| Internet-Draft | Claim Boundaries | September 2026 |
| Sergeev | Expires 27 March 2027 | [Page] |
Systems that act in the world produce logs, receipts, approvals, traces, attestations, provenance statements, and transparency records. These artifacts are routinely offered as evidence that an action was authorized, performed, or completed. This document states a discipline for bounding such claims: the strength of an execution-related claim is limited by what the available evidence actually observed, constitutes, or proves, and by the control and observation topology at the boundary that produced it. Message formats, signature validity, receipt validity, and registration do not create observation or independence that did not exist. No message format can supply the independent enforcement or observation dependencies that a prevention or adversary-resistant detection-coverage guarantee requires. An appendix works through a scenario in which one party creates another and may be able to act in its name. The document defines no protocol, no record format, and no registry. It collects non-inference rules, a control-topology test for prevention and detection claims, a worked example, and reporting distinctions for evidence that does not support the claim asserted over it.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 27 March 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
An operator states that "the payment was executed". The artifact behind the statement is a signed log entry produced by the operator's own service. The signature verifies. The schema validates. The entry was registered with a transparency service. None of that establishes that the payment reached the payment network, only that the operator recorded and registered a well-formed statement saying so.¶
Gaps of this kind are routine wherever execution-related evidence is consumed: audit pipelines, compliance reporting, supply-chain attestation, and incident forensics. They appeared recently and sharply in the IETF's agent-protocol discussions of 2026 (Appendix A), in protocols for AI agents, where one party's software performs actions whose records are produced largely by the acting side itself.¶
The failure mode is semantic and assurance inflation: the strength of a claim silently grows as an artifact moves between parties, formats, and summaries. A record of an invocation is cited as proof of execution. A valid signature is read as truth of the signed statement. The presence of an audit trail is read as completeness of coverage. An authorization is reported as an action performed. Each step feels small, but together they produce a claim that no producing boundary ever observed.¶
This document states the bounding discipline in one place, in protocol-neutral terms, so that specifications, deployments, and reviews can name the exact point at which a claim outruns its evidence.¶
This document is descriptive. It defines no wire format, no transport, no carrier, no record or receipt format, no authority or authorization mechanism, no registry, and no generic evidence protocol. It does not compete with, extend, or profile any of the systems discussed in Section 13. It states analytic limits that hold whichever of those systems carries the evidence. Because it specifies no protocol behavior, it does not use BCP 14 requirement keywords: statements of the form "X does not establish Y" are claims about what an artifact can support, not conformance requirements.¶
This document states a claim-appraisal discipline, not an evidence-design discipline. It identifies when available evidence does or does not establish a claim, from the position of a relying party deciding what to conclude from what it has. It does not prescribe the complete set of observations, bindings, retention mechanisms, or architecture that would have to be put in place in advance so that a given claim remains determinable later. Enforcement or observation at the time of an action and determination at a later time are related, but they are not the same requirement. What further material should have been captured or bound at action time, where, and by whom, is related work and outside the scope of this document.¶
The discipline is not new in its parts. Bounded claim statements are already in use in specific domains: a time-stamp token is evidence that a datum existed before a particular time, and the authority time-stamps only a hash of the datum and does not examine it [RFC3161]; DomainKeys Identified Mail (DKIM) distinguishes the signing domain from the purported author and limits its integrity assertion to the content covered by the signature [RFC6376]; certificate transparency describes its logs as making misissuance detectable rather than preventing it [RFC9162]; supply-chain transparency describes itself as holding issuers accountable rather than preventing dishonest ones [RFC9943]. This document collects such statements as one discipline for execution-related evidence and claims no priority for any individual rule.¶
This document uses the following terms descriptively. It uses "claim", "evidence", and "relying party" in their general senses. In the Remote ATtestation procedureS (RATS) architecture [RFC9334], Evidence and Attestation Results are distinct artifacts, and either can serve as evidence here. A RATS Claim is a piece of asserted information inside such an artifact, while a claim here is a statement offered for reliance. Where a RATS term is meant, it is capitalized.¶
A statement offered for reliance, concerning an action: that it was intended, authorized, invoked, performed, completed, or had an effect.¶
Artifacts offered in support of a claim: records, logs, receipts, signatures, attestations, provenance statements, transparency entries, and similar.¶
The vantage point, component, or interface at which a piece of evidence was produced, together with what that vantage point could observe and who controls it. This document uses "producing boundary" throughout as its genus term for that vantage point.¶
A party whose conduct the claim describes or whose incentives are served by the claim being accepted; typically the operator of the acting system.¶
A party deciding whether to accept the claim.¶
The arrangement of which parties control which enforcement points, observation points, keys, and delivery paths relevant to a claim.¶
A property of deployment and control. A statement of independence names a component and its role: enforcement, observation, delivery, or evaluation. It can instead name a record or the grounds of a premise. It names a party or a coalition (parties acting together), a period, and a threat model. The named thing is independent of that party with respect to a capability if the party lacks that capability over it. Section 8.1 names three capabilities: forgery, concealment, and circumvention. Which of them matter depends on the claim. Independence describes control. Whether the evidence supports the claim is a separate question (Section 3). A label, a field value, a distinct key, an organizational name, or a count of components does not by itself establish independence.¶
The strength of an execution-related claim is bounded by:¶
what the available evidence actually observed, constitutes, or proves, at the boundary that produced it; and¶
the control and observation topology at that boundary: who operated it, who could bypass it, and through whose hands its output travels.¶
Message format, signature validity, receipt validity, and registration do not raise either bound. A format can carry a statement about control or observation, but it cannot create control or observation that did not exist. A signature authenticates bytes under a key. By itself it establishes neither the truth of what the bytes assert nor the signer's control of the boundary they describe. A receipt's evidential force depends on the property being checked, the observations or proofs that support it, and the applicable trust and deployment assumptions. Successful verification of a registration receipt can support that a statement was registered under the service's policy. Registration alone does not establish that the event described in the statement occurred.¶
These limits concern what follows from the stated evidence and premises. They do not preclude an inference from complementary observations whose relationships and load-bearing assumptions are established. Cryptographic verification can support those assumptions. It does not supply a missing observation by authenticating a statement about it.¶
Support does not have to come from direct observation of the claimed action. Section 9 describes the other routes and their premises.¶
