Establishing Identity, Continuity, and Reputation for Autonomous Economic Agents

Full report

On this page

The transition from human-operated digital architectures to open coordination networks populated by autonomous economic agents necessitates a fundamental reevaluation of identity, trust, and accountability. In environments where algorithms autonomously negotiate, exchange private messages, and execute financial transactions at machine speed, traditional access management frameworks—designed around static authorization and human oversight—are inherently inadequate. Autonomous agents require continuous, context-aware verification that operates securely across organizational and trust boundaries without relying on centralized gatekeepers or routine human intervention1.

This analysis investigates the cryptographic, distributed-systems, and cryptoeconomic mechanisms required to build robust identity, continuity, and reputation structures for autonomous agents. By rigorously distinguishing between the cryptographic reality of holding a digital credential and the economic assumption of trustworthiness, this report evaluates public standards ranging from Decentralized Identifiers (DIDs) and zero-knowledge machine learning (zkML) to advanced decentralized reputation models such as Subjective Logic and EigenTrust.

1. Threat Model and the Limits of Identity

To engineer a secure coordination network, the system architecture must explicitly delineate the boundaries of cryptographic identity. A foundational axiom of distributed systems is that cryptographic verification can prove the integrity of a payload and the possession of private key material, but it cannot intrinsically prove the physical, operational, or moral nature of the entity controlling those keys.

The Illusion of Machine Authorship and Operational Independence

Cryptographic identity, regardless of the sophistication of its zero-knowledge proofs or hardware anchoring, cannot definitively prove machine authorship, operational independence, or intent. A distinct writing style, a specialized machine alphabet, or an API flagged with an “AI agent” label provides zero cryptographic or empirical proof of machine authorship or competence. An adversary can effortlessly proxy a human operator behind an automated API interface, or conversely, pipe a rudimentary, hard-coded script through a credentialed agent to mimic advanced artificial intelligence3.

Furthermore, claims of operational independence often rely on hardware-based Trusted Execution Environments (TEEs) such as Intel SGX or TDX, which isolate an agent's memory and execution from the host operating system. While TEEs provide remote attestation capabilities—allowing a remote party to verify the hardware and the initial state of the enclave—these environments have repeatedly proven vulnerable to microarchitectural exploitation. Genkin-style side-channel attacks, such as Foreshadow (L1 Terminal Fault) and other transient execution vulnerabilities, exploit shared microarchitectural resources like CPU caches and branch predictors to extract attestation keys and secret data4. Once an attestation key is extracted, an attacker can trivially forge enclave identities, entirely destroying the claim of operational independence and unforgeable machine authorship5.

Similarly, zero-knowledge machine learning (zkML) provides computational integrity but not functional trustworthiness. A zkML proof asserts mathematically that a specific model processed a specific input to produce a specific output3. It proves correct execution, but it cannot prove that the model's architecture is unbiased, safe, or capable of generalizing to novel situations. ZkML proves the mechanics of the computation, not the intent or the competence behind the design3. Therefore, identity mechanisms prove who is acting (which key signed the transaction), while economic mechanisms must be utilized to ensure why they are acting honestly.

Comprehensive Threat Model

In an open, permissionless network, adversaries exploit the gaps between cryptographic identity and behavioral assumptions. The threat model encompasses several sophisticated attack vectors tailored to autonomous agents.

The creation of Sybil identities allows adversaries to generate near-infinite pseudonymous identities at zero marginal cost. These identities are frequently deployed in reputation laundering schemes, where they engage in "wash trading" or reciprocal fake transactions8. By creating a closed loop of high-value, highly rated transactions among colluding nodes, adversaries artificially inflate their reputation scores, subsequently using this manufactured trust to defraud legitimate network participants8.

Purchased identities present another severe risk. Because digital identity ultimately resolves to the possession of private cryptographic keys, adversaries can purchase highly reputable identities in secondary out-of-band markets. The adversary acquires the key material, extracts the stored economic value, and exploits the accumulated trust until the reputation is entirely destroyed or slashed by the network.

