draft-helixar-hdp-agentic-delegation-01: chain-of-custody for agentic delegation (revision, seeking review)

Hi All,

The -01 revision of draft-helixar-hdp-agentic-delegation is now available:

https://datatracker.ietf.org/doc/draft-helixar-hdp-agentic-delegation/

HDP specifies a token that records which human authorized an agent to act,
under what scope, and through what chain of delegation, verifiable offline
with only the issuer's public key. No central registry, no third-party
trust anchor. The intent is Informational: an architectural position and
interoperable format, not a proposal to replace existing authorization
protocols.


   - 01 is a substantive revision driven largely by review on the W3C
   Credentials Community Group list. My thanks to *Bob Wyman*, *Alan Karp*,
   and *Sankarshan Mukhopadhyay*, whose comments shaped most of what
   follows:
   - Related Work expanded with ODRL, ZCAP-LD, and a VC Data Model 2.0
   termsOfUse alignment note; the UCAN comparison now identifies the execution
   audit trail as HDP's distinguishing contribution rather than authorization
   proof, which UCAN and ZCAP-LD already carry.
   - New section on the generality of the mechanism: the chain-of-custody
   core is payload-agnostic, with agentic delegation as the reference profile.
   - Corrected root-signature verification to reset chain to empty before
   canonicalization, matching the signing procedure. Clarified that in v0.1 a
   single issuer key produces all root and hop signatures.
   - New Security Considerations on chain truncation and completeness, and
   on revocation. Added session_id entropy guidance and per-hop
   opaque-identifier privacy guidance.
   - Verification pipeline now also checks header.version, signature.alg,
   and parent_hop validity.
   - HTTP header fields renamed X-HDP-Token/X-HDP-Token-Ref to
   HDP-Token/HDP-Token-Ref per BCP 178.
   - Completed the IANA media-type registration template; added a
   Well-Known URI registration.


The token wire format is unchanged and remains v0.1; -00 tokens still
verify. The HTTP header field names did change.

I would particularly value input on these questions:


   1. Hop signing key model. v0.1 has the issuer sign every hop with one
   key, which preserves the "verify with only the issuer's public key"
   property. Per-agent hop keys would give stronger per-hop accountability at
   the cost of that offline guarantee and a larger token. Is the single-key
   trade-off the right default?
   2. Truncation. Each hop signs only prior hops, so deleting trailing hops
   verifies cleanly. -01 documents this as a limitation and suggests
   out-of-band completeness checks. Is a signed monotonic chain-length
   commitment worth the complexity?
   3. Scope representation. The scope object is bespoke. Bob Wyman's
   suggestion was that ODRL already covers this ground. I would like to hear
   whether a profile of ODRL is preferable to a purpose-built structure here.
   4. Venue. There is no obvious existing WG for agentic delegation
   provenance. Suggestions welcome.

Deferred to a future revision: per-agent key commitments, a provenance DAG
for parallel/swarm delegation, selective disclosure of hops, and air-gapped
key bootstrap.

Implementation and test vectors: https://github.com/Helixar-AI/HDP

Thank you.
Siri Dalugoda