In this document, evidence supports a claim when the claim follows from the evidence under the stated premises. One practical test checks this. Try to describe two cases in which the relying party holds the same evidence under the same premises, but the claim is true in one case and false in the other. If both cases are possible under those premises, the evidence does not support the claim as stated. Failing to find such a pair does not prove that none exists. Evidence that only makes a claim more likely does not support the claim in this sense, although it can still support a weaker claim (Section 11).¶
Execution-related artifacts answer different questions, and the differences are load-bearing. At minimum, the following bases are worth distinguishing:¶
Some event concerning the action was recorded or reported. Absence of a record alone is not an observation that an event did not occur.¶
A specific intention, plan, approval, or decision concerning the exact action is evidenced. This establishes neither the validity of the approval nor anything about performance.¶
The exact request crossed an observed invocation boundary. This does not establish that the invoked operation executed or had an effect.¶
Performance of the exact action was evidenced at a boundary in a position to observe execution. This does not establish completion of a larger process, a durable external effect, goal satisfaction, correctness, or policy compliance. Section 9 addresses claims about an effect, its persistence, and its finality.¶
The observation base asks only whether some event concerning the action was recorded or reported. Elsewhere in this document, an observation is an event seen at a boundary in a position to see it (Sections 3 and 9). Evidence at the observation base need not be an observation in that sense.¶
These bases are distinct questions about one action. They are not levels on one scale, and they need not be mutually exclusive. A conclusion from one base to another holds only under stated premises. Evidence relevant to one base does not, merely by being assigned to that base, satisfy the evidential criteria relied on for another. Distinctions of this kind, between stages of an action's lifecycle whose evidence does not carry across, are long established in distributed-systems practice (for example the separation of a remote procedure call's invocation from its execution and its result). One executable realization that binds exact predicates to these four bases appears in [I-D.sergeev-wexp-core]. This document does not depend on it.¶
Other distinctions cut across the bases. Verification reach (who can check a record) is orthogonal to claim strength: a third-party-verifiable invocation record is still invocation evidence. And asserted content differs from observed content: a mediator's record may faithfully report what the mediator asserts about a downstream outcome it never observed. A useful record says at which boundary it was produced and whether each statement in it was observed there or merely asserted there.¶
The action referred to by a claim should be identified at the relevant boundary. A business intention, an authorization, a request attempt, an execution, and a durable effect need not have a one-to-one relation. Retries, proxies, and idempotent processing can change those relations. A composite claim depends on evidence establishing the particular bindings it uses. This document prescribes no common identifier format.¶
In this document, a kind of claim is a family of claims to which the same type of evidence is relevant, such as the bases of Section 4. For a stated kind of claim, and under stated premises, a producing boundary limits the claims its evidence can support. Call that limit its claim ceiling. The term does not presume that all claims of one kind are comparable, or that one uniquely strongest claim exists.¶
A boundary in a position to observe invocations, but not execution, cannot by its observations warrant execution claims. That holds no matter how many well-formed execution assertions its records carry.¶
The underlying idea is old and this document claims no priority for it: a conclusion cannot be stronger than the vantage from which its supporting evidence was produced. Section 13 describes prior formulations.¶
A claim ceiling is an exclusion rule, not an evidence source. It can prevent a stronger claim from being supported, but it never creates support, so a supported claim still requires positive evidence at its own base.¶
A ceiling is also only as good as the grounding of the boundary description itself. A boundary descriptor asserted by the producer is only the producer's own account. Section 8.1 describes what grounds a statement about who controls a boundary.¶
The accepted boundary description must apply to the time and deployment context of the claimed action. A later assessment or a current configuration does not, by itself, establish the earlier boundary's properties.¶
The same applies to any premise that would make the producer's records informative without observation. Where a claim rests on the producer's incentives or objectives being known, that knowledge is itself a premise requiring its own grounding. An alignment asserted by the producer is only the producer's own account.¶
This document defines independence in terms of control. Payment, contract, or ownership can give one party the means to direct another party's output or decision. They count here to the extent that they give that capability.¶
A record that requires no later cooperation from the party whose conduct is at issue is not, for that reason, independent of that party. A record it made at the time and left in place needs nothing from it afterwards and remains its own account of itself. The distinction between independence from cooperation and independence of the evidence itself follows an exchange with Douglas Wadkins; see [I-D.wadkins-agentproto-action-determinability].¶
A claim ceiling is relative. It is stated for one kind of claim, at one observation boundary, with the support relation proper to that kind: which evidence supports which claim of that kind. Examples are the bases of Section 4 and, separately, the prevention claims and the detection claims of Section 8.¶
Claims of different kinds are not ranked against one another by a ceiling. An execution claim and a detection claim are different kinds of claim, not points on one scale, and this document defines no scalar scale, level, or score on which all claims are ordered. "Stronger" and "weaker" in this document are always read within the kind of claim at issue.¶
The following rules restate Section 3 as individual limits. Each names an inference that is invalid without additional, separately established premises. None is original here; scoped versions of several appear in the documents cited in Section 13.¶
Each rule is justified analytically. An example or a standards reference given with a rule is an illustration, and it is not presented as a documented incident. Claims about practical occurrence or consequences require their own support.¶
The list is not closed. A reader who finds a promotion these rules do not name has found a gap in this section, not a license for the promotion.¶
Successful signature verification does not by itself establish the truth of an event claim in the signed content. Establishing that correspondence requires grounds beyond signature validity. Separately, signature validity alone does not establish the signer's control of the boundary described by the claim. The same distinction is drawn for verifiable credentials, where verifiability of a credential does not imply the truth of the claims encoded in it [VC-DATA-MODEL], and for signed Decentralized Identifier (DID) documents, where proofs in the document do not by themselves necessarily prove control over the DID [DID-CORE].¶
Attribution of an actor is not proof of actorship. That a record is attributed to a party -- by a key, an identifier, or a credential associated with that party -- does not establish that the party performed the action, where another party can obtain, invoke, or emulate the attributed capability. Where one party creates or hosts another and can reach that other's signing or authenticating capability, an action attributed to the hosted party may have been performed by the host. Where a record reaches the relying party through intermediaries, attribution established at one step of that path does not carry to the next without that step's own basis. A transport can establish which component delivered a record. A source that the deliverer names inside the record is the deliverer's assertion, unless the record carries its own verifiable binding to that source.¶
