Agentic Saturation Stridency (SAS): A Quantitative Model and Admission Architecture for Autonomous Agent Traffic
draft-feria-sas-01
This document is an Internet-Draft (I-D).
Anyone may submit an I-D to the IETF.
This I-D is not endorsed by the IETF and has no formal standing in the
IETF standards process.
| Document | Type | Active Internet-Draft (individual) | |
|---|---|---|---|
| Author | Pablo Octavio Feria Hernández | ||
| Last updated | 2026-09-01 | ||
| RFC stream | (None) | ||
| Intended RFC status | (None) | ||
| Formats | |||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | I-D Exists | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
draft-feria-sas-01
Independent Submission P. Feria Hernandez
Internet-Draft LexaryNova IusTech
Intended status: Informational September 2026
Expires: 5 March 2027
Agentic Saturation Stridency (SAS): A Quantitative Model and Admission
Architecture for Autonomous Agent Traffic
draft-feria-sas-01
Abstract
Autonomous computational agents are capable of generating high-
frequency synthetic traffic that can cause a protected system to
allocate memory, consume processing cycles, or invoke application-
layer computational routines before the eligibility of an incoming
request has been established.
This document formalizes Agentic Saturation Stridency (SAS) as a
measurable system condition defined by the ratio between the arrival
rate of unverified agentic traffic over a discrete observation
interval and the empirically sustainable admission capacity of the
target boundary.
The document defines three operational regimes (Subcritical,
Critical, and Supercritical) and specifies a pre-runtime structural
admission architecture designated Reality Layer 0 (RL0). RL0
establishes an ex-ante admission boundary intended to drop or reject
unverifiable traffic before protected application-layer execution,
incorporating bounded-state replay protection, out-of-band key
revocation checking via probabilistic structures, constant-time
cryptographic operations, and standardized wire encodings.
The admission framework utilizes a signed Reality-Token (RT) and an
admission predicate associated with the Invariant Reality Prism
(IRP), listed as an Informative Reference in the NIST Cybersecurity
Framework Online Informative References catalog under Reference ID
189 (IRP-189). The catalog entry is cited for informational
provenance only and does not imply NIST authorship, endorsement,
certification, or normative incorporation of the IRP framework.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Feria Hernandez Expires 5 March 2027 [Page 1]
Internet-Draft SAS Model & Architecture September 2026
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 5 March 2027.
Copyright Notice
Copyright (c) 2026 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Core Architectural Principle . . . . . . . . . . . . . . 3
1.2. Architectural Scope and Implementation Profiles . . . . . 4
1.3. Relationship to Existing Mechanisms . . . . . . . . . . . 4
1.4. SAS Scope and Non-Goals . . . . . . . . . . . . . . . . . 4
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 5
3. Mathematical Model of SAS . . . . . . . . . . . . . . . . . . 6
3.1. Rate Formalization over Temporal Window . . . . . . . . . 6
3.2. Empirical Sustainable Admission Capacity . . . . . . . . 6
3.3. The Non-Dimensional SAS Ratio . . . . . . . . . . . . . . 7
3.4. Operational Regimes . . . . . . . . . . . . . . . . . . . 7
4. RL0 Admission Architecture . . . . . . . . . . . . . . . . . 8
4.1. Pre-Runtime Admission Boundary . . . . . . . . . . . . . 8
4.2. Reality-Token (RT) Wire Format and Encapsulation . . . . 9
4.3. Deterministic Admission State Machine . . . . . . . . . . 9
4.4. Two-Layer Architecture (RL0 / Prudential Gating) . . . . 10
5. Reality Sovereignty Metric and Predicate . . . . . . . . . . 10
6. Threat Model and Risk Vectors . . . . . . . . . . . . . . . . 11
6.1. Volumetric Synthetic Saturation . . . . . . . . . . . . . 11
6.2. Synthetic Identity and Workflow Spoofing . . . . . . . . 11
6.3. Credential Forgery and Replay State Paradox . . . . . . . 11
6.4. Admission-Layer Resource Exhaustion . . . . . . . . . . . 12
6.5. False Rejection . . . . . . . . . . . . . . . . . . . . . 12
Feria Hernandez Expires 5 March 2027 [Page 2]
Internet-Draft SAS Model & Architecture September 2026
