Network Working Group D. O. Watts Internet-Draft GoodShyt Group Inc. Intended status: Experimental 21 October 2026 Expires: 24 April 2027 Continuity Evidence Records for Delegated Agent Systems draft-watts-agent-continuity-evidence-00 Abstract This document proposes an experimental, signed JSON statement and verification model for observing computational-agent continuity across sessions, instances and delegations. It distinguishes model, runtime, agent, grant and execution identifiers, retains predecessor evidence, and produces three-valued verification outcomes. Integrity of a record never implies permission to perform an action. This is not an OAuth token format or a claim of standardized identity ontology. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 24 April 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. Watts Expires 24 April 2027 [Page 1] Internet-Draft Agent Continuity Evidence October 2026 This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Goals and Explicit Non-Goals . . . . . . . . . . . . . . . . 3 3. BCP 14 Terminology . . . . . . . . . . . . . . . . . . . . . 3 4. Record Model . . . . . . . . . . . . . . . . . . . . . . . . 3 5. Statement Fields . . . . . . . . . . . . . . . . . . . . . . 4 6. Identity Separation and Binding . . . . . . . . . . . . . . . 4 7. Verification Algorithm . . . . . . . . . . . . . . . . . . . 5 8. Example Envelope (Illustrative) . . . . . . . . . . . . . . . 6 9. Replay and Key Rotation . . . . . . . . . . . . . . . . . . . 7 10. Conformance Test Vectors . . . . . . . . . . . . . . . . . . 7 11. Privacy Considerations . . . . . . . . . . . . . . . . . . . 8 12. Security Considerations . . . . . . . . . . . . . . . . . . . 8 13. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 14. Open Issues . . . . . . . . . . . . . . . . . . . . . . . . . 8 15. Normative References . . . . . . . . . . . . . . . . . . . . 8 16. Informative References . . . . . . . . . . . . . . . . . . . 9 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 9 1. Introduction Distributed agent workflows can retain the same model while changing runtime, memory, active policy or authorization. Conversely, legitimate execution can span different instances without discontinuity if delegation and restoration evidence are available. The identity of a model weight snapshot is not the identity of an individual process or an authorization grant. This Experimental proposal addresses a narrow interoperability gap: exchange of cryptographically checkable event assertions that let independent reviewers reconstruct a causal chain, distinguish missing evidence from false evidence, and avoid equating an authentic trace with an authorized act. Its conceptual lineage includes investigator-provided AID-1 test materials and five-axis CIF research; these materials do not establish a deployed protocol. It is separate from, and does not supersede, an earlier Watts draft on evidence qualification at authorization boundaries [WATTSEVID2026]. Watts Expires 24 April 2027 [Page 2] Internet-Draft Agent Continuity Evidence October 2026 2. Goals and Explicit Non-Goals Goals: stable representation of observation records; mandatory separation of model_id, agent_id, instance_id, execution_id and authority grant; support for parent execution and evidence linkage; a verification procedure that fails closed; and portable, synthetic conformance vectors. Non-goals: authenticating humans; granting OAuth scopes; defining a global agent identifier registry; inferring mental or clinical states; proving the correctness of an AI answer; guaranteeing complete witness visibility; requiring trusted hardware; or assigning universal risk weights. 3. BCP 14 Terminology The key words MUST, MUST NOT, REQUIRED, SHOULD, SHOULD NOT and MAY in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals. 4. Record Model An Evidence Envelope is a JSON object containing exactly the top- level members statement and proof. The statement MUST satisfy the profile in Section 4. The proof is a JSON object with fields type and value. The type value for this version is the literal string JWS-compact. The value is a JWS compact serialization whose payload is the canonical JSON bytes of statement encoded as specified by [RFC7515]. Both sender and verifier MUST canonicalize the statement using the JSON Canonicalization Scheme [RFC8785] and the I-JSON constraints. A verifier MUST compare the decoded JWS payload byte-for-byte with the canonical statement before trusting its signature, and MUST reject JOSE algorithm none, unapproved algorithms and untrusted keys. An unresolved or absent trusted key produces INDETERMINATE instead of VERIFIED. Record digests are computed as lowercase hex SHA-256 of the canonical UTF-8 statement bytes and expressed as sha256:<64 lowercase hex characters>. The digest is never computed over its own proof; the proof is excluded from the statement digest. Content addressing alone does not attest the producer. Watts Expires 24 April 2027 [Page 3] Internet-Draft Agent Continuity Evidence October 2026 5. Statement Fields The following fields are REQUIRED for all statements: version (literal 1); event_id (globally unique opaque string within the issuer context); event_type; observed_at (RFC 3339 UTC timestamp [RFC3339]); run_id; agent_id; instance_id; model_id; execution_id; authority (object); and predecessor_digest (string or JSON null). All identifiers are case-sensitive opaque strings; empty strings MUST be rejected. They MUST NOT be inferred from the content