A receipt, record, or registration is not external execution or effect. Registration establishes that a statement entered a log or service under that service's policy. Matching records held by different parties establish that their contents agree (correspondence), not that the parties agree. Correspondence does not establish which event preceded which (precedence), and it does not establish occurrence.¶
Presence of records is not completeness of coverage. A set of records, each individually authentic, does not establish that the set is all the records there are. Detecting omission requires more than the authenticity of each record: an independently grounded expectation of the complete population, which the set itself may carry, or a recording boundary that cannot be bypassed.¶
Absence of a record is not non-occurrence, unless the observation regime supports that inference. The inference from "no record" to "no event" is valid only where a declared, enforced recording boundary meets three conditions. It covers the event class. It cannot be bypassed by the parties in question. And gaps in the record stream are themselves detectable, for example against a pre-declared cadence or sequence carried in the records and watched by a party outside the producer. Otherwise absence is only absence.¶
Such an inference also requires an identified interval, evidence that the required recording and delivery coverage held for that interval, and resolution of relevant delays and gaps. Detectability of a gap does not license a non-occurrence claim while the gap remains unresolved. The conclusion is limited to the specified event class, population, and interval under the stated assumptions.¶
Bypass of the recording boundary is not the only way a record can fail to appear. A record may have been made and then withheld, whether by a retention policy that removed it or by a disclosure decision that did not produce it [AP-SCHROCK-RETENTION]. Where either is possible, the result is a statement about the evidence set examined and not about the recording boundary, and the conditions above are not met by the boundary alone.¶
Authority granted is not action performed. Authorization evidence, however exact, single-use, and attenuated, bounds what a grant permits at the point where it is enforced. It does not establish that the authorized action occurred. What is missing is evidence on the action's own basis: an observation of invocation or of execution, at a boundary in a position to make it, or a record that constitutes the action rather than describing it (Section 4 and Section 9).¶
Internal observation is not independent observation of an external effect. An observation made inside the acting party's boundary can establish, at most, what that boundary observed, and a record's statements about effects at other systems are assertions. In particular, a record minted by the deciding or authorizing side cannot by itself establish the order of its own decision against an effect that side does not observe. Other evidence carried in the same record is appraised under the routes and premises of Section 9, regardless of its source.¶
Time and sequence evidence is bounded by the observation and control properties of its source, like any other evidence. A timestamp or sequence number is only as strong as the party and mechanism that produced it: one minted by the interested party over its own record orders that record, not the world. This is not a claim that time evidence is worthless. Trusted time-stamping has a distinct and stronger evidentiary role: a time-stamp token from an appropriately trusted authority is evidence that a datum existed before a particular time [RFC3161]. And a sequencing mechanism whose observational domain covers both of two events can order them. The rule is that the strength of the time or sequence claim follows the source, and must not be read past what that source observed and controlled.¶
A missing or unverifiable load-bearing premise cannot be silently promoted. Where support for a claim depends on a premise that was not evaluated, or that only the interested party can vouch for, the claim inherits that limitation. The report names the claims that are supported, and keeps the status of each premise that was not evaluated. A conditional claim states the premise it depends on (Section 11).¶
Current authentication, when its verified scope is limited to a present binding, does not by itself establish identity continuity or succession relative to an earlier subject. Identity continuity, succession, and the present applicability of prior authorization, standing, or reputation are distinct claims. Each requires grounds covering the specific relation or applicability asserted under the relevant identity and authorization rules. A record's evidentiary force depends on those rules and its verified properties, not merely on its statement of the claim. DID Core states the corresponding limit for persistent identifiers: absent published operational policies, requesting parties are not expected to assume that an identifier is persistent for the same subject [DID-CORE].¶
Behavior observed under one set of conditions does not establish the same behavior under other conditions without grounds for carrying the conclusion across. A test, an audit, or a monitored run observes a system under the conditions it applies. The result describes those conditions. Carrying it to other conditions needs grounds that the two do not differ in anything the behavior depends on. Where the system can detect that it is being tested or observed, results obtained under those conditions do not by themselves supply such grounds, since the system can make its behavior depend on them. Appendix B reads the emissions case this way.¶
Multiplicity is not independence. A number of records, keys, services, or organizational names does not by itself establish independent support. Where one party has a capability that matters to the claim over several of them, their number adds nothing against that party (Section 8.1). Independence is judged claim by claim, for the components on whose correctness the support for that claim relies.¶
Coherence is not corroboration. The detail, internal consistency, plausibility, or fluency of an account produced by the interested party does not by itself support the claim that what it describes occurred. A fabricated account can have all of these properties, so they do not distinguish a true claim from a false one (the test of Section 3). This holds with particular force for accounts generated by software, including language models, whose output can be fluent whether or not it matches the events it describes. Support needs grounds beyond these qualities, and evidence carried with the account can provide them by one of the routes of Section 9.¶
Every rule here is stated against premises. The premises a conclusion rests on, their grounds, and their status should be available directly or by unambiguous reference. A premise accepted as a matter of policy is not thereby independently established. Where the premises change, whether the conclusion remains warranted has to be checked rather than assumed.¶
Aggregation, transformation, summarization, and re-signing remove none of these limitations. A pipeline that normalizes, merges, or re-encodes evidence inherits each relevant limitation of its inputs unless a specific limitation is specifically resolved by additional evidence. An unsupported widening of a claim at the output of such a pipeline is a defect to locate, not a result to report.¶
The rules above can be applied as a short checklist when reviewing a specification, a deployment, or an evidence design. For a given claim, ask:¶
Exact claim. What exact claim, about what exact action, is being made?¶
Producing boundary. Which boundary produced the supporting evidence, and what could that boundary observe?¶
Control. Who controls that boundary? Can the interested party or coalition forge its output, conceal it, or circumvent it (Section 8.1)? Which of these capabilities matter to the claim being made? Did the limits on them hold for the period the claim depends on? What grounds those limits?¶
Ceiling. For the kind of claim at issue, what claim or claims can that boundary warrant? Does the asserted claim exceed them?¶
Positive evidence. Is there positive evidence at the claim's own base? A ceiling supplies no evidence, and a signature or a registration supports only the predicate that its verification establishes.¶
Prevention, detection coverage, or a particular finding. If the claim is that misbehavior is prevented, which independently controlled enforcement point does it rest on (Section 8)? If the claim is that misbehavior of a specified class cannot be concealed, which independently controlled observation and delivery dependencies does that coverage rest on? For a claim that a particular event was detected, which evaluation act (evaluator, predicate, evidence basis, window or context) is identified?¶