7. Operational and Deployment Considerations . . . . . . . . . . 12
8. Experimental Evaluation Methodology . . . . . . . . . . . . . 13
8.1. Evaluation Scenarios (A-D) . . . . . . . . . . . . . . . 13
8.2. Formal Metrics . . . . . . . . . . . . . . . . . . . . . 13
8.3. Falsifiable Hypotheses (H1-H3) . . . . . . . . . . . . . 14
8.4. Illustrative Parameter Ranges for Experimental
Planning . . . . . . . . . . . . . . . . . . . . . . . . 15
9. Limitations and Evaluation Boundaries . . . . . . . . . . . . 15
10. Security Considerations . . . . . . . . . . . . . . . . . . . 16
11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16
12. Normative References . . . . . . . . . . . . . . . . . . . . 16
13. Informative References . . . . . . . . . . . . . . . . . . . 17
Appendix A. Appendix A. Operational Flow Diagram for Reference
IRP-Based RL0 Profile . . . . . . . . . . . . . . . . . . 17
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 19
1. Introduction
Modern computational infrastructures are increasingly exposed to
autonomous agents, automated swarms, and synthetic processes capable
of issuing protocol-level requests at machine frequency. At the end
of the second quarter of 2026, the global domain name base comprised
approximately 401.6 million domain name registrations across all TLDs
according to the VeriSign Domain Name Industry Brief [VERISIGN-DNIB],
with gTLDs accounting for 243.8 million per ICANN operational metrics
[ICANN-METRICS]. Unlike traditional human-driven interaction,
agentic workflows can sustain continuous, high-volume request streams
that increase pressure on system resources.
Traditional application-layer security mechanisms (e.g., Web
Application Firewalls, API gateways, and rate limiters) commonly
operate after some transport, parsing, routing, or application-layer
processing has already occurred. Depending on deployment
architecture, additional computational resources may therefore be
committed before structural admission has been established.
When applied to high-frequency autonomous agentic traffic, this
ordering creates an asymmetric resource condition: the computational
cost of evaluating an unverified request may be borne primarily by
the protected target rather than by the initiating agent.
1.1. Core Architectural Principle
To reduce this structural asymmetry, this document establishes the
following architectural principle:
| Verification before Resource Commitment.
Feria Hernandez Expires 5 March 2027 [Page 3]
Internet-Draft SAS Model & Architecture September 2026
For deployments implementing the RL0 architecture, protected
application-layer computation SHOULD NOT be invoked until the
required structural admission conditions have been established.
In this specification, "pre-runtime" refers specifically to
processing that occurs prior to protected application or backend
execution, rather than execution before all ingress transport
processing.
1.2. Architectural Scope and Implementation Profiles
This document defines Agentic Saturation Stridency (SAS) as a
quantitative measure of arrival pressure and introduces Reality Layer
0 (RL0) as a pre-runtime structural admission architecture. RL0
separates structural admissibility from subsequent contextual,
normative, or prudential policy decisions, enabling evaluation of a
modular two-layer defense model.
The document does not define a complete application authorization
protocol or mandatory identity governance scheme. The Reality-Token
(RT) mechanism, the Edge Admission Control Profile (EACP), and the
THALET prudential gating pipeline represent reference implementation
profiles and research instantiations associated with this model; they
are not normatively specified by this document.
1.3. Relationship to Existing Mechanisms
RL0 is intended to complement, rather than replace, existing network
and application security mechanisms:
* *Rate Limiting:* Manages request volume over time based on IP or
identity quotas; RL0 evaluates structural admissibility prior to
quota accounting.
* *Web Application Firewalls (WAF):* Inspect payload semantics and
behavioral threat patterns; RL0 filters non-admissible traffic
before deep inspection overhead is incurred.
* *Authentication Gateways:* Establish principal identity and
application permissions; RL0 validates perimeter eligibility
credentials ex-ante.