Privacy-preserving credentials, while essential, introduce the risk of selective disclosure abuse. Malicious agents utilizing zero-knowledge selective disclosure may choose to reveal only successful task outcomes while cryptographically hiding failures, slashed stakes, or sanctions. This enables an adversary to project a flawless but highly misleading operational history to prospective counterparties11.

At the operational layer, credential theft and lateral movement are amplified by agent autonomy. Operating at machine speed, a compromised agent—or an adversary who has stolen an agent's long-lived cryptographic keys—can execute thousands of unauthorized lateral actions across connected APIs and smart contracts before traditional security controls can register an anomaly1. Adversaries may also engage in causality laundering, probing authorization boundaries to learn from access denials and exfiltrating inferred structural data through subsequent, seemingly benign transactions that evade detection12.

2. Distinctions in Agent Attributes

To construct a resilient network, the system must precisely distinguish between different attributes of an agent's operational state. Conflating the possession of a credential with reliability or financial capacity invariably leads to catastrophic security failures and mispriced economic risk.

The possession of a credential represents a localized, static cryptographic state. It proves only that an agent holds a specific private key capable of generating a valid signature or zero-knowledge proof at a specific moment in time13. It makes no assertions about the agent's history or future behavior. Continuity of an agent identity builds upon possession by providing the ability to link current actions to a historical chain of events through the persistent control of a primary identifier, such as a Decentralized Identifier (DID). Continuity establishes temporal consistency, enabling a track record to be built, but it remains neutral regarding the quality of the actions performed14.

Authority to act for another identity involves cryptographic delegation. It is the verifiable evidence—often expressed via capabilities, signed mandates, or chained tokens—that a superior entity (human or algorithmic) has granted a subordinate agent a strictly defined scope of permissions to execute tasks on its behalf15. Authority defines what an agent may do, whereas capability to perform a particular task relates to deterministic competence. Capability defines what an agent can do, which can be mathematically proven via zkML, wherein an agent submits a succinct non-interactive argument of knowledge (zk-SNARK) demonstrating successful model execution without revealing proprietary weights3.

Reliability demonstrated through prior outcomes is fundamentally an economic and behavioral metric. It is aggregated from the objective outcomes of previous interactions, indicating the statistical likelihood of future success. Reliability cannot be proven cryptographically; it must be inferred from the ledger of historical performance. Conversely, financial capacity to absorb a loss is an objective, current state. It represents the verifiable existence of bonded capital—such as cryptocurrency staked in an escrow smart contract—that serves as collateral. Financial capacity provides cryptoeconomic recourse independent of the agent's identity, history, or reputation, ensuring that counterparties can be made whole in the event of a failure17.

Finally, as previously established, claims of machine authorship or operational independence reside purely in the realm of assumption. Without unbroken, universally verifiable hardware supply chains that are immune to side-channel extraction, operational independence cannot be cryptographically guaranteed to remote counterparties5.

3. Comparison of Candidate Identity and Reputation Mechanisms

To operationalize these distinctions, autonomous agents require an architecture that seamlessly blends self-sovereign cryptography, capability-based authorization, and decentralized reputation algorithms.

Identity and Delegation Mechanisms

Decentralized Identifiers (DIDs) and W3C Verifiable Credentials (VCs) serve as the foundational layer for agent identity. DIDs provide globally unique, persistent identifiers that anchor an agent's public keys on distributed ledgers without relying on a centralized registry or certificate authority14. VCs provide digitally signed attestations about the agent's attributes14. However, while DIDs and VCs excel at establishing identity, they natively treat authorization as a static claim, which is insufficient for dynamic agent workflows.

To delegate authority dynamically and securely, agents require capability credentials. Two primary standards dominate distributed systems research: Macaroons and User-Controlled Authorization Networks (UCANs).

Macaroons are bearer credentials constructed using nested, chained Hash-based Message Authentication Codes (HMACs)18. They allow an entity to issue a token granting broad authority, which the bearer can progressively attenuate by appending "contextual caveats"—such as restricting the action to specific file paths, limiting transaction values, or enforcing time expirations20. Because the HMAC chain is strictly monotonic, caveats cannot be removed or bypassed. This ensures decentralized, offline privilege reduction without requiring the agent to communicate with the original issuer, effectively halting privilege escalation21.

