise CISOs cannot
>>> deploy agents with just an audit log; they need prevention at the execution
>>> boundary.
>>>
>>> 2. Classical vs. Post-Quantum:
>>> HDP relies on Ed25519. While standard today, it is vulnerable to
>>> Store-Now-Decrypt-Later attacks. NTI uses Dilithium5 (ML-DSA) to ensure the
>>> delegation chain survives the quantum transition.
>>>
>>> I actually see these protocols as highly complementary. HDP is the
>>> perfect "provenance receipt" that can travel alongside an NTI enforcement
>>> header. NTI provides the cryptographic bouncer at the door; HDP provides
>>> the immutable ledger of who came in.
>>>
>>> @Kaliya, I would love to frame the NTI paper for the AIW Book of
>>> Proceedings around this synthesis: How do we bridge post-incident
>>> provenance (like HDP) with execution-time enforcement (like NTI)?
>>>
>>> Best,
>>> Abisheak
>>>
>>> On Tue, 27 Oct, 2026, 7:30 pm Alan Karp, <alanhkarp@gmail.com> wrote:
>>>
>>>> There are other projects in this space, too.  One of them is
>>>> https://datatracker.ietf.org/doc/draft-helixar-hdp-agentic-delegation/.
>>>>
>>>> --------------
>>>> Alan Karp
>>>>
>>>>
>>>> On Tue, Oct 27, 2026 at 5:13 AM Abisheak P <abisheakp197@gmail.com>
>>>> wrote:
>>>>
>>>>> Hi Xinghua,
>>>>>
>>>>> I completely agree with your Topic 2 regarding revocable, auditable
>>>>> authority for agent chains. I'm the founder of NTI (Neutral Trust
>>>>> Infrastructure), a W3C participant.
>>>>>
>>>>> We actually have a working implementation for this. We use
>>>>> Merkle-chained proofs and Dilithium5 signatures to cryptographically bind
>>>>> execution-time consent to tool calls, preventing agents from exceeding
>>>>> their mandate.
>>>>>
>>>>> If someone is attending AIW in person and raises this, please point
>>>>> them to our live leaderboard (https://nti-leaderboard.vercel.app). I
>>>>> would love to collaborate with you on pushing this as the standard.
>>>>>
>>>>> Best,
>>>>> Abisheak
>>>>>
>>>>> On Tue, 27 Oct, 2026, 12:23 pm Steven Zhao, <zhaoxinghua07@126.com>
>>>>> wrote:
>>>>>
>>>>>> Hi all,
>>>>>>
>>>>>> I'm Xinghua Zhao, an independent researcher working on lifecycle
>>>>>> governance of delegated agents — provenance, scope boundaries and
>>>>>> revocation (ORCID 0009-0001-0512-1237). I've been following this CG's work
>>>>>> on agent discovery, identification and collaboration protocols.
>>>>>>
>>>>>> Next week (November 6), Agentic Internet Workshop #3 takes place at
>>>>>> the Computer History Museum in Mountain View — the open-space event in the
>>>>>> IIW tradition, where people building MCP / A2A / UCP / AP2 and the adjacent
>>>>>> W3C / IETF / OIDF / DIF work meet in person. I can't attend (I'm based in
>>>>>> Beijing), so I'd like to propose two topics through this list, and to ask a
>>>>>> favor: if anyone on this list is attending in person, would you be willing
>>>>>> to raise them in the opening circle?
>>>>>>
>>>>>> **Topic 1 — Identity and delegation chains across MCP and A2A:
>>>>>> aligning W3C, IETF and OIDF work.**
>>>>>> The AIW topics page identifies delegation and authorization as its
>>>>>> largest cluster: how authority passes from humans or organizations to
>>>>>> agents and stays bounded, revocable and auditable. My interest is where the
>>>>>> "each hop individually compliant, but the whole chain exceeding its
>>>>>> mandate" problem actually sits in the stack, and how the tracks converge or
>>>>>> diverge: this CG and the Agent Identity Registry / Memory Interop groups on
>>>>>> the W3C side; CATALIST, the OAuth-on-behalf-of-user and GNAP-based
>>>>>> delegation drafts, DAWN and webbotauth on the IETF side; and AIIM on the
>>>>>> OIDF side. A shared vocabulary for delegation chains that cross MCP and A2A
>>>>>> — and for what a revocation boundary looks like at each hop — would be the
>>>>>> outcome I'd hope for.
>>>>>>
>>>>>> **Topic 2 — Revocable, auditable authority for agent chains:
>>>>>> machine-speed, execution-time consent.**
>>>>>> Long-running agent chains accumulate authority far beyond the moment
>>>>>> of consent. The questions I'd bring: where do execution-time consent
>>>>>> checkpoints belong (MCP tool calls, A2A handoffs); what audit logs and
>>>>>> telemetry must capture to make delegation auditable across protocol
>>>>>> boundaries; and how a human — or a policy layer — retains the ability to
>>>>>> pause, halt and revoke a running agent, including when intent drifts from
>>>>>> the original mandate.
>>>>>>
>>>>>> I'd be glad to have notes from these sessions folded into the public
>>>>>> Book of Proceedings, and to follow up with authors whose work touches agent
>>>>>> identity and authorization afterward.
>>>>>>
>>>>>> If you're attending AIW #3 and happy to raise either topic on my
>>>>>> behalf, please reply here or off-list — much appreciated.
>>>>>>
>>>>>> Best regards,
>>>>>> Xinghua Zhao
>>>>>> Independent researcher (SynomosAI initiative)
>>>>>> ORCID: 0009-0001-0512-1237
>>>>>>
>>>>>> [Disclosure: drafting of this message was assisted by AI; all
>>>>>> positions reviewed and approved by me.]
>>>>>>
>>>>>