1.4. SAS Scope and Non-Goals
SAS is strictly a quantitative measure of arrival pressure relative
to sustainable admission capacity. SAS does NOT evaluate or measure:
* Agent intent, motive, or maliciousness;
Feria Hernandez Expires 5 March 2027 [Page 4]
Internet-Draft SAS Model & Architecture September 2026
* Legal legitimacy or normative authorization;
* Agent intelligence or behavioral complexity;
* Payload content quality or semantic correctness; or
* Probability of attack success.
Operationally, SAS evaluates traffic classified by the deployment as
autonomous or automated prior to structural admission under the
deployment's observation model. A high SAS value indicates
saturation pressure and does not, by itself, establish that the
originating traffic is malicious.
2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP
14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
Agentic Saturation Stridency (SAS): A non-dimensional measure of
system pressure representing the ratio between the arrival rate of
unverified agentic requests and the sustainable admission capacity
of a protected boundary over a specified observation interval.
Unverified Request: An incoming protocol request whose required
structural admission assertions, cryptographic credentials, or
associated admission predicates have not yet been successfully
validated by the ingress boundary.
Sustainable Admission Capacity (lambda_admission_capacity): The
empirically sustainable rate at which an admission boundary can
execute its deterministic validation and decision logic without
unacceptable queue growth, memory exhaustion, or latency
degradation under specified operating conditions.
Reality Layer 0 (RL0): A pre-runtime admission layer responsible for
executing deterministic structural verification prior to protected
application or backend execution.
Reality-Token (RT): A signed request-level data structure carrying
structural claims, cryptographic proof, and validity context
evaluated by RL0.
Structural Admission: The ex-ante determination of whether an
Feria Hernandez Expires 5 March 2027 [Page 5]
Internet-Draft SAS Model & Architecture September 2026
incoming request satisfies the mandatory cryptographic and
structural assertions required to enter the protected execution
domain.
Prudential Gating (Layer 1): An optional secondary decision layer
that evaluates contextual, evidential, mitigative, and policy
properties of requests that have already satisfied structural
admission.
Fail-Closed: An operational mode wherein a validation error, missing
mandatory assertion, cryptographic invalidity, or validation
timeout results in request rejection or silent drop rather than
bypass of the admission boundary.
DROP: Denotes immediate connection or frame termination without
returning an application-layer response payload.
REJECT: Denotes an explicit admission rejection response returned at
the protocol boundary.
Backend: The protected computational resource, database, application
logic, or AI inference engine situated downstream of the admission
boundary.
3. Mathematical Model of SAS
3.1. Rate Formalization over Temporal Window
Let Delta_t denote a discrete temporal observation interval, where
Delta_t > 0. The observed average arrival rate of unverified agentic
requests over the interval [t, t + Delta_t] is defined as:
N_unverified(t, t + Delta_t)
lambda_unverified(t, Delta_t) = ------------------------------
Delta_t
where N_unverified(t, t + Delta_t) represents the total count of
unverified requests arriving at the admission boundary during
Delta_t.
3.2. Empirical Sustainable Admission Capacity
The sustainable admission capacity lambda_admission_capacity(t,
Delta_t) is an operational quantity determined from measured system
behavior under specified workload, concurrency, hardware,
cryptographic, memory, and network conditions.
Feria Hernandez Expires 5 March 2027 [Page 6]
Internet-Draft SAS Model & Architecture September 2026
For analytical approximation under stable service-time and
concurrency assumptions, capacity MAY be estimated as:
Capacity_max
lambda_admission_capacity(t, Delta_t) ≈ -----------------
tau_exec
where tau_exec represents the effective admission processing time per
request and Capacity_max represents the applicable concurrency bound
under the defined operating conditions. This approximation MUST NOT
replace empirical measurement when determining operational saturation
thresholds.
3.3. The Non-Dimensional SAS Ratio
The Agentic Saturation Stridency ratio SAS(t, Delta_t) over window
Delta_t is defined as:
lambda_unverified(t, Delta_t)
SAS(t, Delta_t) = -----------------------------------------------------
lambda_admission_capacity(t, Delta_t)
SAS is dimensionless. A value greater than one indicates that the
observed arrival rate exceeds the measured sustainable admission
capacity for the corresponding observation conditions.
