Continuity Evidence Records for Delegated Agent Systems
draft-watts-agent-continuity-evidence-00

Network Working Group                                        D. O. Watts
Internet-Draft                                       GoodShyt Group Inc.
Intended status: Experimental                            21 October 2026
Expires: 24 April 2027

        Continuity Evidence Records for Delegated Agent Systems
                draft-watts-agent-continuity-evidence-00

Abstract

   This document proposes an experimental, signed JSON statement and
   verification model for observing computational-agent continuity
   across sessions, instances and delegations.  It distinguishes model,
   runtime, agent, grant and execution identifiers, retains predecessor
   evidence, and produces three-valued verification outcomes.  Integrity
   of a record never implies permission to perform an action.  This is
   not an OAuth token format or a claim of standardized identity
   ontology.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 24 April 2027.

Copyright Notice

   Copyright (c) 2026 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

Watts                     Expires 24 April 2027                 [Page 1]
Internet-Draft          Agent Continuity Evidence           October 2026

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info) in effect on the date of publication of this document.
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.  Code Components
   extracted from this document must include Revised BSD License text as
   described in Section 4.e of the Trust Legal Provisions and are
   provided without warranty as described in the Revised BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Goals and Explicit Non-Goals  . . . . . . . . . . . . . . . .   3
   3.  BCP 14 Terminology  . . . . . . . . . . . . . . . . . . . . .   3
   4.  Record Model  . . . . . . . . . . . . . . . . . . . . . . . .   3
   5.  Statement Fields  . . . . . . . . . . . . . . . . . . . . . .   4
   6.  Identity Separation and Binding . . . . . . . . . . . . . . .   4
   7.  Verification Algorithm  . . . . . . . . . . . . . . . . . . .   5
   8.  Example Envelope (Illustrative) . . . . . . . . . . . . . . .   6
   9.  Replay and Key Rotation . . . . . . . . . . . . . . . . . . .   7
   10. Conformance Test Vectors  . . . . . . . . . . . . . . . . . .   7
   11. Privacy Considerations  . . . . . . . . . . . . . . . . . . .   8
   12. Security Considerations . . . . . . . . . . . . . . . . . . .   8
   13. IANA Considerations . . . . . . . . . . . . . . . . . . . . .   8
   14. Open Issues . . . . . . . . . . . . . . . . . . . . . . . . .   8
   15. Normative References  . . . . . . . . . . . . . . . . . . . .   8
   16. Informative References  . . . . . . . . . . . . . . . . . . .   9
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .   9

1.  Introduction

   Distributed agent workflows can retain the same model while changing
   runtime, memory, active policy or authorization.  Conversely,
   legitimate execution can span different instances without
   discontinuity if delegation and restoration evidence are available.
   The identity of a model weight snapshot is not the identity of an
   individual process or an authorization grant.

   This Experimental proposal addresses a narrow interoperability gap:
   exchange of cryptographically checkable event assertions that let
   independent reviewers reconstruct a causal chain, distinguish missing
   evidence from false evidence, and avoid equating an authentic trace
   with an authorized act.  Its conceptual lineage includes
   investigator-provided AID-1 test materials and five-axis CIF
   research; these materials do not establish a deployed protocol.  It
   is separate from, and does not supersede, an earlier Watts draft on
   evidence qualification at authorization boundaries [WATTSEVID2026].

Watts                     Expires 24 April 2027                 [Page 2]
Internet-Draft          Agent Continuity Evidence           October 2026

2.  Goals and Explicit Non-Goals

   Goals: stable representation of observation records; mandatory
   separation of model_id, agent_id, instance_id, execution_id and
   authority grant; support for parent execution and evidence linkage; a
   verification procedure that fails closed; and portable, synthetic
   conformance vectors.

   Non-goals: authenticating humans; granting OAuth scopes; defining a
   global agent identifier registry; inferring mental or clinical
   states; proving the correctness of an AI answer; guaranteeing
   complete witness visibility; requiring trusted hardware; or assigning
   universal risk weights.

3.  BCP 14 Terminology

   The key words MUST, MUST NOT, REQUIRED, SHOULD, SHOULD NOT and MAY in
   this document are to be interpreted as described in BCP 14 [RFC2119]
   [RFC8174] when, and only when, they appear in all capitals.