Basis for a claimed effect. Which route of Section 9 supports the claim? The routes described there include observation at a boundary outside the interested party's control, a record that constitutes the action, and evidence whose verification establishes a predicate. Where the support rests on another basis, is that basis stated? What limits its scope?¶
Completeness and absence. Does the claim depend on the record set being complete, or on an absence meaning non-occurrence? Is that supported (rules 4 and 5)? What interval and delivery horizon were evaluated, and were relevant gaps resolved?¶
Pipeline widening. Does any step between production and reliance widen the claim beyond what the producing boundary supported?¶
Reporting. Does the report separate whether each evaluation was made from what it found (Section 11)? Does it name the supported claims, and the reason for any evaluation that was not made? Is anything silently rounded up?¶
The considerations sections of [RFC3552] (security) and [RFC6973] (privacy) are the models for this genre: a document states, in its own terms, what its mechanisms do and do not establish, and what residual exposure remains. This lens applies the same documentation discipline to the semantic strength of execution-related claims. It is a review aid, not a conformance procedure.¶
Claims that an architecture prevents or detects misbehavior are execution-related claims about the architecture itself, and they are bounded the same way. Farrell's (a,b,c) scenario, described in Appendix A, motivates the control-topology test used here. Stated mechanism-neutrally:¶
A claim that party B is prevented from performing or forging an action requires an enforcement point that B does not control and cannot bypass, positioned so that the action cannot complete without it. A component outside B's control that is not actually required for the action prevents nothing.¶
A claim that misbehavior in a specified class cannot be concealed by B requires the following.¶
adequate to distinguish that misbehavior under the stated assumptions.¶
delivery or omission controls that prevent B from hiding it without an observable indication.¶
The claim should state its coverage, timing, and failure limits. These coverage conditions are distinct from establishing that a particular event was detected from evidence already obtained.¶
The prevention and coverage properties above depend on independence in the sense of Section 8.1. The components concerned are the enforcement point, the observation point, and the delivery path. The party concerned is the stated party or coalition.¶
An architecture claiming prevention or adversary-resistant detection coverage should state:¶
which independently controlled enforcement or observation dependencies the guarantee rests on;¶
what the relevant limits on forgery, concealment, and circumvention are (Section 8.1);¶
what happens when a dependency is unavailable or cannot be validated.¶
Without those dependencies, that guarantee is not established against adversarial B, whatever its message formats carry. This does not invalidate a narrower finding supported by evidence that has actually been received and evaluated.¶
A protected observation path is not, by itself, sufficient for detection. The evidence must support a check that distinguishes the specified misconduct under the stated assumptions. An observable gap can establish a loss of coverage without establishing which underlying event occurred.¶
A claim that a particular event was detected requires an identifiable evaluation act. The record should name which evaluator evaluated, which predicate was checked and with what result, and on what evidence basis. Where a window or context applies, it should name that too.¶
Such a finding does not, by itself, establish that all events of that class were detectable or detected. A path that could have revealed an event does not show that anyone looked. This document defines no format for stating those items.¶
Existing mechanisms slot into this test rather than exempting themselves from it. Remote attestation [RFC9334] contributes where all of the following hold:¶
the Evidence covers the property at issue;¶
the adversarial party can neither forge nor substitute the Evidence or the Attestation Result, nor control the Verifier, its Appraisal Policy for Evidence, or the Endorsements and Reference Values it relies on;¶
the result is freshly and securely bound to the relevant actor and action.¶
RFC 9334 permits its roles to be aggregated into one entity, so independence from a given party is a property of the deployment, not of the architecture.¶
Threshold signing [RFC9591] contributes a prevention dependency exactly where the adversarial party or coalition cannot reach the threshold without an independently controlled signer that checks the exact operation and can withhold its share. These mechanisms contribute only to the properties and dependencies actually established by their deployment.¶
OAuth sender-constraining mechanisms such as Demonstrating Proof of Possession (DPoP) [RFC9449] can limit the use of stolen tokens. They do not by themselves prevent B from invoking a key through a signing interface B controls. That holds whether the key was provisioned by another party or stored as non-exportable (Section 11.4 of [RFC9449]).¶
An isolated execution environment, including a trusted execution environment (TEE), can contribute an enforcement dependency where B cannot modify or bypass the relevant checks. Claims about effects outside that environment still require an appropriate evidence basis.¶
The Workload Identity in a Multi System Environment (WIMSE) architecture [I-D.ietf-wimse-arch] separates workload authentication from authorization and permits different placements of policy enforcement. The test therefore asks who controls the deployed enforcement point and which operations it covers, rather than treating workload identity or credential provisioning as evidence that the claimed operation occurred.¶
The independently controlled point need not be cryptographic. A preserving repository may be audited and certified against a published standard [ISO16363], by a body the repository does not control and which is itself accredited under a separate regime [CCSDS652-1]. That contributes a detection dependency if the audit observes the practice at issue and if any suppression of an adverse finding by the audited party would become visible.¶
That contribution is limited by the audit's scope, period, sampling, access, and reporting arrangements. Certification alone does not establish complete observation of all relevant conduct, nor the visibility of every suppressed adverse finding. The recursion terminates in an accreditation body that some party must be prepared to treat as terminal.¶
The test is indifferent to whether the point outside the party in question is a key, a verifier, or an accreditation regime. It asks only whether the deployment placed one there, and what that point actually covers.¶
A statement of independence says which capabilities of the party matter to the claim at issue. It says what grounds the limit on each of them. This document does not say which grounds suffice to establish that such a limit holds.¶
The capabilities in question are these.¶
The party can make a relying party accept false evidence. One way is to fabricate the evidence, substitute or replay it, or alter it without detection. Another is to direct the component that produces the evidence, so that its output is false.¶
The party can act outside the recording boundary, so that the activity is not recorded there. It can also suppress, withhold, or delay evidence that exists.¶
The party can complete the action without the enforcement point, or direct the decision of that point.¶
Where this document says "bypass", bypassing an enforcement point is circumvention and bypassing a recording boundary is concealment.¶
A claim needs limits only on the capabilities that matter to it. A capability matters to a claim if the party could use it to leave the relying party holding the same evidence while the claim is false. That is the test of Section 3, applied to what the party can do. Take a particular finding made from evidence already received. Forgery matters to it, and so does the binding of the evidence to the exact action (Section 9). A payment network's record of transfer T can support that T occurred. This holds although the operator could have withheld the record or made other transfers elsewhere. Concealment matters to completeness and to detection coverage (rules 4 and 5). The same record does not support that these are all of the operator's transfers. Concealment can also matter to a particular finding, where omitted evidence would change the finding. Circumvention matters to prevention. The limits have to hold for the period the claim depends on. A present assessment does not by itself establish that the limits held earlier.¶