The numerator and denominator MUST refer to the same admission
boundary, observation window, and declared operating conditions.
Capacity values obtained under materially different hardware,
workload, concurrency, cryptographic, or network conditions MUST NOT
be directly substituted without an explicit normalization or
recalibration procedure.
3.4. Operational Regimes
System operation is classified into three operational regimes
governed by an implementation-defined positive classification
tolerance epsilon (where 0 < epsilon < 1). Note that epsilon is an
operational policy parameter and not an intrinsic physical property
of SAS:
* *Subcritical Regime (SAS(t, Delta_t) < 1 - epsilon):* The observed
arrival rate remains materially below the sustainable admission
capacity under the defined operating conditions.
Feria Hernandez Expires 5 March 2027 [Page 7]
Internet-Draft SAS Model & Architecture September 2026
* *Critical Regime (| SAS(t, Delta_t) - 1 | <= epsilon):* The
observed arrival rate is sufficiently close to the sustainable
admission boundary that workload variation or micro-bursts may
produce queue growth, latency degradation, or transient resource
pressure.
* *Supercritical Regime (SAS(t, Delta_t) > 1 + epsilon):* The
observed arrival rate exceeds the sustainable admission capacity
by a material margin. Without effective admission control,
downstream computational resources may experience progressive
resource pressure or saturation.
4. RL0 Admission Architecture
4.1. Pre-Runtime Admission Boundary
RL0 is designed as an ex-ante structural admission boundary situated
as close to the network interface or ingress processing boundary as
practical. The reference processing pipeline is:
Incoming Traffic
|
v
+------------------+
| Admission |
| Boundary RL0 |
+------------------+
|
Structural Validation
|
+---------+---------+
| |
FAIL PASS
| |
DROP v
+----------------+
| Layer 1 |
| Optional |
| Prudential |
| Gating |
+----------------+
|
+------+------+
| |
DENY PERMIT
| |
DROP v
Protected Application
Feria Hernandez Expires 5 March 2027 [Page 8]
Internet-Draft SAS Model & Architecture September 2026
4.2. Reality-Token (RT) Wire Format and Encapsulation
The Reality-Token (RT) serves as a reference structural admission
credential carried within protocol-defined headers or framing
structures. To ensure zero-copy parsing and high-throughput
evaluation at the perimeter, implementations SHOULD format HTTP
header representations in compliance with HTTP Structured Field
Values [RFC8941].
The following is an HTTP header representation conforming to
Structured Field Values syntax:
Reality-Token: v=1, kid="ed25519:abc123x", exp=1793404800, aud="RL0-Edge-X", sig=:b2xUYW...:
For binary protocol environments or low-bandwidth deployments (e.g.,
HTTP/3 QPACK frames or transport-layer wrappers), implementations MAY
encode the token using Concise Binary Object Representation (CBOR)
and CBOR Object Signing and Encryption (COSE) [RFC9052]. This binary
encoding minimizes header serialization overhead and parsing
complexity in high-frequency network paths.
The presence of an RT asserts only structural compliance and
cryptographic proof. It MUST NOT be construed as proof of
application-layer authorization, legal legitimacy, or normative
alignment.
4.3. Deterministic Admission State Machine
An RL0 ingress gate following this architecture MUST enforce bounded
credential and header sizes and MUST bound the amount of input
consumed by structural validation. Admission processing SHOULD be
designed to maintain bounded resource consumption per request under
the declared input and implementation constraints.
1. Step 1: Header Evaluation - For an RL0 implementation using the
RT profile, if the required RT is absent or malformed under
[RFC8941] rules, DROP the request.
2. Step 2: Key & Revocation Lookup - Verify key ID (kid) against
local out-of-band key store or compact revocation structure
(e.g., Cuckoo Filter). If key is unknown or revoked, DROP the
request.
3. Step 3: Cryptographic & Replay Verification - Validate signature
in constant time and check timestamp window. If signature is
invalid, expired, or detected as a replay via sliding Bloom
filter, DROP the request.
Feria Hernandez Expires 5 March 2027 [Page 9]
Internet-Draft SAS Model & Architecture September 2026
4. Step 4: Predicate Evaluation - If R_sov is configured as a
mandatory admission condition and R_sov != 1, REJECT the request.