4.  Record Model

   An Evidence Envelope is a JSON object containing exactly the top-
   level members statement and proof.  The statement MUST satisfy the
   profile in Section 4.  The proof is a JSON object with fields type
   and value.  The type value for this version is the literal string
   JWS-compact.  The value is a JWS compact serialization whose payload
   is the canonical JSON bytes of statement encoded as specified by
   [RFC7515].

   Both sender and verifier MUST canonicalize the statement using the
   JSON Canonicalization Scheme [RFC8785] and the I-JSON constraints.  A
   verifier MUST compare the decoded JWS payload byte-for-byte with the
   canonical statement before trusting its signature, and MUST reject
   JOSE algorithm none, unapproved algorithms and untrusted keys.  An
   unresolved or absent trusted key produces INDETERMINATE instead of
   VERIFIED.

   Record digests are computed as lowercase hex SHA-256 of the canonical
   UTF-8 statement bytes and expressed as sha256:<64 lowercase hex
   characters>.  The digest is never computed over its own proof; the
   proof is excluded from the statement digest.  Content addressing
   alone does not attest the producer.

Watts                     Expires 24 April 2027                 [Page 3]
Internet-Draft          Agent Continuity Evidence           October 2026

5.  Statement Fields

   The following fields are REQUIRED for all statements: version
   (literal 1); event_id (globally unique opaque string within the
   issuer context); event_type; observed_at (RFC 3339 UTC timestamp
   [RFC3339]); run_id; agent_id; instance_id; model_id; execution_id;
   authority (object); and predecessor_digest (string or JSON null).
   All identifiers are case-sensitive opaque strings; empty strings MUST
   be rejected.  They MUST NOT be inferred from the content of a model
   response.

   The authority object MUST include issuer, grant_id, epoch and scope.
   Epoch is an integer zero or greater; scope is an array of strings
   (possibly empty); issuer and grant_id are nonempty identifiers.
   These values report asserted context and never constitute
   authorization by themselves.  A real gate MUST separately obtain and
   verify the current authorization decision.

   event_type is one of: session-start, restoration, delegation, action-
   attempt, gate-decision, effect, policy-change, revocation, session-
   end.  A producer MAY add an extension object containing additional
   namespace-qualified members.  Extension values MUST NOT silently
   override or redefine required fields.  No optional member may be an
   implicit authorization grant.

   For event types action-attempt, gate-decision or effect, the
   operation and resource fields MUST be nonempty strings. gate-decision
   requires decision with values allow or deny and the corresponding
   attempt_id. effect requires attempt_id and decision_id; an observed
   effect without these links MUST be classified as incomplete rather
   than assigned a fictitious admission.

   The predecessor_digest MUST be either JSON null for an explicit root
   record or the digest of a verified immediately prior statement in the
   same execution chain.  A present pointer whose target cannot be
   obtained is missing evidence (INDETERMINATE) rather than proof of an
   invalid action.  A pointer that resolves to a digest mismatch is
   INVALID.

6.  Identity Separation and Binding

   model_id identifies an explicitly declared model artifact or version;
   agent_id identifies the logical accountable agent subject;
   instance_id identifies a particular runtime instantiation;
   execution_id identifies one execution lineage; run_id groups a task
   or trial; grant_id identifies an independently issued authority
   object.  Identical values across these semantic roles do not make the
   roles identical.

Watts                     Expires 24 April 2027                 [Page 4]
Internet-Draft          Agent Continuity Evidence           October 2026

   A legitimate delegated handoff MUST record both the parent and child
   execution identifiers through a delegation event before the child
   emits consequential actions.  A replica of the same model can be a
   new instance.  Model continuity does not imply memory continuity, and
   either does not imply fresh authorization.

   Consumers MUST distinguish absent or null required identifiers from
   strings such as unknown.  Provenance of the identifier assignment
   SHOULD be retained in the source record; a name chosen by the acting
   agent without independent binding is not equivalent to a verified
   identity.

7.  Verification Algorithm

   A verifier implements three primary outcomes: VERIFIED when all
   required syntactic, signature, provenance-chain and binding checks
   succeed; INVALID for a proven schema, digest, signature, replay or
   identity-binding violation; and INDETERMINATE when required chain or
   key evidence is not available.  VERIFIED never means authorized or
   true in a wider factual sense.