Independence does not make an observation relevant to the claim. An observer outside the operator's control that saw a command sent has not thereby seen it executed. A separate question remains: can the observation distinguish a true claim from a false one (Section 3)?¶
A dependency can enter where evidence is formed, where it is delivered, and where it is evaluated. An independent evaluator can verify the interested party's own account, but the account does not become an independent observation. Control over delivery gives the capability to conceal, and it can also permit substitution or replay, but it does not give control over the source. An independent component does not make a record presented as its output authentic: the operator can present a forged confirmation from an independent payment network. The relying party therefore checks origin, binding to the exact action, and any required freshness separately (Section 9).¶
Two sources that take a fact from the same origin both depend on that origin for that fact. Two logs that each copy the operator's message are not two observations of execution (rule 3). Where one party has the relevant capability over several components, those components do not count separately against that party. Three services that act, record, and check, run by one operator who can change their code or their records, divide the work but not the control. The useful question is which error or fabrication the second source rules out. Independence from one party does not establish independence from a coalition that includes it.¶
A statement of independence is itself a claim, with a producing boundary and a ceiling. Its grounds can stop at a premise that a party accepts as a matter of policy. A claim that relies on the statement then stays conditional on that premise. The premise travels with that claim when it is passed on (Sections 6 and 11). The audit example in Section 8 shows one such premise. Section 9 describes evidence whose source need not be independent.¶
The discipline does not only rule claims out. Stronger claims about a particular effect become supportable when the effect is observed at a boundary capable of observing it. That capability is judged under the stated threat and control model. The evidence of that observation must also be protected against undetected fabrication or alteration by the interested party. Coverage claims additionally depend on the observation and delivery conditions described in Section 8.¶
An external footprint is one important route to such observation. Examples are movement on a payment rail, and resource or configuration records in an external provider's control plane. In each, a system the interested party does not control observed something at its own boundary, and a relying party can check that system's records against the claim.¶
It is not the only route. The observing boundary may be any of several things:¶
an external service, a counterparty, or a settlement system;¶
an external control plane;¶
the relying party's own observation boundary, where the relying party itself observes the effect: a state change in a system it operates, or a delivery it takes receipt of itself;¶
another point that is in a position to observe the relevant fact and that the interested party does not control under the stated threat model.¶
A distinct third party is not always necessary. The relying party's own observation may provide the required evidence, subject to the same claim-specific trust and deployment assumptions.¶
A further route relies on a record constituting the precise action claimed, rather than describing a separate action:¶
a signed order that is the order;¶
a recorded state transition on a ledger that is the transfer;¶
a recorded command whose issuance is itself the claimed action;¶
a write-ahead entry that defines the commit.¶
Such a record supports that precise claim, because issuing or accepting it constitutes the action under the applicable rules. The evidence must establish the conditions that give the record that constitutive effect, including any applicable authority, acceptance, and commit or finality conditions. A record on a branch that was never accepted does not constitute the action merely by resembling one that would.¶
What it supports is bounded by the action it constitutes and extends no further. A ledger entry that is the transfer establishes the transfer, not that goods moved. A signed order that is the order establishes the order, not that it was carried out. Where a record describes an action it does not constitute, this route does not apply.¶
Another route relies on evidence whose verification itself establishes a predicate. Examples are a proof of computation, a proof of possession, and a response to a fresh challenge. The source of such evidence does not need to be independent of the interested party. Successful verification establishes the proved predicate, under the premises of the verification. Those premises include the soundness of the proof system, the integrity of the verifier, and that the statement verified is the one the claim names. Where soundness bounds the probability of a false acceptance rather than excluding it, treating it as exact is an idealization, and a report that relies on it should say so. A claim that does not follow from that predicate needs its own evidentiary grounds and the bindings it requires. For a proof of computation, such claims can concern whether the committed inputs match the facts they stand for. They can concern who performed the computation, when a policy was applied, or whether an external effect followed. Signature verification is the familiar case: the proved predicate is that the bytes were signed under the key, and rule 1 applies to anything beyond it.¶
The qualifications below travel with these routes:¶
The observing boundary supports claims at its own observation boundary and no further. A payment network's record establishes what the network observed about a transfer at its boundary, not that a business obligation was satisfied. A relying party's own observation establishes what the relying party observed at its boundary, and no more.¶
The observation, whether an external footprint or the relying party's own, must be bound to the exact action claimed. A matching amount, timestamp, or counterparty is correlation, and correlation supports weaker claims than a validated binding.¶
The protection afforded by the observing boundary is itself a threat-model statement. For a particular finding, the relevant protection is against the operator of the acting system fabricating or undetectably altering the evidence for the claimed observation. Against the operator of the observing boundary itself, the route gives no additional support. Where the relying party observes at its own boundary, the claim rests on the relying party's own observation, which is independent of the interested party but not of the relying party.¶
An effect is observed at a time. The observation does not, by itself, establish that the effect persisted or is final. A transfer can be reversed, a write can be rolled back, and a ledger branch can be abandoned. A claim of a durable or final effect needs evidence of the conditions that make it so. The rules of the system where the effect occurs set those conditions. That evidence needs one of the routes of this section.¶
Ordering claims, such as that the decision preceded the effect, require an ordering relation whose observational domain includes both terms. That means one boundary that observed both, or records from the two boundaries that can be securely related and ordered. Matching records alone establish neither the order of the records nor the order of the events.¶
The capability to conceal does not, by itself, invalidate evidence that has been received (Section 8.1). Subject to the qualifications above, the received evidence may support a particular finding within its observational and temporal scope. A finding that depends on the completeness of a specified evidence set, or on absence as evidence of non-occurrence, requires the corresponding coverage and gap-resolution basis (rules 4 and 5).¶