5. Step 5: Layer Selection - If Layer 1 is enabled, forward the
structurally admitted request to Layer 1; otherwise forward the
request to the protected application.
If any structural verification step encounters a processing error,
internal exception, or validation timeout, the RL0 state machine MUST
fail closed and reject the request.
4.4. Two-Layer Architecture (RL0 / Prudential Gating)
This specification explicitly separates structural admission from
subsequent prudential evaluation:
* *Layer 0 (RL0):* Performs deterministic structural and
cryptographic validation. Layer 0 answers: "Is this request
structurally admissible at the perimeter?"
* *Layer 1 (Prudential Gating):* An optional higher-level layer
evaluates contextual, evidential, normative, and policy properties
of traffic that has already satisfied Layer 0 admission. Layer 1
answers: "Should an admitted request be permitted to execute given
current context?"
Because Layer 0 can reject structurally non-admissible traffic before
Layer 1 invocation, the architecture is intended to reduce the volume
of traffic exposed to more computationally expensive contextual
evaluation. The magnitude of that reduction is an empirical question
addressed by the evaluation methodology.
5. Reality Sovereignty Metric and Predicate
RL0 may associate structural admission with a binary reality
sovereignty predicate R_sov defined by:
R_sov = sigma_BIT * VC_ctx * Omega_env
where sigma_BIT in {0, 1} represents structural and cryptographic
validity, VC_ctx in {0, 1} represents valid contextual scope, and
Omega_env in {0, 1} represents environmental validity assertions.
Because all three factors are binary, R_sov is binary and can equal 1
only when all mandatory predicates evaluate to 1.
When R_sov is configured as a mandatory admission condition and R_sov
!= 1, the RL0 implementation MUST reject the request.
Feria Hernandez Expires 5 March 2027 [Page 10]
Internet-Draft SAS Model & Architecture September 2026
The mathematical formulation of R_sov is associated with the
Invariant Reality Prism (IRP) framework, listed as an Informative
Reference in the NIST Cybersecurity Framework Online Informative
References catalog under Reference ID 189 (IRP-189) [NIST-IRP-189].
The NIST OLIR entry is cited solely as informational provenance for
the referenced IRP framework. Its inclusion does not imply NIST
authorship, endorsement, certification, validation, or normative
incorporation of the IRP framework into an IETF protocol or standard.
6. Threat Model and Risk Vectors
6.1. Volumetric Synthetic Saturation
An adversary may deploy autonomous processes capable of emitting
high-frequency unverified traffic streams. Without effective
admission control, downstream parsing and backend processing may
consume substantial computational resources. RL0 is intended to
mitigate this condition by rejecting structurally unverified requests
before protected application-layer execution.
6.2. Synthetic Identity and Workflow Spoofing
Automated agents may generate forged identities or mimic legitimate
workflow patterns. RL0 can mitigate structural credential forgery by
requiring valid cryptographic signatures anchored to trusted key
structures before admission.
6.3. Credential Forgery and Replay State Paradox
An adversary may replay recorded valid Reality-Tokens to bypass
cryptographic validation. Under Supercritical SAS regimes (SAS > 1 +
epsilon), maintaining unbounded state lists for nonce or sequence
tracking introduces a memory exhaustion vulnerability at the
perimeter node itself.
To resolve this state paradox without compromising perimeter low-
latency objectives, implementations MUST enforce ultra-short temporal
validity windows (Delta t_valid <= 5 seconds) synchronized via
network time protocols (NTP/PTP). Implementations SHOULD complement
short temporal windows with bounded-state memory structures, such as
Time-Bound Sliding Bloom Filters operating with fixed memory capacity
M_max and O(1) insertion/lookup complexity. Stateful tracking
requiring long-term persistence MUST be delegated downstream to Layer
1 or application-layer policy engines.
Feria Hernandez Expires 5 March 2027 [Page 11]
Internet-Draft SAS Model & Architecture September 2026
6.4. Admission-Layer Resource Exhaustion
The admission boundary itself may become a target for resource-
exhaustion attacks. Implementations SHOULD use cryptographic and
parsing mechanisms whose computational and memory costs are bounded
and appropriate to the expected threat model. Ed25519 is one
possible signature algorithm; cryptographic verification MUST be
implemented using constant-time algorithms to prevent timing side-
channel attacks.