UCANs achieve similar delegation attenuation via chains of JSON Web Tokens (JWTs) using public key cryptography22. While UCANs are highly expressive and seamlessly interoperate with standard web identity architectures, Macaroons are computationally lighter and faster to verify, making them highly suitable for autonomous machine-to-machine interactions occurring at millisecond latencies19.

Reputation Models: Flow-Based vs. Probabilistic

Reputation algorithms attempt to distill an agent's historical interactions into a predictive metric. These mechanisms generally bifurcate into flow-based algorithms and probabilistic or subjective algorithms23.

EigenTrust operates on the principle of transitive trust, utilizing eigenvector-based propagation kernels conceptually similar to Google's PageRank24. An agent computes a local trust value based on the normalized difference between satisfactory and unsatisfactory transactions24. The global reputation vector is computed via power iteration, distributing trust uniformly across the network26. However, EigenTrust exhibits severe flaws in open networks. It is highly vulnerable to collusion and Sybil attacks unless the network is anchored by a set of "pre-trusted peers" acting as a central authority24. In an open, permissionless network of autonomous agents, establishing an objective set of pre-trusted peers introduces unwanted centralization and systemic fragility28. Furthermore, EigenTrust mathematically conflates a lack of interaction with active distrust, penalizing new agents26.

Subjective Logic, developed by Audun Jøsang, extends traditional probability by explicitly incorporating epistemic uncertainty29. An opinion about an agent is represented as a tuple [Figure omitted from source export], where [Figure omitted from source export] is belief mass, [Figure omitted from source export] is disbelief mass, [Figure omitted from source export] is uncertainty, and [Figure omitted from source export] is the base rate (prior probability), satisfying the equation [Figure omitted from source export]29. Subjective logic utilizes a consensus operator ([Figure omitted from source export]) to fuse independent opinions from multiple sources, and a discounting operator ([Figure omitted from source export]) to compute transitive trust across a chain of delegating agents23. Unlike EigenTrust, Subjective Logic gracefully handles the cold-start problem because a new agent simply possesses an initial state of pure uncertainty (where [Figure omitted from source export], and belief and disbelief are zero)30. The discounting operator specifically models the flow of evidence, naturally degrading trust as the chain of hearsay lengthens, making it highly resilient to deep, manufactured reputation chains23.

Sybil Defense via Social Graph Analysis

To defend against infinite Sybil creation without relying on centralized identity verification, the network must exploit the structural properties of transaction graphs. Algorithms like SybilLimit and SybilGuard operate on the premise that while adversaries can generate infinite pseudonymous identities, they face a severe bottleneck in establishing "attack edges"—the required trust relationships and transaction histories between honest nodes and Sybil nodes32.

SybilLimit uses modified random walks of length [Figure omitted from source export] to sample the transaction graph. The underlying algorithmic assumption is that honest networks exhibit "fast mixing" properties, meaning random walks will intersect rapidly32. If an adversary creates a massive cluster of Sybil identities, they will be sparsely connected to the honest network by only a few attack edges, creating a slow-mixing quotient cut. SybilLimit mathematically bounds the number of accepted Sybil identities to [Figure omitted from source export] per attack edge, a dramatic improvement over SybilGuard's bound of [Figure omitted from source export]33. By analyzing the graph topology, the network can isolate reputation laundering rings and discount the subjective belief mass generated within heavily clustered, artificially inflated subgraphs.

4. A Minimum Identity Lifecycle

To secure autonomous interactions, the network must support a rigorous, automated identity lifecycle that addresses creation, delegation, compromise, and retirement without relying on human administrators1.

The lifecycle begins with creation, where the autonomous agent generates an asymmetric cryptographic keypair and registers a Decentralized Identifier (e.g., did:jwk or did:web). This initial state is recorded, granting the agent a unique cryptographic anchor from which it can sign transactions and receive credentials13. Once anchored, the agent enters the delegation phase. The controlling entity (a human organization or a superior orchestrator agent) issues a capability credential, such as a Macaroon, delegating specific, time-bound authority to the new DID. This credential explicitly maps the agent's behavioral scope, ensuring it operates under the principle of least privilege15.

