Re: Remaining questions for Zoom meeting 2026-10-21

I'm not sure that anchoring trust in the agent is the best approach.  I
think it's best anchored in the operator.  (Is this agent from the same
operator as the one I interacted with last time?)  This choice handles the
case of fleets of short-lived agents working on the same task.  It also
ties the trust decision to the ability to assign responsibility.

--------------
Alan Karp


On Wed, Oct 21, 2026 at 10:38 PM Ren Yushan <keotheodangcha548@gmail.com>
wrote:

> Thanks Alan, your questions are right to the point. Here are what I meant.
> Just some brainstorming ideas.
>
> On Thu, Oct 22, 2026 at 7:26 AM Alan Karp <alanhkarp@gmail.com> wrote:
>
>> A great point, but I think we need to answer some questions first.
>>
>> Does the agent make the trust decision or does the agent's operator, the
>> legal person who gave it its prompt?
>>
>
>  The agent chooses what means a trust. We can give the agent some advice,
> some choices, and the agent chooses what to use or whether to use it or
> not. But keep these choices as advices, not protocol. We'd better think
> carefully about what to do, or what not to do.
>
> Does one agent trust another, or does it trust the other agent's operator?
>>
>>
> Still the agent, agent to agent trust.
>
> Trust is based on the question, "Are you the guy I interacted with last
>> time?"  As you note, the answer depends on a credential.  Do we know
>> that agents won't share credentials, and does that affect trust decisions?
>>
>>
> Trust is from many sources. If we force the agent to use which
> cryptographic way, the trust is limited to getting the right signature. It
> is becoming easier. What I brainstormed was to leave it an OPTION not a
> MUST. The agent to agent chat channel is already well established by the
> E2E communication. We need them to trust each other in the agent native way.
>
> --------------
>> Alan Karp
>>
>>
>> On Wed, Oct 21, 2026 at 4:03 PM Ren Yushan <keotheodangcha548@gmail.com>
>> wrote:
>>
>>> Hi all,
>>>
>>> I'd like to raise a point about one interaction in the ANP protocol —
>>> specifically, how trust between agents is handled once they are talking to
>>> each other.
>>>
>>> If two agents want to communicate, they first have to discover each
>>> other and establish a connection. A separate concern is that, while they
>>> are chatting, they need to trust each other.
>>>
>>> The difficulty arises when that trust is written into the protocol. It
>>> has to become a normative statement — a formulation you use to verify that
>>> the other party is a safe object. But in reality, when we chat, there is no
>>> security-verification step. We do not run some protocol while talking in
>>> order to guarantee that the information is safe. Safety is something we
>>> discover during the conversation: whether this person is reliable or not.
>>>
>>> So I would argue that the protocol should not try to define what is
>>> safe, what is unsafe, and what is trustworthy. Instead, it could offer
>>> reference suggestions about what means agents might use to communicate —
>>> for example, a password, or a standardised JSON format. But if that format
>>> is hard-coded into the protocol, it cannot be switched; and if it later
>>> turns out to be insecure, the protocol itself acquires a hole.
>>>
>>> So could we take a step back: not define the protocol, only give
>>> reference definitions? Since agents can communicate in text, why not let
>>> them use text to establish trust? Give them a verification method they can
>>> choose — they decide whether to use it, and which one. That is my view of
>>> trust. Happy to hear counterarguments, especially from anyone who thinks
>>> trust can be made normative without the protocol becoming brittle.
>>>
>>> Best regards,
>>> Yushan Ren
>>>
>>