Implementations SHOULD minimize dynamic memory allocation and
expensive processing before cryptographic validation and MUST enforce
bounded credential and header sizes.
6.5. False Rejection
Overly strict admission criteria, expired credentials, key
synchronization failures, or contextual mismatches may cause
legitimate requests to be dropped. Deployments SHOULD measure
legitimate-traffic survival (S_legit) and admission error rates
during operational evaluation and tuning.
7. Operational and Deployment Considerations
1. *Perimeter Placement:* RL0 SHOULD be deployed as close to the
physical or virtual network interface or ingress boundary as
practical, subject to the deployment's security and performance
architecture.
2. *Key Management and Invalidation:* Key distribution for token
verification SHOULD utilize local out-of-band caching to prevent
synchronous external network queries (e.g., JWKS lookups) during
admission decisions. Emergency key or token revocations SHOULD
be propagated using compact, probabilistic O(1) data structures
such as Cuckoo Filters or distributed revocation bit-arrays.
3. *Minimization of State:* Ingress nodes MUST bound memory
allocated to unverified requests. State used for replay
suppression MUST be bounded to M_max, self-expiring, and isolated
from downstream backend memory structures.
4. *Fail-Closed Default:* If an ingress gate experiences an internal
fault that prevents reliable validation, the implementation
SHOULD deny access rather than bypass mandatory admission checks.
5. *Capacity Measurement:* Sustainable admission capacity SHOULD be
established empirically under representative hardware, workload,
concurrency, cryptographic, and network conditions.
Feria Hernandez Expires 5 March 2027 [Page 12]
Internet-Draft SAS Model & Architecture September 2026
8. Experimental Evaluation Methodology
This document establishes a formal experimental framework to
empirically evaluate admission efficacy under varying SAS regimes.
The evaluation is designed to distinguish the contribution of
deterministic Layer 0 filtering from the contribution of optional
Layer 1 prudential evaluation.
8.1. Evaluation Scenarios (A-D)
The experimental design utilizes four comparative scenarios:
+==========+=========+=========+============================+
| Scenario | Layer 0 | Layer 1 | Description |
+==========+=========+=========+============================+
| A | OFF | OFF | Unprotected Baseline |
| | | | (Direct Backend Ingestion) |
+----------+---------+---------+----------------------------+
| B | ON | OFF | Isolated Layer 0 Perimeter |
| | | | Filter |
+----------+---------+---------+----------------------------+
| C | OFF | ON | Isolated Layer 1 |
| | | | Prudential Evaluator |
+----------+---------+---------+----------------------------+
| D | ON | ON | Integrated Two-Layer |
| | | | Defense System |
+----------+---------+---------+----------------------------+
Table 1: Comparative Experimental Scenarios
The four scenarios permit independent estimation of the effect of
Layer 0, the effect of Layer 1, and the combined behavior of the two-
layer architecture.
8.2. Formal Metrics
Implementations SHOULD measure performance using the following
metrics:
* *Avoided Backend Invocations (I_avoided):* I_avoided = 1 -
(N_backend,protected / N_backend,baseline), provided that
N_backend,baseline > 0.
* *Saved Computational Resources (C_saved):* C_saved = 1 -
(Resource_protected / Resource_baseline), provided that
Resource_baseline > 0.
Feria Hernandez Expires 5 March 2027 [Page 13]
Internet-Draft SAS Model & Architecture September 2026
* *Legitimate-Traffic Survival (S_legit):* S_legit =
Throughput_protected,legit / Throughput_baseline,legit, measured
under equivalent legitimate workload conditions, provided that
Throughput_baseline,legit > 0.
* *Inter-Process Communication Latency (L_IPC):* The incremental
latency introduced by transferring request context between Layer 0
and Layer 1.
* *Admission Accuracy Error Rate (E_admission):* A measure of false-
positive and false-negative admission classifications under a
defined ground-truth workload.