of a model response. The authority object MUST include issuer, grant_id, epoch and scope. Epoch is an integer zero or greater; scope is an array of strings (possibly empty); issuer and grant_id are nonempty identifiers. These values report asserted context and never constitute authorization by themselves. A real gate MUST separately obtain and verify the current authorization decision. event_type is one of: session-start, restoration, delegation, action- attempt, gate-decision, effect, policy-change, revocation, session- end. A producer MAY add an extension object containing additional namespace-qualified members. Extension values MUST NOT silently override or redefine required fields. No optional member may be an implicit authorization grant. For event types action-attempt, gate-decision or effect, the operation and resource fields MUST be nonempty strings. gate-decision requires decision with values allow or deny and the corresponding attempt_id. effect requires attempt_id and decision_id; an observed effect without these links MUST be classified as incomplete rather than assigned a fictitious admission. The predecessor_digest MUST be either JSON null for an explicit root record or the digest of a verified immediately prior statement in the same execution chain. A present pointer whose target cannot be obtained is missing evidence (INDETERMINATE) rather than proof of an invalid action. A pointer that resolves to a digest mismatch is INVALID. 6. Identity Separation and Binding model_id identifies an explicitly declared model artifact or version; agent_id identifies the logical accountable agent subject; instance_id identifies a particular runtime instantiation; execution_id identifies one execution lineage; run_id groups a task or trial; grant_id identifies an independently issued authority object. Identical values across these semantic roles do not make the roles identical. Watts Expires 24 April 2027 [Page 4] Internet-Draft Agent Continuity Evidence October 2026 A legitimate delegated handoff MUST record both the parent and child execution identifiers through a delegation event before the child emits consequential actions. A replica of the same model can be a new instance. Model continuity does not imply memory continuity, and either does not imply fresh authorization. Consumers MUST distinguish absent or null required identifiers from strings such as unknown. Provenance of the identifier assignment SHOULD be retained in the source record; a name chosen by the acting agent without independent binding is not equivalent to a verified identity. 7. Verification Algorithm A verifier implements three primary outcomes: VERIFIED when all required syntactic, signature, provenance-chain and binding checks succeed; INVALID for a proven schema, digest, signature, replay or identity-binding violation; and INDETERMINATE when required chain or key evidence is not available. VERIFIED never means authorized or true in a wider factual sense. The validator MUST reject duplicate JSON member names and non- canonical/unrepresentable JSON values, reject absent, null or empty required text fields, verify supported signatures against an independent trust policy, check event-type-specific fields, and resolve predecessor links where applicable. On malformed input, it MUST return INVALID rather than silently filling required fields. Consumers MUST use an independent current authorization decision when deciding whether an action may have external effects. A VERIFIED action-attempt statement containing a stale grant is valid historical evidence, not an acceptable permit. The evidence verification output SHOULD include both result and reason_code, such as missing_predecessor, expired_grant, invalid_signature or missing_trust_anchor; authorization-related reasons do not alter the evidence truth classification. An implementation MAY accept a valid root with predecessor_digest null; it MUST NOT infer that a missing predecessor is a root simply because the predecessor cannot be fetched. Event timestamps MUST be checked for gross clock anomalies under a declared skew policy, but wall-clock ordering alone is not a substitute for parent-link verification. 1. Parse as UTF-8 JSON and reject duplicates, non-I-JSON or unsupported version. Watts Expires 24 April 2027 [Page 5] Internet-Draft Agent Continuity Evidence October 2026 2. Verify all mandatory fields, enumerations and event-dependent link fields. 3. Canonicalize statement via RFC 8785, compute digest, compare decoded JWS payload bytes. 4. Verify JWS signature using a separately established trust anchor and algorithm policy. 5. Resolve the predecessor digest and execution links where required; distinguish unavailable from inconsistent evidence. 6. Emit VERIFIED, INVALID or INDETERMINATE with typed reasons; refer separately to current policy for the authorization decision. 