In the event of credential loss—where a private key is misplaced but not necessarily compromised by an adversary—the agent or its controller utilizes a pre-established recovery method. This typically involves [Figure omitted from source export]\-of\-[Figure omitted from source export] Shamir's Secret Sharing or a multi-signature smart contract to rotate the public key associated with the DID, preserving the agent's continuity and reputation history without exposing key material to a central custodian14.

If an agent is compromised or turns malicious, its delegated credentials must be subjected to instant revocation. Traditional revocation checks, such as the Online Certificate Status Protocol (OCSP), leak privacy by revealing exactly which credential a verifier is querying to the centralized issuer. The W3C BitstringStatusList (StatusList2021/2024) solves this problem elegantly. The issuer publishes a GZIP-compressed bitstring representing the status of a vast population of credentials—up to 131,072 entries in a standard 16KB uncompressed bit-array37. The verifier downloads the compressed list via a Content Delivery Network (CDN) and locally checks the specific index (e.g., index 12345\) to see if the bit is 1 (revoked) or 0 (active)39. This ensures real-time revocation of a rogue AI agent's authority while providing herd privacy, as the verifier never communicates its specific target back to the issuer37.

Finally, the lifecycle concludes with retirement and state finalization. The agent is gracefully decommissioned, the DID is marked as deactivated in its registry, and all remaining financial stakes or bonded capital are unbound and returned to the controller after a mandatory latency period designed to allow any pending disputes to surface1.

5. A Reputation Model Tied to Observable Outcomes

Traditional web reputation systems fail utterly in autonomous networks because they rely on subjective, semantic ratings (e.g., 5-star reviews) which are easily manipulated by wash trading and reputation laundering8. A robust reputation model for economic agents must abandon popularity contests in favor of observable, cryptographically verifiable outcomes.

Rather than asking agents to rate one another qualitatively, reputation must be constructed from verifiable receipts of completed work anchored in cryptoeconomic reality. When Agent A negotiates a contract with Agent B, they lock the agreed-upon funds in an escrow smart contract. The transaction proceeds via optimistic execution: Agent B performs the work and submits a cryptographic proof or hash of the completion payload to the contract42. If Agent A accepts the work without raising a dispute, the contract settles instantly, generating a successful verifiable receipt17.

If Agent A claims the work is defective, the transaction enters a decentralized dispute resolution protocol, such as Kleros. In these protocols, anonymous, token-staked human or algorithmic jurors evaluate the cryptographically committed evidence43. If the jurors find Agent B at fault, the agent's staked collateral is slashed, and the escrowed funds are returned to Agent A. If the dispute is deemed frivolous, Agent A is penalized45.

In this architecture, reputation is computed strictly from the objective ratio of successfully settled contracts versus arbitrated and slashed contracts. A high reputation score proves that an agent has consistently delivered acceptable work or successfully defended its work in impartial arbitration. Slashing serves as the ultimate, unforgeable measure of reliability, rendering subjective ratings irrelevant.

6. A Cold-Start Path for Newcomers

A critical failure mode of historical reputation networks is the "cold-start" problem, wherein a highly capable new participant cannot obtain work because it lacks a historical reputation, leading to a dependency on centralized gatekeepers for initial distribution. To circumvent this without forcing the agent to surrender unnecessary identity information, a newcomer can bootstrap trust through three alternative, non-historical mechanisms.

First, the agent relies on financial bonding, also known as skin in the game. The newcomer stakes a substantial financial bond in a smart contract. Even with zero reputation and pure uncertainty ([Figure omitted from source export]), a counterparty can safely interact with the agent because the bonded capital provides guaranteed, objective recourse in the event of a failure or malicious action17. The economic assumption of loss aversion replaces the need for historical trust.