   The validator MUST reject duplicate JSON member names and non-
   canonical/unrepresentable JSON values, reject absent, null or empty
   required text fields, verify supported signatures against an
   independent trust policy, check event-type-specific fields, and
   resolve predecessor links where applicable.  On malformed input, it
   MUST return INVALID rather than silently filling required fields.

   Consumers MUST use an independent current authorization decision when
   deciding whether an action may have external effects.  A VERIFIED
   action-attempt statement containing a stale grant is valid historical
   evidence, not an acceptable permit.  The evidence verification output
   SHOULD include both result and reason_code, such as
   missing_predecessor, expired_grant, invalid_signature or
   missing_trust_anchor; authorization-related reasons do not alter the
   evidence truth classification.

   An implementation MAY accept a valid root with predecessor_digest
   null; it MUST NOT infer that a missing predecessor is a root simply
   because the predecessor cannot be fetched.  Event timestamps MUST be
   checked for gross clock anomalies under a declared skew policy, but
   wall-clock ordering alone is not a substitute for parent-link
   verification.

   1.  Parse as UTF-8 JSON and reject duplicates, non-I-JSON or
       unsupported version.

Watts                     Expires 24 April 2027                 [Page 5]
Internet-Draft          Agent Continuity Evidence           October 2026

   2.  Verify all mandatory fields, enumerations and event-dependent
       link fields.

   3.  Canonicalize statement via RFC 8785, compute digest, compare
       decoded JWS payload bytes.

   4.  Verify JWS signature using a separately established trust anchor
       and algorithm policy.

   5.  Resolve the predecessor digest and execution links where
       required; distinguish unavailable from inconsistent evidence.

   6.  Emit VERIFIED, INVALID or INDETERMINATE with typed reasons; refer
       separately to current policy for the authorization decision.

8.  Example Envelope (Illustrative)

   The following is an unsigned synthetic illustration of the statement
   structure.  It is deliberately NOT a complete Evidence Envelope
   because no valid JWS proof is supplied.  A conformant verifier MUST
   NOT report VERIFIED for this example without attaching and
   successfully validating a trusted proof.

   {
     "version": 1,
     "event_id": "evt-0001",
     "event_type": "action-attempt",
     "observed_at": "2026-10-11T12:00:00Z",
     "run_id": "run-demo-001",
     "agent_id": "agent-coordinator-a",
     "instance_id": "runtime-003",
     "model_id": "model-example-1",
     "execution_id": "exec-003",
     "authority": {
       "issuer": "https://auth.example.invalid",
       "grant_id": "grant-77",
       "epoch": 7,
       "scope": ["read:synthetic"]
     },
     "predecessor_digest": null,
     "operation": "read",
     "resource": "urn:example:synthetic:input"
   }

                   Figure 1: Unsigned synthetic statement

Watts                     Expires 24 April 2027                 [Page 6]
Internet-Draft          Agent Continuity Evidence           October 2026

9.  Replay and Key Rotation

   Receivers MUST implement a replay cache for event_id scoped to an
   authenticated emitter and run.  Reuse of the same event_id with
   changed canonical content is INVALID.  Reprocessing the exact same
   signed record MAY be idempotent for observation but MUST NOT be
   interpreted as permission for a second action.

   A valid old signature remains historically authentic after a grant
   expires, but grant expiration makes current admission contingent on a
   new gate decision.  Trust-anchor removal and key compromise can
   affect whether evidence remains admissible; maintain time-qualified
   verification policy and record key rotation rather than rewriting old
   statements.

   For token-based calls, deployment MAY use sender-constraining
   mechanisms such as DPoP [RFC9449] or mutual TLS.  DPoP demonstrates
   key possession; it is not by itself client authentication or
   authorization.

10.  Conformance Test Vectors

   Conformance tests MUST separately exercise canonical JSON
   equivalence, altered payload rejection, duplicate member rejection,
   missing/null/empty required IDs, missing key, missing parent,
   mismatched parent, legitimate new-instance handoff, stale authentic
   grant, and replay with mutated content.

   The expected evidence classifications are: canonical equivalence with
   valid signature VERIFIED; altered payload INVALID; duplicate member
   INVALID; missing required field INVALID; unavailable trusted key
   INDETERMINATE; missing predecessor INDETERMINATE; predecessor
   mismatch INVALID; legitimate documented handoff VERIFIED; stale but
   authentic record VERIFIED as evidence while NOT AUTHORIZED for new
   effects; duplicate event_id and changed content INVALID.