Consider an agent that reports having paid a supplier. Three evidence artifacts and a report combining them are on the table. The point of the example is that they support different claims, and that a report must keep separate what each boundary observed from what it merely asserts.¶
A self-produced execution record. The operator's own service emits a signed record: "paid supplier S, amount X, at time T". Observed at that boundary: that the operator's service produced and signed this statement. Asserted, not observed there: that the payment reached S. What it supports on its own: that the operator stated a payment; not that the payment occurred (rules 1, 3, 7).¶
This example assumes that the record contains only the operator's own statement. If it carries independently verifiable evidence from another source, that evidence is appraised at its own producing boundary. The party assembling the container does not determine every item's origin.¶
A transparency registration. The signed record is registered with a transparency service, which returns a receipt carrying an inclusion proof. Observed: that this statement was registered under the service's policy. Any claim about registration time depends on the time evidence provided and its verified scope. What it does not establish: the truth of the statement or the occurrence of the payment (rule 3). Registration raises auditability, not the claim ceiling.¶
External payment-network evidence. A record from the payment network -- a settlement entry or network-issued confirmation -- that the network observed a transfer matching the action. Observed at a boundary outside the operator's control: that the network saw a transfer with these attributes. This is the footprint of Section 9, and it must be bound to the exact action: a bare amount-and-time match is only correlation. Its strength holds against the operator, not against the payment network's own operator.¶
A composite report. A report that draws on all three should read, in substance, as three statements. The operator asserts a payment (1). The assertion is registered and independently checkable as an assertion (2). And where (3) is present and bound to the exact action, a system outside the operator observed a matching transfer at its boundary. That last supports a payment-reached-the-network claim, to the extent the binding holds and that evidence is protected against fabrication or undetected alteration by the operator. With only artifacts (1) and (2), the supportable claim is that the operator stated and registered a payment, not that a payment occurred.¶
A report over these artifacts could read as follows. Evaluator V checked the origin of each artifact and the binding of the network record to the payment. V accepts one named premise: the network's record is reliable for the event it reports. Assume that the record reports that a transfer was seen, and says nothing about finality. V did not assess whether the set covers all of the operator's payments.¶
A statement of the payment was signed under the operator's key. Evaluated. Supported: the signature verifies.¶
The statement was registered. Evaluated. Supported: the receipt verifies, within its scope.¶
The network observed a transfer bound to this payment. Evaluated. Supported: origin and binding were checked, under the named premise.¶
The payment to S is final. Evaluated. Unsupported by this set: the evidence evaluated does not establish the conditions for finality (Section 9).¶
These are all of the operator's payments in the period. Not evaluated: completeness was not assessed (rule 4).¶
Suppose instead that only the amount and the time match, and the binding is not established. The third entry is then unsupported for this payment. That the network saw some transfer remains supported.¶
The example makes no universal assertion about what any particular service observes. What a given payment service, transparency service, or agent runtime actually observed is a fact about that deployment, to be stated from its evidence, not assumed from its role.¶
Where evidence does not support the claim asserted over it, the useful output is not a bare failure. For each claim, a report says whether the evaluation was made and, if it was, what it found. These are separate questions. An outcome-binding profile drew a related line earlier: its indeterminate state, used when required evidence is missing, unauthenticated, unpinned, or not exactly bound, is not a comparison outcome [I-D.schrock-ep-outcome-binding].¶
Whether the evaluation was made:¶
The relevant assessment ran over identified evidence, in an identified appraisal context.¶
The assessment did not run, the identified evidence could not be obtained, or the premise was outside the evaluation's scope. This status supplies no finding for or against the claim. It does not mean the claim is false, and it does not determine what the available evidence would support if evaluated. Nor is it permission to discard evidence that positively supports a claim at its own base. A claim well supported at its own base stays supported, even while another claim is not evaluated. It is also not a reason to repeat an action whose outcome is unknown, since the first attempt may have completed. That profile states the same limit for its indeterminate state [I-D.schrock-ep-outcome-binding].¶
A reason for "not evaluated" that belongs to the evaluator. The statement is one that the evaluator in question cannot check from the evidence and inputs available to it at the time of evaluation. The standing example is a producer's description of its own deployment, which an evaluator may be unable to check without deployment access or other adequate evidence about that deployment. The category is relative to an evaluator and to an evidence or input set. Where they matter, it is relative to an evaluation context or time as well. A statement can pass from verifiable to unverifiable while the record itself is unchanged. The evaluator that could check it may cease to exist, or lose its access or the means to interpret what it holds. Such statements can still be worth carrying. The report names the reason and the premise that was not checked. Where a statement rests only on the producer's account, the report says so. A reader can then see which parts of a composite claim rest on trust. A report that fixes the category without fixing the evaluator and the moment says less than it appears to.¶
What the evaluation found:¶
The evidence evaluated supports the claim as stated, under the stated premises.¶
The assessment ran over the evidence evaluated, and that evidence failed it. This is a finding about the evaluated evidence, relative to the evidence set and the appraisal context in which it was evaluated. It is not a property of the world, and a different evidence set may support the claim. Where the assessment ran and the evidence evaluated lacks what the claim needs, the claim was evaluated and the finding is unsupported.¶
The evidence supports the negation of the claim. Absence of a record refutes a claim of occurrence only where rule 5 of Section 6 permits the inference from absence to non-occurrence. The report should state that finding and its basis explicitly, rather than treating it as mere absence of support.¶
One reporting practice applies to both questions:¶
Where the asserted claim is unsupported or not evaluated, report the strongest claim of the kind at issue that the evidence does support, or the supported claims where there is no unique strongest one, alongside the asserted claim, with its status and any finding. A claim supported at another base is a separate finding, not a downgrade; support at one base is not inferred from support at another (Section 4). "Invocation: supported. Execution: unsupported by the evidence evaluated" is actionable; "invalid" is not.¶
Collapsing "not evaluated" into "unsupported", or either into "refuted", destroys information a relying party needs: "we checked and it failed" and "we could not check" call for different decisions. These terms are not a result-code set. One report can say that a claim was not evaluated because a premise is unverifiable, and also identify a weaker claim that is supported.¶
A support assessment over the available evidence can complete while a required premise is not evaluated. The report identifies these assessments separately.¶
Each of these terms is relative to the evidence actually evaluated, and a report is more useful when it says what that evidence was. The evaluated set may itself be incomplete or selected. Every record in it can verify while records that would have changed the outcome were never delivered: rule 4 of Section 6, met again at the reporting layer.¶
A verdict applies to the evidence basis it names, and a verdict that names no basis invites exactly the widening this document is about.¶