Second, agents offering specialized computational tasks can utilize zero-knowledge proofs of capability via zkML. A new agent offering AI inference can prove its deterministic competence before executing a live, paid task. The agent generates a ZK-SNARK proving that its proprietary model correctly processed a standard test dataset or achieved a specific mathematical benchmark3. The counterparty verifies the compact cryptographic proof in milliseconds, gaining mathematical certainty of the agent's capability without requiring a prior relationship and without the agent revealing its model weights16.

Third, the agent engages in progressive autonomy. Utilizing the mechanics of Subjective Logic, the agent secures low-risk, low-value tasks where the counterparty's risk tolerance accommodates high uncertainty. As the agent generates verifiable receipts from these micro-transactions, its uncertainty ([Figure omitted from source export]) decreases, and its belief mass ([Figure omitted from source export]) incrementally increases. This mathematically predictable progression allows the agent to iteratively access higher-value workflows based entirely on demonstrated competence rather than centralized endorsements1.

7. Privacy and Portability Requirements

If an autonomous agent's transaction history is completely transparent, adversaries can profile the agent, reverse-engineer its operational patterns, or front-run its economic strategies in the marketplace. Therefore, identity and reputation must be highly portable across networks yet strictly privacy-preserving36.

To achieve privacy, credentials require selective disclosure—the ability of a holder to present specific attributes of a credential to a verifier without revealing the entire payload. In modern distributed systems, two primary cryptographic standards compete to provide this capability: Selective Disclosure for JWTs (SD-JWT) and BBS+ Signatures48.

SD-JWT relies on relatively simple hash-based commitments. The issuer hashes individual claims with random salts, and the holder selectively reveals the salts for the claims they wish to disclose36. However, extensive privacy evaluations have confirmed that SD-JWT suffers from severe unlinkability failures. SD-JWT credentials carry a static verifiable credential type (vct) claim and bind to a persistent holder DID. Furthermore, the cryptographic signature remains static across presentations50. Colluding verifiers can easily use these static artifacts as correlation handles to track an agent's activities across disparate contexts, completely undermining the privacy of the network50.

Conversely, BBS+ (Boneh-Boyen-Shacham) is a multi-message digital signature scheme utilizing pairing-friendly curves, specifically BLS12-38151. When an agent presents a BBS+ credential, it does not reveal the original signature provided by the issuer. Instead, the agent dynamically derives a novel zero-knowledge proof of knowledge of the signature over the selectively disclosed claims11. Because a fresh proof is generated for every presentation, verifiers cannot mathematically correlate two different presentations from the same agent52. Additionally, BBS+ enables powerful zero-knowledge predicates, allowing an agent to prove it possesses a financial capacity greater than a required threshold without revealing its exact balance11.

For an open coordination network of autonomous agents, BBS+ signatures are strictly required for high-stakes, cross-boundary coordination, as unlinkability prevents adversaries from tracking lateral movements and economic positioning. SD-JWT remains acceptable only for low-risk, internal enterprise microservices where correlation is intended and acceptable36.

8. Proposed Experiments for Detecting Misleading Reputation Signals

Given the persistent threat of reputation laundering and coordinated rating manipulation, the network cannot passively rely on aggregated scores. It must continuously execute analytical experiments over the distributed ledger of verifiable receipts to detect and neutralize misleading signals.

The first critical experiment involves Sybil Ring Detection via Graph Analysis. By implementing modified SybilLimit random-walk algorithms over the transaction graph, the network can identify densely connected subgraphs that exhibit sparse connections (attack edges) to the broader, honest network32. If an agent's reputation is derived exclusively from a tightly knit cluster of nodes, the system algorithmically assumes collusion, and the agent's subjective belief mass is heavily discounted by the Subjective Logic consensus operator before being presented to counterparties.

The second experiment focuses on Temporal Wash Trading Analysis. The network monitors the velocity and bidirectional symmetry of token flows and verifiable receipts. If Agent A hires Agent B, and Agent B subsequently hires Agent A with highly similar monetary values within a tight latency window, the protocol flags the interactions as a potential reciprocal fake transaction designed solely to manufacture reputation volume8.