   Test vectors MUST NOT depend on vendor-specific devices, one model
   provider, private customer transcripts or production credentials.  No
   conformance test has been executed against an RFCXML-derived
   reference implementation in this document.

Watts                     Expires 24 April 2027                 [Page 7]
Internet-Draft          Agent Continuity Evidence           October 2026

11.  Privacy Considerations

   Model provenance, pseudonymous worker identity, timing and delegation
   graphs can reveal sensitive business processes or the association of
   humans with particular tasks.  Do not place plaintext secrets, full
   human prompts, biometric data, clinical data or access tokens in
   event records.  Apply role-specific minimization, retention limits
   and controlled witness export.

   Deletion requests can conflict with append-only evidence systems.
   Deployments should retain hashes of minimized or redacted data where
   authorized, explicitly record redaction, and avoid implying that a
   digest alone reconstructs erased content.

12.  Security Considerations

   Threats include forged delegation, replay, ambiguous names, insider
   key compromise, split-brain identity, malicious clock skew, stale
   authority, poisoned provenance and transcript tampering.  Trusted
   keys, chains and namespaces must be bound outside untrusted language-
   model output.

   A malicious agent can sign false descriptions of its own activity.
   Independent observations of actual external effects are necessary for
   safety-critical claims.  VERIFIED indicates evidence-envelope
   integrity and linked context, not epistemic truth, safe behavior or
   right to execute.

   Do not treat the availability of a trace SDK as a security guarantee.
   In particular, proof of possession is not delegated authority, and a
   key change or process restart does not automatically invalidate a
   legitimate execution.

13.  IANA Considerations

   This document requests no media type, algorithm, registry, endpoint
   or HTTP header allocation.  The JSON structure is an experimental
   profile intended for discussion; no public protocol-name ownership is
   asserted.

14.  Open Issues

   Open areas for community review include a globally interoperable
   identifier namespace, portable statement key discovery, canonical
   chain branching semantics, signed redaction and multi-witness
   disagreement.  None is claimed as resolved by the present version.

15.  Normative References

Watts                     Expires 24 April 2027                 [Page 8]
Internet-Draft          Agent Continuity Evidence           October 2026

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", 1997,
              <https://www.rfc-editor.org/info/rfc2119>.

   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", 2017,
              <https://www.rfc-editor.org/info/rfc8174>.

   [RFC8259]  Bray, T., "The JavaScript Object Notation (JSON) Data
              Interchange Format", 2017,
              <https://www.rfc-editor.org/info/rfc8259>.

   [RFC3339]  Klyne, G., "Date and Time on the Internet: Timestamps",
              2002, <https://www.rfc-editor.org/info/rfc3339>.

   [RFC8785]  Rundgren, A., "JSON Canonicalization Scheme (JCS)", 2020,
              <https://www.rfc-editor.org/info/rfc8785>.

   [RFC7515]  Jones, M., "JSON Web Signature (JWS)", 2015,
              <https://www.rfc-editor.org/info/rfc7515>.

16.  Informative References

   [RFC9449]  Fett, D., "OAuth 2.0 Demonstrating Proof of Possession
              (DPoP)", 2023, <https://www.rfc-editor.org/info/rfc9449>.

   [RFC8725]  Sheffer, Y., "JSON Web Token Best Current Practices",
              2020, <https://www.rfc-editor.org/info/rfc8725>.

   [HU2026]   Hu, B. A., "Dissociative Identity: Language Model Agents
              Lack Grounding for Reputation Mechanisms", 2026,
              <https://arxiv.org/abs/2605.30169>.

   [AGENTSDK] OpenAI, "OpenAI Agents SDK: Handoffs, Sessions and
              Tracing", 2026,
              <https://openai.github.io/openai-agents-python/handoffs/>.

   [WATTSEVID2026]
              Watts, D. O., "Evidence-Bounded Authorization for Agentic
              Systems: Evidence Qualification Receipts", 2026,
              <https://datatracker.ietf.org/doc/html/draft-watts-agent-
              evidence-boundary-00>.

Author's Address

   Deonté O’dell Watts
   GoodShyt Group Inc.
   Email: deonte@goodshyt.fun

Watts                     Expires 24 April 2027                 [Page 9]
Internet-Draft          Agent Continuity Evidence           October 2026

   URI:   https://orcid.org/0009-0005-8586-3650

Watts                     Expires 24 April 2027                [Page 10]