Appraisal results travel. One evaluator's result may be consumed by a later composite report: that a claim was not evaluated, for instance. The later relying party then needs to distinguish an attributable appraisal from an unattributed conclusion.¶
Propagated or aggregated appraisal results should therefore retain enough provenance to identify:¶
who or what appraised;¶
the evidence or input basis, or a stable reference to it;¶
the predicate, profile, or evaluation context under which the result was reached, including the boundary at which the appraisal was made.¶
Without that, "not evaluated" degrades across aggregation into somebody's unattributed conclusion. That is the aggregation limit of Section 6 arriving at the reporting layer. Where evaluated evidence or received appraisals support incompatible findings, the report identifies the conflict and any premise used to resolve it.¶
This is a consideration for reporting designs. It is not a record format and not a general retention requirement. The provenance of an appraisal identifies who is reported to have appraised what, under which context. By itself it establishes neither that the appraisal ran as reported nor that the underlying event occurred.¶
A reporting design that preserves these distinctions makes inflation visible: every summary that would erase one of them is a place where a stronger claim would otherwise silently replace a weaker one.¶
Nothing in this discipline is stated in terms specific to AI agents. The same bounding questions apply to:¶
audit logging and monitoring pipelines, where the questions are what the log source observed and who can write to it;¶
compliance reporting and incident forensics;¶
operational telemetry, which is self-reported by instrumented code and designed for diagnosis rather than adjudication.¶
Agent systems sharpened the problem. Actions are initiated by software whose records are produced mostly at the acting side, and delegation chains multiply the boundaries across which claims travel and inflate. But the rules in Section 6 are stated as properties of evidence rather than of agents.¶
One domain is worked here: the long-term preservation of records, where no agent acts and no payment is made. A preserving repository holds a record deposited by its creator. Fixity evidence can support a claim that deposited bytes have not changed relative to an accepted baseline. Identity and provenance evidence may support an authenticity assessment under stated assumptions. Archival diplomatics drew this distinction earlier and for a different substrate. It separates a record's reliability at the point of creation, the accuracy of its content, and its authenticity [INTERPARES] [DURANTI1998]. Neither finding, by itself, establishes that the record was reliable when created or that its content was accurate. Preservation does not convert custody integrity into truth of the original content. That is an instance of the claim ceiling of Section 5.¶
A gap in a deposited series supports no conclusion about what was never deposited, unless the deposit regime was declared, enforced, and observable to a party outside the depositor (rule 5). Whether a preserved record can still be evaluated depends on the record, the available representation and provenance information, and the evaluator's knowledge and access. This illustrates the evaluator- and time-relative unverifiability of Section 11. The Open Archival Information System (OAIS) reference model addresses continued understandability for an identified Designated Community [ISO14721].¶
Appendix B gives three public findings that state the same bounds outside agent systems. Applicability to the other domains listed above is asserted on the same grounds and is not worked case by case here.¶
This document specifies no new protocol mechanisms. Its subject is the prevention of a class of security failures that occur at the semantic layer: relying parties accepting claims stronger than the evidence supports.¶
Cautions about the discipline itself, including its misuse:¶
The discipline does not make a dishonest or compromised evidence source honest. It bounds what a relying party should infer. It does not improve the evidence.¶
The discipline does not make an evaluator correct either. Every finding is conditional on the correctness of the evaluator and of the tools and inputs it relies on. That condition is a premise of every report, whether or not the report states it.¶
"Not evaluated" is not a license to discard evidence. A report that one claim was not evaluated, or is unsupported, is not a basis for setting aside evidence that positively supports another claim at its own base. The correct output is that supported claim, reported as such (Section 11).¶
Deliberately unobservable topology is a limitation to report, not an exoneration. An interested party may arrange that its enforcement or observation points cannot be checked by anyone else. The report then says which evaluation failed or could not be made (Section 11). Unobservability does not support the corresponding prevention or detection-coverage guarantee, and it is not evidence of good behavior. This does not extend to every case-level finding that received evidence may support.¶
Conformance vocabulary is itself inflatable. "Consistent with the claim-boundary discipline" is not a property a document or product can certify by assertion. The test is whether specific claims are bounded by specific producing boundaries, checked claim by claim.¶
Detection mechanisms can leak information. Making refusals, gaps, or suppression observable to an external party discloses timing and frequency information to that party. Deployments should weigh the observability required by Section 8 against what the observation channel itself reveals; RFC 6973 [RFC6973] gives the model for stating that residual exposure.¶
This document has no IANA actions.¶
In the agentproto mailing-list discussion of July 2026, in the thread on the draft minutes of the AGENTPROTO BoF, Stephen Farrell posed a gating scenario [AP-FARRELL-ABC]. In his words:¶
If (a,b,c) is a comms path between agents (perhaps within a tree) and if 'c' is actually a newly created entity, but one that needs access to a long-term secret credential accessible at 'a' (e.g. pwd or SSH private key) and where that credential must not be exposed to 'b' nor easily abused - then how's that going to work?¶
He emphasized that "the scenario I posited is one where 'b' creates 'c' and so is in a fine place to cheat" [AP-FARRELL-CHEAT].¶
The list discussion produced concrete mitigations, collected in a reply by Shawn Sammartano [AP-SAMMARTANO], who credited most of them to existing mechanisms:¶
exact, single-use, attenuated permission slips bound to request bytes;¶
hardware-protected keys, and threshold signing;¶
short-lived credentials, and forward-moving counters;¶
delegation budgets, and delays with cancellation windows;¶
approval separated from the creator. Sammartano also stated the hard case plainly: "If b builds c, then b can read c's key, so b can be c. No message format fixes that, mine included."¶
The author proposed an enforcement/observation framing in response to that discussion [AP-SERGEEV-GATE]. The control-topology test of Section 8 refines that framing by distinguishing adversary-resistant detection coverage from a particular finding made from evidence already obtained. Farrell posed the scenario. This document does not attribute the generalized test to him. Applied to the scenario:¶
Exact, single-use, attenuated authority bounds what the grant authorizes, where it is enforced. It does not establish that an action attributed to c was not performed by b, where b created or hosts c and can obtain or invoke c's signing capability (rules 2 and 6 of Section 6).¶
A message format can carry the relevant control or evidence. It cannot create the required independence (Sections 3 and 8.1).¶
A prevention claim at that boundary needs an enforcement point b does not control and cannot circumvent. A claim that covered misbehavior cannot be concealed needs evidence b cannot forge, on a path b cannot silently prune (Section 8). Attestation and threshold signing supply such points only in deployments that actually place them outside b's control.¶
What is missing in the hard case is not another field. It is a point outside b's control that either enforces or observes, and no message format creates one.¶
This is narrower than solving credential custody. It makes the assurance claim and its trust boundary reviewable before a mechanism is chosen, which is what a chartering or design review needs.¶
Three public findings state the same bounds outside agent systems, in the words of the bodies that made them.¶