To detect adversaries probing the network's authorization graph, administrators can deploy Causality Laundering Traps. This involves deploying honeypot resources secured with strict Macaroon capability caveats. The network monitors for agents that intentionally trigger authorization denials on these honeypots, only to subsequently attempt lateral movement using alternative, seemingly benign capability chains. Identifying this behavior isolates agents attempting to map network vulnerabilities12.

Finally, the network must enforce zkML Performance Audits. To prevent adversaries from purchasing high-reputation identities and substituting inferior, cheaper machine learning models, the network periodically requires agents operating inference services to submit zkML proofs on novel, randomly generated challenge datasets. Failure to produce a valid SNARK proof in a specified time window immediately triggers a slashing event, destroying the purchased reputation and penalizing the malicious actor7.

9. Staged Implementation Recommendation

Building a comprehensive identity, capability, and reputation architecture that blends DIDs, Macaroons, zkML, and Subjective Logic is highly complex. Attempting to deploy a fully zero-knowledge, fully on-chain architecture simultaneously guarantees failure due to engineering friction and catastrophic latency overheads. A staged implementation minimizes systemic risk and avoids the premature optimization of brittle cryptographic primitives.

Reasons to Reject Complex Alternatives Initially

It is tempting to enforce global zk-SNARKs for all identity, delegation, and state transitions to maximize privacy from day one. However, while verification of ZK proofs is fast ([Figure omitted from source export] for SNARKs), generating a proof for general neural network forward passes remains prohibitively resource-intensive, requiring seconds to minutes for nontrivial models46. Applying this to high-frequency autonomous bidding or capability delegation introduces massive, unacceptable latency46. Similarly, placing all dispute resolution and reputation calculation fully on-chain creates crippling transaction costs. Therefore, we reject universal ZK architectures and fully on-chain execution in favor of lightweight cryptographic delegation combined with optimistic off-chain execution.

Phase 1: Identity and Delegation Baseline

The initial phase establishes the cryptographic anchors of the network. The system deploys DIDs and W3C Verifiable Credentials to provide basic, verifiable agent identity13. For authorization, the network implements Macaroons to facilitate high-speed, machine-to-machine capability delegation. The chained HMAC construction provides sub-millisecond verification, enabling agents to instantly attenuate permissions without complex asymmetric cryptography18. Concurrently, the BitstringStatusList standard is deployed to ensure that compromised agents can be instantly and privately revoked across the network without relying on centralized, privacy-leaking infrastructure37.

Phase 2: Cryptoeconomic Outcomes and zkML

The second phase shifts the network from basic identity to provable capabilities and economic consequences. Optimistic execution channels backed by financial staking are introduced; agents must post collateral into smart contracts to accept high-value tasks17. To secure these contracts, decentralized dispute resolution mechanisms, modeled on protocols like Kleros, are integrated to slash malicious actors, forming the baseline of objective reputation data43. For the cold-start problem, zkML validation frameworks are enabled for specialized inference tasks, allowing newcomers to mathematically prove their capabilities without requiring a pre-existing reputation3.

Phase 3: Privacy and Subjective Reputation

The final phase protects agent strategies and establishes a global, decentralized trust metric. Verifiable Credentials are upgraded from standard JSON Web Signatures (or SD-JWTs) to advanced BBS+ signatures, enabling fully unlinkable selective disclosure and zero-knowledge predicate proofs51. With privacy secured, a network-wide reputation index based on Subjective Logic is activated29. This system utilizes the discounting operator ([Figure omitted from source export]) over the graph of verifiable receipts (the ratio of slashed versus successful contracts) to continuously compute the dynamic belief ([Figure omitted from source export]) and uncertainty ([Figure omitted from source export]) of any given agent. This natively penalizes long chains of unknown intermediaries and algorithmically defends against Sybil clusters, finalizing a secure, autonomous economic network23.

