Cryptographic Execution-Trace Verification, JCS Canonicalization, and Fail-Closed Delegation Attestation for Autonomous AI Agents
draft-durga-agenttrust-trace-verification-00
This document is an Internet-Draft (I-D).
Anyone may submit an I-D to the IETF.
This I-D is not endorsed by the IETF and has no formal standing in the
IETF standards process.
| Document | Type | Active Internet-Draft (individual) | |
|---|---|---|---|
| Author | Raghuvar Karthik Durga | ||
| Last updated | 2026-10-29 | ||
| RFC stream | (None) | ||
| Intended RFC status | (None) | ||
| Formats | |||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | I-D Exists | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
draft-durga-agenttrust-trace-verification-00
Network Working Group R. K. Durga
Internet-Draft Microsoft Corporation
Intended status: Informational 29 October 2026
Expires: 2 May 2027
Cryptographic Execution-Trace Verification, JCS Canonicalization, and
Fail-Closed Delegation Attestation for Autonomous AI Agents
draft-durga-agenttrust-trace-verification-00
Abstract
This document specifies a deterministic cryptographic verification
profile for execution traces, delegation chains, and weight-custody
manifests generated by autonomous artificial intelligence (AI) agents
operating across Model Context Protocol (MCP), Agent-to-Agent (A2A),
and enterprise system-of-record boundaries. The profile binds JSON
Canonicalization Scheme (JCS, RFC 8785) pre-image serialization,
Ed25519 (RFC 8032) and ECDSA P-256/P-384 signatures, JSON Web Key
(JWK, RFC 7517) thumbprint pinning, and fail-closed revocation and
freshness checks so that relying parties can independently verify
whether an agent action was authorized prior to commit.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 2 May 2027.
Copyright Notice
Copyright (c) 2026 IETF Trust and the persons identified as the
document authors. All rights reserved.
Durga Expires 2 May 2027 [Page 1]
Internet-Draft AgentTrust Trace Verification October 2026
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Conventions and Terminology . . . . . . . . . . . . . . . . . 2
3. Deterministic Pre-Image Canonicalization (RFC 8785 JCS) . . . 3
4. Strict Base64url and JWK Public-Key Hygiene . . . . . . . . . 3
5. Parent-Linked Delegation Chain Verification . . . . . . . . . 3
6. Security Considerations . . . . . . . . . . . . . . . . . . . 4
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 4
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 4
8.1. Normative References . . . . . . . . . . . . . . . . . . 4
8.2. Informative References . . . . . . . . . . . . . . . . . 5
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 5
1. Introduction
Autonomous AI agents increasingly invoke external tools, modify
enterprise state, and delegate subtasks across multi-agent boundaries
using protocols such as the Model Context Protocol (MCP) and Agent-
to-Agent (A2A) transport envelopes. Without a deterministic,
cryptographically verifiable execution receipt, a relying party
cannot distinguish between a self-reported agent log and an
independently verifiable commitment record.
This specification formalizes the fail-closed verification invariants
implemented in the open-source AgentTrust ("agentrust-io/trace-spec",
"agentrust-io/agent-manifest", and "agentrust-io/weight-custody-
manifest") conformance suites and empirically evaluated in
[TR-2026-01], [TR-2026-02], and [TR-2026-03].
2. Conventions and Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP
14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
Durga Expires 2 May 2027 [Page 2]
Internet-Draft AgentTrust Trace Verification October 2026
3. Deterministic Pre-Image Canonicalization (RFC 8785 JCS)
To prevent cross-language signature verification drift between
Python, TypeScript/JavaScript, and Rust verifiers, every execution
trace envelope MUST be serialized according to the JSON
Canonicalization Scheme [RFC8785] prior to digest calculation or
signature verification:
* Non-string dictionary keys MUST be rejected with a deterministic
type error rather than silently coerced.
* Lone UTF-16 surrogates (U+D800 through U+DFFF) and non-finite IEEE
754 floating-point values (NaN, +Infinity, -Infinity) MUST cause
canonicalization to fail closed.
* Duplicate JSON object member names within signed payloads MUST be
rejected during parsing before signature appraisal.