8. Example Envelope (Illustrative) The following is an unsigned synthetic illustration of the statement structure. It is deliberately NOT a complete Evidence Envelope because no valid JWS proof is supplied. A conformant verifier MUST NOT report VERIFIED for this example without attaching and successfully validating a trusted proof. { "version": 1, "event_id": "evt-0001", "event_type": "action-attempt", "observed_at": "2026-10-11T12:00:00Z", "run_id": "run-demo-001", "agent_id": "agent-coordinator-a", "instance_id": "runtime-003", "model_id": "model-example-1", "execution_id": "exec-003", "authority": { "issuer": "https://auth.example.invalid", "grant_id": "grant-77", "epoch": 7, "scope": ["read:synthetic"] }, "predecessor_digest": null, "operation": "read", "resource": "urn:example:synthetic:input" } Figure 1: Unsigned synthetic statement Watts Expires 24 April 2027 [Page 6] Internet-Draft Agent Continuity Evidence October 2026 9. Replay and Key Rotation Receivers MUST implement a replay cache for event_id scoped to an authenticated emitter and run. Reuse of the same event_id with changed canonical content is INVALID. Reprocessing the exact same signed record MAY be idempotent for observation but MUST NOT be interpreted as permission for a second action. A valid old signature remains historically authentic after a grant expires, but grant expiration makes current admission contingent on a new gate decision. Trust-anchor removal and key compromise can affect whether evidence remains admissible; maintain time-qualified verification policy and record key rotation rather than rewriting old statements. For token-based calls, deployment MAY use sender-constraining mechanisms such as DPoP [RFC9449] or mutual TLS. DPoP demonstrates key possession; it is not by itself client authentication or authorization. 10. Conformance Test Vectors Conformance tests MUST separately exercise canonical JSON equivalence, altered payload rejection, duplicate member rejection, missing/null/empty required IDs, missing key, missing parent, mismatched parent, legitimate new-instance handoff, stale authentic grant, and replay with mutated content. The expected evidence classifications are: canonical equivalence with valid signature VERIFIED; altered payload INVALID; duplicate member INVALID; missing required field INVALID; unavailable trusted key INDETERMINATE; missing predecessor INDETERMINATE; predecessor mismatch INVALID; legitimate documented handoff VERIFIED; stale but authentic record VERIFIED as evidence while NOT AUTHORIZED for new effects; duplicate event_id and changed content INVALID. Test vectors MUST NOT depend on vendor-specific devices, one model provider, private customer transcripts or production credentials. No conformance test has been executed against an RFCXML-derived reference implementation in this document. Watts Expires 24 April 2027 [Page 7] Internet-Draft Agent Continuity Evidence October 2026 11. Privacy Considerations Model provenance, pseudonymous worker identity, timing and delegation graphs can reveal sensitive business processes or the association of humans with particular tasks. Do not place plaintext secrets, full human prompts, biometric data, clinical data or access tokens in event records. Apply role-specific minimization, retention limits and controlled witness export. Deletion requests can conflict with append-only evidence systems. Deployments should retain hashes of minimized or redacted data where authorized, explicitly record redaction, and avoid implying that a digest alone reconstructs erased content. 12. Security Considerations Threats include forged delegation, replay, ambiguous names, insider key compromise, split-brain identity, malicious clock skew, stale authority, poisoned provenance and transcript tampering. Trusted keys, chains and namespaces must be bound outside untrusted language- model output. A malicious agent can sign false descriptions of its own activity. Independent observations of actual external effects are necessary for safety-critical claims. VERIFIED indicates evidence-envelope integrity and linked context, not epistemic truth, safe behavior or right to execute. Do not treat the availability of a trace SDK as a security guarantee. In particular, proof of possession is not delegated authority, and a key change or process restart does not automatically invalidate a legitimate execution. 13. IANA Considerations This document requests no media type, algorithm, registry, endpoint or HTTP header allocation. The JSON structure is an experimental profile intended for discussion; no public protocol-name ownership is asserted. 14. Open Issues Open areas for community review include a globally interoperable identifier namespace, portable statement key discovery, canonical chain branching semantics, signed redaction and multi-witness disagreement. None is claimed as resolved by the present version. 15. Normative References Watts Expires 24 April 2027 [Page 8] Internet-Draft Agent Continuity Evidence October 2026 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", 1997, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", 2017, . [RFC8259] Bray, T., "The JavaScript Object Notation (JSON) Data Interchange Format", 2017, . [RFC3339] Klyne, G., "Date and Time on the Internet: Timestamps", 2002, . [RFC8785] Rundgren, A., "JSON Canonicalization Scheme (JCS)", 2020, . [RFC7515] Jones, M., "JSON Web Signature (JWS)", 2015, . 16. Informative References [RFC9449] Fett, D., "OAuth 2.0 Demonstrating Proof of Possession (DPoP)", 2023, . [RFC8725] Sheffer, Y., "JSON Web Token Best Current Practices", 2020, . [HU2026] Hu, B. A., "Dissociative Identity: Language Model Agents Lack Grounding for Reputation Mechanisms", 2026, . [AGENTSDK] OpenAI, "OpenAI Agents SDK: Handoffs, Sessions and Tracing", 2026, . [WATTSEVID2026] Watts, D. O., "Evidence-Bounded Authorization for Agentic Systems: Evidence Qualification Receipts", 2026, . Author's Address Deonté O’dell Watts GoodShyt Group Inc. Email: deonte@goodshyt.fun Watts Expires 24 April 2027 [Page 9] Internet-Draft Agent Continuity Evidence October 2026 URI: https://orcid.org/0009-0005-8586-3650 Watts Expires 24 April 2027 [Page 10]