8.3. Falsifiable Hypotheses (H1-H3)
The evaluation framework tests three explicit hypotheses:
*H1 (Invocation and Computation Avoidance):* Deterministic perimeter
filtering at Layer 0 reduces backend invocations attributable to
structurally inadmissible traffic and reduces protected computational
consumption relative to the corresponding unprotected baseline
(Scenario A) under equivalent workload and operating conditions, such
that I_avoided > 0 and C_saved > 0 during Critical and Supercritical
SAS regimes.
*H2 (Prudential Composition):* The addition of Layer 1 prudential
gating permits contextual policy evaluation while preserving a
measurable reduction in Layer 1 and backend invocation load relative
to Scenario C, attributable to Layer 0 admission filtering.
*H3 (Net Architectural Efficiency - Falsifiable):* The computational
resources saved by preventing protected backend execution exceed the
computational overhead introduced by the admission architecture.
For a common normalized resource unit U, define:
C_net = C_backend_avoided - C_RL0 - C_L1 - C_IPC
where C_backend_avoided represents protected backend resources
avoided by admission filtering, C_RL0 represents Layer 0 processing
cost, C_L1 represents Layer 1 processing cost when enabled, and C_IPC
represents the resource-equivalent cost of inter-layer communication
(including processing, serialization, transport, and latency
overhead) converted into the normalized resource unit U via a
predefined experimental normalization function.
Feria Hernandez Expires 5 March 2027 [Page 14]
Internet-Draft SAS Model & Architecture September 2026
H3 is supported only when C_net > 0 under the defined experimental
conditions. If experimental data demonstrate C_net <= 0, H3 MUST be
considered rejected for those operating conditions, thereby bounding
the demonstrated efficiency domain of the architecture.
8.4. Illustrative Parameter Ranges for Experimental Planning
To support experimental planning, implementations MAY use preliminary
synthetic projections to identify measurement ranges. The values in
Table 2 represent illustrative parameter ranges for test execution
planning and MUST NOT be interpreted as measured performance results,
validated benchmarks, or expected deployment performance.
+==============+===================+===============+==============+
| Architecture | Illustrative Avg. | Illustrative | Illustrative |
| Stage | Latency / Req. | CPU Cost | System |
| | | Profile | Outcome |
+==============+===================+===============+==============+
| Baseline | 150.0 ms | High (DB/ | High |
| (Backend | | Inference) | Resource |
| only) | | | Pressure |
+--------------+-------------------+---------------+--------------+
| Layer 0 | 0.5 ms | Low | Invalid |
| (RL0) | | (Signature | Traffic |
| | | Verification) | Dropped |
+--------------+-------------------+---------------+--------------+
| Layer 1 | 12.0 ms | Medium | Contextual |
| (Prudential | | (Policy | Decision |
| Gating) | | Evaluation) | |
+--------------+-------------------+---------------+--------------+
Table 2: Illustrative Parameter Ranges - Not Measured
Experimental Results
9. Limitations and Evaluation Boundaries
SAS does not establish malicious intent, attack attribution, or
application-layer authorization. A high SAS value may result from
legitimate autonomous workloads, misconfiguration, protocol retries,
or malicious activity.
RL0 also does not guarantee that backend resource exhaustion is
impossible. The admission layer introduces its own computational
cost and may itself become a resource target. The architecture
therefore requires empirical capacity measurement and comparative
evaluation rather than an assumption of universal efficiency.
Feria Hernandez Expires 5 March 2027 [Page 15]
Internet-Draft SAS Model & Architecture September 2026
Similarly, cryptographic admission establishes structural eligibility
only. It does not establish that an admitted request is safe,
lawful, contextually appropriate, or desirable for execution. Such
determinations remain within application-layer or Layer 1 policy
domains.
10. Security Considerations
RL0 ingress boundaries MUST provide a defined mechanism for limiting
state associated with token tracking or replay-protection structures,
bounding total state memory to M_max.
Cryptographic verification MUST use constant-time implementations
with established side-channel resistance to prevent timing leaks
during signature parsing or key comparison.
