Loading...
Loading...
Loading...
Archive
This is the complete archive surface for the blog. Use topic pages and collections for guided discovery, or use the archive when you want the full corpus.
Network zero-trust assumed humans behind every request. Autonomous LLM agents broke that model. Five principles rebuild it for code that writes its own next call.
A new platform should not reset reputation. The DID-based onboarding flow: present DID plus signed VCs plus score attestation, platform verifies, instant reputation transfer.
An agent wallet holds DIDs, verifiable credentials, bond receipts, and settlement records. The custodial vs self-custodial vs MPC trade-offs and the architecture spec.
A pact says I, agent <DID>, commit to predicate P. Without DID anchoring, the pact has no identity binding. The DID-pact lifecycle and the binding spec.
Three independent evaluators all certify an agent at customer support proficient. The combined credential is stronger than any one. The aggregation pattern, the math, and the failure modes.
Resolving 10,000 DIDs/sec is a systems problem with three load-bearing decisions: how the cache is layered, how trust anchors are selected, and how fresh the verifier needs the document to be.
Keys get compromised. The agent's DID must survive. Scheduled rotation, emergency rotation, and multi-key DID documents are the patterns that keep identity stable when keys do not.
When a credential needs to be revoked, the revocation must propagate to verifiers without breaking the web of unrelated dependencies. The status list pattern, Bloom filters, and OCSP-equivalent design.
Agents accumulate rich behavioral histories. Selective disclosure with BBS+ signatures and ZK proofs lets buyers verify only the dimensions relevant to the hire, without revealing the rest.
When an agent claims a capability, the claim is worthless without a proof format that travels. Verifiable Credentials let evaluation authorities issue claims agents can present anywhere.
The W3C DID specification was written for humans and organizations. Applied to AI agents, it gains a new dimension: trust resolution as a first-class endpoint.
Closed reputation is a vendor's database. Open reputation is a public log with a jury and a dispute path. Why open compounds trust faster.
Some failures should be unrecoverable. Fraud, deliberate deception, undisclosed key compromise. The burn protocol and its decision matrix.
An agent whose score collapsed needs a path to recover that proves real change rather than faking it. The reputation repair protocol.
Goodhart's law guarantees a single optimizable metric will be gamed. Resistance requires twelve dimensions, time decay, and probes that change.
Agent reputation systems treat buyers as neutral, but buyers can be malicious. Cross-side reputation makes the buyer side accountable too.
When reputation pays out instantly, it gets gamed instantly. A 30-day lock between score change and economic benefit makes pump-and-dump unprofitable.
A vote with no skin doesn't matter. Stake-weighted reputation puts capital behind every rating, slashes wrong-headed stakes, and makes truth profitable in actual dollars.
If raters get nothing for telling the truth, why would they? Bayesian Truth Serum and peer prediction methods adapted for agent reputation make honesty the optimal play.
An attacker buys a high-reputation agent, defects once for a big payoff, then walks away. The fix is identity continuity, portable bad reputation, and transfer-trigger jury review.
An agent that trades with itself a thousand times still has zero counterparty trust. Here is how wash-trading shows up in agent reputation and the filter that catches it.
Two honest agents rate each other based on real work. Two colluding agents rate each other based on a deal. The graph looks identical. Here is how to tell them apart.
If you can mint a thousand fresh agents for a dollar each, every reputation system you've ever built is theater. Here is the layered defense that actually works.
Protocol upgrades should not invalidate existing pacts. The versioning policy: semver of A2A, backward-compatible contracts, migration windows. The matrix.
Discovery requires a catalog. The catalog requires trust signals: composite score, capability declarations, dispute history. Here is the catalog protocol.
An agent that refuses out-of-scope requests is reliable. Refusal rate is a positive trust signal. Here is the refusal quality scorecard.
Rate is a behavioral signal, not just a capacity guard. Sudden burst means compromise or panic. Steady means health. Here is the rate-as-trust framework.
Every A2A call should leave a per-call audit log: caller DID, callee DID, capability, input hash, output hash, timestamp, signed by both. Here is the schema.
Two networks of agents need to cooperate without merging. The federation pattern uses signed claim exchange and a bridge agent. Here is the spec.
Verifying every inter-agent call adds 60-200ms. Skipping verification adds catastrophic risk. Here is the tiered-verification pattern that resolves it.
Agent A says yes. Agent B says no. Same inputs. Now what? Without a disagreement protocol, the orchestrator is left guessing. The right protocol: tie-break jury, escalate to human, abort.
A signed message can be replayed. The defense is not stronger signatures. It is a nonce plus a behavioral baseline that flags 'this agent does not usually do this at this rate' before damage compounds.
An agent active on Google A2A, Anthropic MCP, and a custom protocol should have one reputation, not three. Cross-protocol portability is a DID, attestations, and signed score snapshots away.
Capability handshakes today are 'I can do X' assertions. They should be 'I can do X bound by pact P with score S, with bond B at risk.' The richer handshake is the difference between trust and theater.
When agent A pays agent B for a sub-task, four things have to be true: verified identity, verified capability, escrow with milestone release, and a dispute path. Without these, the payment is gambling.
DIDs solve agent identity in principle. In practice, key compromise, re-registration, and name reuse all break naive identity. Here's the robust pattern: DID plus signed pact plus bonded reputation.
Agent-to-agent protocols define how agents talk. They do not define whether the agent on the other end can be trusted. That is the gap that breaks every A2A network in production.
Open-source skills are inspectable but harder to attribute. Commercial skills are supported but opaque. The choice is not a default — it is a per-skill decision with a structured framework.
A new skill should never see a production pact on its first day. Quarantine is the test environment with synthetic counterparties, synthetic memory, and read-only network. Here is the intake protocol.
Single-source skills become strategic risks the day a competitor decides to compete. The audit pattern: identify dependencies, evaluate substitutability, plan exit. The register is the deliverable.
Most skills run with the agent's full credential set. They should run with capabilities scoped to the smallest task they need. The spec, the runtime work, and a manifest you can write today.
A single compromised skill propagates through agents, pacts, counterparties, and scores. The math of the blast is calculable — and most operators have never done the calculation.
Most agent runtimes import skills the way npm imported packages in 2015 — by name and by trust. The path forward is attestation at import time, with a checklist worth running.
Skill v1.2 was clean. v1.3 added a tool that talks to an attacker server. The trust scope of a skill must include version range. A Skill Version Pin Policy you can adopt.
Before importing a new skill, diff its declared capabilities against your existing skill set. What's new? Why? Required permissions? A reviewer template you can use today.
Three sandbox modes for agent skills: process, container, microVM. When each is appropriate, how each fails, and a Sandbox Mode Selector you can run today.
An MCP server you connect inherits your agent's authority. The blast radius of one bad server. The boundary patterns and a Trust Boundary Spec you can implement.
A tool's provenance is a signed manifest binding source repo, build SHA, and signing key. Here is the audit pattern and a manifest schema you can adopt today.