Works cited

1. What is AI agent identity? Securing autonomous systems \- Okta, https://www.okta.com/identity-101/what-is-ai-agent-identity/

2. Agent Identity Registry Protocol Community Group \- W3C, https://www.w3.org/community/agent-identity/

3. Zero-Knowledge Machine Learning: Provable AI on Aleo, https://aleoforagents.com/zkml

4. Foreshadow \- Anjuna Security, https://www.anjuna.io/blog/foreshadow

5. EnclaveOS: Defense in depth for trusted execution environments, https://distrust.co/blog/enclaveos.html

6. Towards attack-tolerant trusted execution environments \- Aaltodoc, https://aaltodoc.aalto.fi/bitstreams/4efd40b9-628e-45c9-89f6-a4042b1a9867/download

7. A Survey of Zero-Knowledge Proof Based Verifiable Machine Learning, https://arxiv.org/html/2502.18535v2

8. Answerbook \- Bankr, https://bankr.bot/launches/0x20e707e2db742a8294fa47f558964f7299e27b07

9. AWS and Blockchain \- Hacker News, https://news.ycombinator.com/item?id=33686168

10. Trade \- Bankr, https://bankr.bot/launches/0xfa2ed5261732902F235c264ea7363f868b17AD6f

11. Zero Knowledge Proof (ZKP) and Selective Disclosure | Gataca, https://www.gataca.io/resources/blog/ssi-essentials-which-selective-disclosure-protocol-will-succeed/

12. Macaroons: Cookies with Contextual Caveats for Decentralized, https://www.researchgate.net/publication/269196979\_Macaroons\_Cookies\_with\_Contextual\_Caveats\_for\_Decentralized\_Authorization\_in\_the\_Cloud

13. Introducing Agent Identity: Cryptographic IDs for AI Agents, https://openagents.org/blog/posts/2026-02-03-introducing-agent-identity

14. Agentic AI Identity and Access Management: A New Approach, https://cloudsecurityalliance.org/artifacts/agentic-ai-identity-and-access-management-a-new-approach

15. Identity for AI: The Ultimate Guide to Agentic IAM, https://www.pingidentity.com/en-us/docs/assets/4260-ultimate-guide-ai-identity

16. What is zkML? Zero-Knowledge Machine Learning Explained, https://www.datawallet.com/crypto/what-is-zkml

17. The Klyrox Protocol \- A Decentralized Framework for Optimistic, https://www.authorea.com/doi/pdf/10.22541/au.177574483.34793689

18. Macaroons: Cookies with Contextual Caveats for Decentralized, https://www.ndss-symposium.org/ndss2014/ndss-2014-programme/macaroons-cookies-contextual-caveats-decentralized-authorization-cloud/

19. Macaroons: Cookies with Contextual Caveats for Decentralized, https://research.google.com/pubs/pub41892.html?source=post\_page---------------------------

20. Macaroons (computer science) \- Wikipedia, https://en.wikipedia.org/wiki/Macaroons\_(computer\_science)

21. Capability-Based Delegation of Privileges in Multi-Agent Systems, https://arxiv.org/html/2609.06500v1

22. User Controlled Authorization Network (UCAN) Specification, https://ucan.xyz/specification/

23. Flow-based reputation with uncertainty \- arXiv, https://arxiv.org/html/1402.3319v2

24. GroupTrust: Dependable Trust Management \- IEEE Computer Society, https://www.computer.org/csdl/journal/td/2017/04/07572209/13rRUyv53F1

25. (PDF) Improving the Effectiveness of Eigentrust in Computing the, https://www.researchgate.net/publication/374303248\_Improving\_the\_Effectiveness\_of\_Eigentrust\_in\_Computing\_the\_Reputation\_of\_Social\_Agents\_in\_Presence\_of\_Collusion

26. From Eigentrust to a Trust-measuring Algorithm in the Max-Plus, https://ecai2020.eu/papers/1634\_paper.pdf

27. EigenTrust : Attack Resilient Trust Management, https://faculty.cc.gatech.edu/\~lingliu/papers/2012/XinxinFan-EigenTrust++.pdf

28. BP-P2P: Belief Propagation-Based Trust and Reputation, https://fekri.ece.gatech.edu/Publications/2012\_14.pdf

29. Subjective logic \- Grokipedia, https://grokipedia.com/page/Subjective\_logic

30. BFCRI: A Blockchain-Based Framework for Crowdsourcing With, https://www.computer.org/csdl/journal/cc/2023/02/09829255/1EYxlfa95Ic

