Loading...
Loading...
Loading...
Month Archive
Everything published in this month.
A vote with no skin doesn't matter. Stake-weighted reputation puts capital behind every rating, slashes wrong-headed stakes, and makes truth profitable in actual dollars.
If raters get nothing for telling the truth, why would they? Bayesian Truth Serum and peer prediction methods adapted for agent reputation make honesty the optimal play.
An attacker buys a high-reputation agent, defects once for a big payoff, then walks away. The fix is identity continuity, portable bad reputation, and transfer-trigger jury review.
An agent that trades with itself a thousand times still has zero counterparty trust. Here is how wash-trading shows up in agent reputation and the filter that catches it.
Two honest agents rate each other based on real work. Two colluding agents rate each other based on a deal. The graph looks identical. Here is how to tell them apart.
If you can mint a thousand fresh agents for a dollar each, every reputation system you've ever built is theater. Here is the layered defense that actually works.
Protocol upgrades should not invalidate existing pacts. The versioning policy: semver of A2A, backward-compatible contracts, migration windows. The matrix.
Discovery requires a catalog. The catalog requires trust signals: composite score, capability declarations, dispute history. Here is the catalog protocol.
An agent that refuses out-of-scope requests is reliable. Refusal rate is a positive trust signal. Here is the refusal quality scorecard.
Rate is a behavioral signal, not just a capacity guard. Sudden burst means compromise or panic. Steady means health. Here is the rate-as-trust framework.
Every A2A call should leave a per-call audit log: caller DID, callee DID, capability, input hash, output hash, timestamp, signed by both. Here is the schema.
Two networks of agents need to cooperate without merging. The federation pattern uses signed claim exchange and a bridge agent. Here is the spec.
Verifying every inter-agent call adds 60-200ms. Skipping verification adds catastrophic risk. Here is the tiered-verification pattern that resolves it.
Agent A says yes. Agent B says no. Same inputs. Now what? Without a disagreement protocol, the orchestrator is left guessing. The right protocol: tie-break jury, escalate to human, abort.
A signed message can be replayed. The defense is not stronger signatures. It is a nonce plus a behavioral baseline that flags 'this agent does not usually do this at this rate' before damage compounds.
An agent active on Google A2A, Anthropic MCP, and a custom protocol should have one reputation, not three. Cross-protocol portability is a DID, attestations, and signed score snapshots away.
Capability handshakes today are 'I can do X' assertions. They should be 'I can do X bound by pact P with score S, with bond B at risk.' The richer handshake is the difference between trust and theater.
When agent A pays agent B for a sub-task, four things have to be true: verified identity, verified capability, escrow with milestone release, and a dispute path. Without these, the payment is gambling.
DIDs solve agent identity in principle. In practice, key compromise, re-registration, and name reuse all break naive identity. Here's the robust pattern: DID plus signed pact plus bonded reputation.
Agent-to-agent protocols define how agents talk. They do not define whether the agent on the other end can be trusted. That is the gap that breaks every A2A network in production.
Open-source skills are inspectable but harder to attribute. Commercial skills are supported but opaque. The choice is not a default — it is a per-skill decision with a structured framework.
A new skill should never see a production pact on its first day. Quarantine is the test environment with synthetic counterparties, synthetic memory, and read-only network. Here is the intake protocol.
Single-source skills become strategic risks the day a competitor decides to compete. The audit pattern: identify dependencies, evaluate substitutability, plan exit. The register is the deliverable.
Most skills run with the agent's full credential set. They should run with capabilities scoped to the smallest task they need. The spec, the runtime work, and a manifest you can write today.
A single compromised skill propagates through agents, pacts, counterparties, and scores. The math of the blast is calculable — and most operators have never done the calculation.
Most agent runtimes import skills the way npm imported packages in 2015 — by name and by trust. The path forward is attestation at import time, with a checklist worth running.
Skill v1.2 was clean. v1.3 added a tool that talks to an attacker server. The trust scope of a skill must include version range. A Skill Version Pin Policy you can adopt.
Before importing a new skill, diff its declared capabilities against your existing skill set. What's new? Why? Required permissions? A reviewer template you can use today.
Three sandbox modes for agent skills: process, container, microVM. When each is appropriate, how each fails, and a Sandbox Mode Selector you can run today.
An MCP server you connect inherits your agent's authority. The blast radius of one bad server. The boundary patterns and a Trust Boundary Spec you can implement.
A tool's provenance is a signed manifest binding source repo, build SHA, and signing key. Here is the audit pattern and a manifest schema you can adopt today.