In the English prosecutions arising from the Post Office Horizon accounting system, the Court of Appeal found that the prosecutor "treated what was no more than a shortfall shown by an unreliable accounting system as an incontrovertible loss", and that defendants were convicted "on the basis that the Horizon data must be correct, and cash must therefore be missing, when in fact there could be no confidence as to that foundation" [HAMILTON]. The load-bearing premise was the reliability of that system. The court recorded that the prosecutor was under a duty to investigate subpostmasters' claims that there were problems with it, and it found "failures of investigation and disclosure". On the reading taken here, that is the position rule 9 of Section 6 names. The claim rested on a premise the relying party was required to test and did not adequately test. The judgment does not address what a bounded report of the same evidence would have said, and it is not cited for that part of the rule.¶
In the inquiry into the Grenfell Tower fire, the panel examined the performance criteria applied in large-scale fire tests of external wall systems. Failure to meet those criteria would show a system unlikely to comply with the applicable requirement. But "the converse was not necessarily true": a system might meet the criteria and yet fail to comply with that requirement [GRENFELL2]. A bounded test result can tell against a claim in one direction without establishing it in the other.¶
In the third case the test results were genuine outputs of a genuine test. Vehicles were certified against emissions standards on the strength of those results [EPA-VW-NOV]. Software detected the test condition and enabled full emissions controls only then, so the vehicles "meet emissions standards in the laboratory or testing station, but during normal operation" emitted nitrogen oxides at levels up to forty times the standard [EPA-VW]. The result established the behavior of the vehicle under the conditions the test applied, which was all it had ever observed. The certificate carried it to a claim about the vehicle in use (rule 11 of Section 6).¶
These authorities reached findings within their own legal and regulatory settings. The findings are their own, and their connection to the rules stated here is this document's reading.¶
This appendix is to be removed before publication as an RFC.¶
Independence is defined once, as limits on three capabilities of a named party or coalition: forgery, concealment, and circumvention (Sections 2 and 8.1). The earlier definition treated them as one property. Section 5 no longer repeats the audit example, which stays in Section 8.¶
Section 3 says in which sense this document uses "support", adds a practical test of it, and points to the routes of Section 9. Its first bound and the abstract now name what evidence constitutes or proves, not only what it observed.¶
Section 4 no longer describes the bases as ordered. They are distinct questions about one action. It now points to Section 9 for claims about an effect, and it separates the observation base from an observation in the sense used elsewhere in the document.¶
Section 5 speaks of kinds of claim rather than claim dimensions.¶
Section 6 adds rules 11 to 13: behavior observed under different conditions, multiplicity of sources, and the coherence of an account produced by the interested party. Rules 1 to 10 keep their numbers. Rule 2 adds attribution along a delivery path. Rule 3 no longer reads matching records as agreement between the parties. Rule 4 limits itself to the authenticity of individual records, and rule 7 to the boundary's own observation. The last sentence of rule 9 now follows the reporting terms of Section 11. The preamble is shorter.¶
Section 7 revises four items: item 3 names the three capabilities, item 5 no longer says that a signature or registration supplies no evidence, item 7 asks which route of Section 9, or which other stated basis, supports a claimed effect, and item 10 follows Section 11.¶
Section 9 adds a route through evidence whose verification establishes a predicate. It adds a qualification on the time and finality of an observed effect, and it names as an idealization the treatment of probabilistic soundness as exact. The closing advice on deployment design is removed, because Section 1.1 puts evidence design out of scope.¶
Section 10 ends with a sample report.¶
Section 11 separates whether an evaluation was made from what it found, and notes the related line drawn earlier in [I-D.schrock-ep-outcome-binding]. The status that -00 called "not established" is now "not evaluated", because the rules use "establish" for the relation between evidence and a claim. Downgrading is now a reporting practice that applies to both questions, and a claim supported at another base is a separate finding, not a downgrade.¶
Sections 12 and 13 are shorter. The three public findings move to Appendix B; the Grenfell summary now follows the inquiry's wording, and the emissions summary also cites the Notice of Violation [EPA-VW-NOV]. The paragraph on archival preservation moves from Section 13 to Section 12. The discussion of Federal Rule of Civil Procedure 37(e) and the separate paragraph on the considerations-section genre are removed. Section 7 still names that genre.¶
Section 13 corrects the paraphrase of requirement DET-3: -00 omitted the qualifier that limits the cooperation clause to participants whose conduct or assertion is material. The paraphrase now follows the published wording of [I-D.wadkins-agentproto-action-determinability].¶
Section 13 now lists all five distinctions drawn in [I-D.abak-agent-control-delivery-evidence]; -00 omitted required-target resolution. It also cites sources for the reference-monitor and tamper-evident logging lineages [ANDERSON72] [SCHNEIER-KELSEY].¶
Section 14 narrows its opening sentence, and adds that every finding is conditional on the correctness of the evaluator. The item on unobservable topology now refers to Section 11 for the reporting terms.¶
The abstract no longer names the source of the scenario. Section 8, Appendix A, and the Acknowledgments do.¶
The scenario of Appendix A was posed by Stephen Farrell [AP-FARRELL-ABC]. The mitigation list and the plain statement of the key-custody limit were collected by Shawn Sammartano [AP-SAMMARTANO], who also confirmed the enforcement/observation framing used here [AP-SAMMARTANO-FRAMING]; Charles Eckel proposed that 'a' authorize 'c' to do something specific on 'a's behalf, rather than expose a long-term credential [AP-ECKEL]. Dapeng Liu proposed sender-constrained tokens (DPoP) so that 'b' could not present a token bound to 'c's key [AP-LIU-DPOP]; Section 8 discusses what they do and do not prevent. Yuning Jiang raised the continuity of an identity across restarts, instance changes, and key rotation, which is how the question behind rule 10 of Section 6 entered this work [AP-JIANG-CONTINUITY]. The distinction itself is older and is drawn in [DID-CORE]. Vladimir Ikher is the author's co-author on the earlier work [WITMODEL] from which the bases of Section 4 and the ceiling of Section 5 are restated here. This document also benefited from the broader agentproto and agent2agent mailing-list discussions of 2026 on evidence, delegation, and audit. The author thanks their participants without implying that any of them endorses this document.¶
Douglas Wadkins reviewed a pre-submission draft; the statement of scope in Section 1.1, the additions to Section 11, and the qualification in Section 12 are responses to his comments.¶
This document was drafted with substantial assistance from generative AI tools, working from the author's prior publications, specifications, and mailing-list correspondence, at the author's direction. It also incorporates material arising from adversarial review conducted with such tools: the wording of several rules, and the separation of analytical justification from documented practical confirmation stated in Section 6, were reached that way. In this version, the treatment of independence (Sections 2, 3, 8.1, and 9), rules 12 and 13 of Section 6, and the reporting terms of Section 11 were revised or added the same way. The author reviewed the resulting text and is responsible for its content, citations, and attributions. The use of large language models (LLMs) in IETF discussions is the subject of [I-D.fengfar-led], which explicitly excludes Internet-Draft and RFC text from its scope. This disclosure is voluntary.¶
The author also has an implementation interest in this area: the WEXP appraisal layer [I-D.sergeev-wexp-core] is the author's own work. This document is usable independently of it. No organizational independence between the two works is claimed.¶