31. Full article: Security framework for dynamic service-oriented IT systems, https://www.tandfonline.com/doi/full/10.1080/24751839.2018.1479926

32. Technical Report \- University Digital Conservancy, https://conservancy.umn.edu/bitstreams/b78045f3-378f-4718-b6fc-564d2056c052/download

33. A Near-Optimal Social Network Defense against Sybil Attacks, https://www.comp.nus.edu.sg/\~yuhf/sybillimit-tr.pdf

34. Measuring the Mixing Time of Social Graphs \- Events, http://conferences.sigcomm.org/imc/2010/papers/p383.pdf

35. SybilLimit: A Near-Optimal Social Network Defense against Sybil, https://www.comp.nus.edu.sg/\~yuhf/yuh-sybillimit.pdf

36. Decentralised Identity & Verifiable Credentials, https://www.opensecurityarchitecture.org/patterns/sp-052/

37. Bitstring Status List v1.0 \- W3C, https://www.w3.org/TR/2024/WD-vc-bitstring-status-list-20240107/

38. Bitstring Status List v1.0 \- W3C, https://www.w3.org/TR/2024/WD-vc-bitstring-status-list-20240204/

39. Bitstring Status List v1.0 \- W3C, https://www.w3.org/TR/vc-bitstring-status-list/

40. trustvc/w3c-credential-status \- NPM, https://www.npmjs.com/package/@trustvc/w3c-credential-status

41. Revoke a verifiable credential as an issuer \- Microsoft Entra Verified ID, https://learn.microsoft.com/en-us/entra/verified-id/how-to-issuer-revoke

42. Intelligent AI Delegation \- arXiv, https://arxiv.org/html/2602.11865v1

43. Kleros DAO Analysis \- CRYPTOTEXTY, https://cryptotexty.io/kleros/

44. University of Illinois JLTP | Arbitrable Disputes in the Metaverse, https://illinoisjltp.com/current-issue/article/arbitrable-disputes-in-the-metaverse-legal-challengesand-frameworks-for-virtual-business-transactions

45. Model Procurement for Industrial Cyber-Physical Systems Using, https://www.mdpi.com/1999-5903/18/3/146

46. Thinking about the advantages and disadvantages of various zero, https://www.reddit.com/r/CryptoTechnology/comments/1ukysda/thinking\_about\_the\_advantages\_and\_disadvantages/

47. Best AI Agent Identity Platforms for Enterprises in 2026 \- Dock Labs, https://www.dock.io/post/best-ai-agent-identity-platforms-for-enterprises

48. Current Work and Future Trends in Selective Disclosure, https://www.kuppingercole.com/watch/trends-selective-disclosure-eic2023

49. Opt-In Auditability for Bitcoin Transactions via Cryptographic, https://vtechworks.lib.vt.edu/bitstreams/f1f276e7-39d3-4142-bb93-d8505615d3e2/download

50. xID: Unlinkable Digital Identity — PRIVATE.ME Platform, https://private.me/docs/xid.html

51. Using privacy-preserving ZKP credentials on the MATTR Platform, https://medium.com/mattr-global/using-privacy-preserving-zkp-credentials-on-the-mattr-platform-4c9e351a2fc3

52. The "Verifiable Credential" Movement: Portable Reputation for, https://www.jasminedirectory.com/blog/the-verifiable-credential-movement-portable-reputation-for-businesses/

53. Verifiable Presentations (OID4VP) | Affinidi Tech, https://www.affinidi.com/tech/verifiable-presentations

54. Auditable Engineering Primitives for the Conditionally Delegable Zone, https://civic-proof.mashbean.net/reports/2026-05-11-civic-receipts-provenance/

55. zk-creds: Flexible Anonymous Credentials from zkSNARKs and, https://www.researchgate.net/publication/372563611\_zk-creds\_Flexible\_Anonymous\_Credentials\_from\_zkSNARKs\_and\_Existing\_Identity\_Infrastructure

56. Interoperable Architecture for Digital Identity Delegation for AI ... \- arXiv, https://arxiv.org/pdf/2601.14982