[agent2agent] Re: Security-principal separation for agent communication protocols

[Chris Hood <[e-mail]>]

Songbook,As a side note, and for reference, The Agent Transfer Protocol, AGTP covers the items you outlined.1. User/organizational authority. AGTP has Owner-ID. This is the accountable principal — the human or organization on whose behalf the agent acts. Directly addresses this. AGTP-LEI extends this into institutional identity through GLEIF. 2. Agent instance identity. AGTP has Agent-ID derived from the Agent Genesis. AGTP-CERT binds the identity to X.509 credentials for TLS mutual authentication. AGTP-IDENTIFIERS extends this into a hash chain. 3. Tool/external-resource identity. This is where AGTP's story gets interesting. AGTP composition profiles cover MCP tool invocations, external IdP credentials, and HTTP gateway translation. Each carries the target resource identity but through the composition layer rather than as an AGTP primitive. Partial coverage — the tool identity is present but is expressed at the composition layer rather than as a first-class AGTP primitive.4. Delegation state. AGTP has Delegation-Chain header carrying the chain of who delegated what to whom. The DELEGATE method invocation produces attribution records for each delegation event. Authority-Scope narrows on delegation. 5. Session state. AGTP has Session-ID and Task-ID. The AGTP-Session companion draft (v00) covers session semantics for bounded and persistent sessions. 6. Action evidence. AGTP-IDENTIFIERS defines the identifier chain with Audit-ID producing a per-agent hash chain from every action back to Agent Genesis. AGTP-LOG aligns with RFC 9162 (Certificate Transparency 2.0) and RFC 9943 (SCITT) for interoperable audit receipts. So, from at least one protocol position, security and governamce has been substantially looked at and is included in the draft. Chris Hood
-------- Original message --------From: Songbo Bu <[e-mail]> Date: 7/2/26  12:49 AM  (GMT-08:00) To: [e-mail] Subject: [agent2agent] Security-principal separation for agent communication protocols Hi all,
One useful early contribution to AGENTPROTO may be a security-principal separation for agent sessions and delegation.
In agent communication protocols, user authority, agent instance identity, tool identity, gateway identity, delegated scope, session continuity, and audit evidence are easy to conflate. If those claims are not separated early, protocol text can accidentally allow a token, session, or tool call to imply more authority than it actually carries.
The distinction I would suggest is:

user or organizational authority: who authorized the task or policy;
agent instance identity: which agent/runtime is acting in the current session;
tool or external-resource identity: what the agent is invoking;
delegation state: what authority has been delegated, by whom, and under what scope;
session state: what is bound to the current long-lived communication channel;
action evidence: what can later be verified about what the agent actually did.

From this, the requirements surface would include token attenuation, session binding, replay/freshness, tool/agent confusion prevention, revocation continuity, and auditable failure behavior for denied or blocked actions.
I am outlining a short individual note under the working title “Security Requirements for Agent Session and Delegation Binding”. I would appreciate feedback on whether this is most useful as charter input, requirements text, security-considerations text, or a separate individual draft.
Best,
Songbo