4. Strict Base64url and JWK Public-Key Hygiene
Verifiers evaluating detached signatures, witness receipts, or JWK
bundles [RFC7517] MUST enforce canonical unpadded base64url encoding
(Section 5 of [RFC4648]):
* Padding characters ("="), non-alphabet whitespace, or non-zero
trailing pad bits MUST be rejected.
* Verification bundles MUST NOT contain private JWK parameters ("d",
"p", "q", "dp", "dq", "qi", "oth"). Any trust bundle containing a
private key parameter MUST be rejected immediately.
* JWK thumbprints [RFC7638] and confirmation claims ("cnf.jwk") MUST
be validated against the pinned trust store prior to revocation
list evaluation.
5. Parent-Linked Delegation Chain Verification
When an orchestrator agent delegates authority to a sub-agent, each
hop record MUST include a "parent_record_hash" field containing the
lowercase hexadecimal SHA-256 digest of the canonicalized parent
record. A verifier evaluating an N-hop delegation chain MUST verify:
1. Cryptographic signature validity of every hop i in 0..N-1.
2. Hash continuity: hop[i].parent_record_hash ==
SHA256(JCS(hop[i-1])).
Durga Expires 2 May 2027 [Page 3]
Internet-Draft AgentTrust Trace Verification October 2026
3. Scope attenuation: hop[i].granted_scopes is a strict subset of or
equal to hop[i-1].granted_scopes.
4. Temporal monotonicity: hop[i].issued_at >= hop[i-1].issued_at and
hop[i].expires_at <= hop[i-1].expires_at.
6. Security Considerations
Verifiers that accept boolean literals as integer timestamps (for
example, in runtimes where boolean is a subclass of integer) or that
silently truncate recursive argument walks without flagging depth
exhaustion introduce fail-open bypass vectors. Implementations MUST
validate exact integer types for sequence numbers, epochs, and clock-
skew bounds, and MUST fail closed when structural nesting bounds are
exceeded.
7. IANA Considerations
This document has no IANA actions.
8. References
8.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data
Encodings", RFC 4648, October 2006,
<https://www.rfc-editor.org/info/rfc4648>.
[RFC7517] Jones, M., "JSON Web Key (JWK)", RFC 7517, May 2015,
<https://www.rfc-editor.org/info/rfc7517>.
[RFC7638] Jones, M. and N. Sakimura, "JSON Web Key (JWK)
Thumbprint", RFC 7638, September 2015,
<https://www.rfc-editor.org/info/rfc7638>.
[RFC8032] Josefsson, S. and I. Liusvaara, "Edwards-Curve Digital
Signature Algorithm (EdDSA)", RFC 8032, January 2017,
<https://www.rfc-editor.org/info/rfc8032>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, May 2017,
<https://www.rfc-editor.org/info/rfc8174>.
Durga Expires 2 May 2027 [Page 4]
Internet-Draft AgentTrust Trace Verification October 2026
[RFC8785] Rundgren, A., Jordan, B., and S. Erdtman, "JSON
Canonicalization Scheme (JCS)", RFC 8785, June 2020,
<https://www.rfc-editor.org/info/rfc8785>.
8.2. Informative References
[TR-2026-01]
Durga, R. K., "Deterministic Control-Plane Governance and
Lease-Bounded Recovery for Enterprise Agentic AI Systems",
DOI 10.5281/zenodo.23735274, October 2026,
<https://doi.org/10.5281/zenodo.23735274>.
[TR-2026-02]
Durga, R. K., "Adversarial Regression Benchmarking for
Agentic AI Security Controls Across OWASP ASI01-ASI10",
DOI 10.5281/zenodo.23735497, October 2026,
<https://doi.org/10.5281/zenodo.23735497>.
[TR-2026-03]
Durga, R. K., "Cryptographic Weight-Custody Manifests, JCS
Canonicalization, and Two-Plane Edge Fleet Verification
for Autonomous AI Systems", DOI 10.5281/zenodo.23775009,
October 2026, <https://doi.org/10.5281/zenodo.23775009>.
Author's Address
Raghuvar Karthik Durga
Microsoft Corporation
Chicago, IL
United States of America
Email: rdurga@microsoft.com
URI: https://orcid.org/0009-0003-7014-355X
Durga Expires 2 May 2027 [Page 5]