Implementations using replayable RT credentials MUST provide replay
resistance appropriate to the deployment model, utilizing short
temporal validity windows (Delta t_valid <= 5 s), audience
constraints, sliding Bloom filters, or equivalent mechanisms as
required by policy.
A failure in Layer 1 evaluation or backend state MUST NOT compromise
the structural filtering integrity of Layer 0.
The admission credential and all data consumed by token parsing and
signature verification MUST be bounded in size. Implementations
SHOULD minimize dynamic memory allocation in the critical path to
reduce algorithmic-complexity and resource-exhaustion risks at the
admission layer.
Because the admission layer becomes a security-critical perimeter
component, implementations SHOULD independently evaluate its
throughput, latency, memory consumption, key-management dependencies,
replay state, and failure behavior under adversarial workloads.
11. IANA Considerations
This document has no IANA actions.
12. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
Feria Hernandez Expires 5 March 2027 [Page 16]
Internet-Draft SAS Model & Architecture September 2026
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", May 2017,
<https://www.rfc-editor.org/info/rfc8174>.
[RFC8941] Nottingham, M. and P-H. Kamp, "Structured Field Values for
HTTP", February 2021,
<https://www.rfc-editor.org/info/rfc8941>.
[RFC9052] Schaad, J., "CBOR Object Signing and Encryption (COSE):
Structures and Headers", August 2022,
<https://www.rfc-editor.org/info/rfc9052>.
13. Informative References
[EACP] Feria Hernandez, P., "Edge Admission Control Profile
(EACP)", Work in Progress, 2026.
[ICANN-METRICS]
Internet Corporation for Assigned Names and Numbers
(ICANN), "ICANN Domain Metrics (Statistical Summary, April
8, 2026)", 8 April 2026.
[NIST-IRP-189]
Feria Hernandez, P., "Invariant-Reality-Prism-Framework-
to-Cybersecurity-Framework-v2.0 Informative Reference
Details", NIST National Online Informative References
(OLIR) Catalog, Reference ID 189; Final; Version 1.0.0, 9
March 2026, <https://csrc.nist.gov/projects/olir/
informative-reference-catalog/details?referenceId=189>.
[THALET] Feria Hernandez, P., "Prudential Gating Architecture for
Autonomous Computational Systems", Work in Progress, 2026.
[VERISIGN-DNIB]
VeriSign, Inc., "The Domain Name Industry Brief: Q2 2026",
Volume 23, Issue 2, 23 July 2026.
Appendix A. Appendix A. Operational Flow Diagram for Reference IRP-
Based RL0 Profile
The operational state sequence executed for each request at Layer 0
is summarized below:
Feria Hernandez Expires 5 March 2027 [Page 17]
Internet-Draft SAS Model & Architecture September 2026
+-------------------------------------------------------------------+
| Ingress Frame / Request |
+-------------------------------------------------------------------+
|
v
+---------------------------+
| Is Reality-Token (RT) | --- NO ---> [ DROP ]
| present? |
+---------------------------+
| YES
v
+---------------------------+
| Is Key & Revocation valid | --- NO ---> [ DROP ]
| (O(1) Cuckoo / Cache)? |
+---------------------------+
| YES
v
+---------------------------+
| Is Cryptographic Sig & | --- NO ---> [ DROP ]
| Short Window (<=5s) valid?|
+---------------------------+
| YES
v
+---------------------------+
| Does Predicate R_sov | --- NO ---> [ REJECT ]
| equal 1? |
+---------------------------+
| YES
v
+---------------------------+
| Layer 1 Enabled? |
+---------------------------+
| |
YES NO
| |
v v
+-------------------+ +-------------------+
| Layer 1 Prudential| | Protected |
| Evaluation | | Application |
+-------------------+ +-------------------+
| |
DENY PERMIT
| |
DROP v
+-------------------+
| Protected |
| Application |
+-------------------+
Feria Hernandez Expires 5 March 2027 [Page 18]
Internet-Draft SAS Model & Architecture September 2026
Author's Address
Pablo Octavio Feria Hernandez
LexaryNova IusTech
Xalapa, Veracruz
Mexico
Email: lexarynova@pm.me
Feria Hernandez Expires 5 March 2027 [Page 19]