[Agentproto] Re: Charter Update

[Orie <[e-mail]>]

Hi Sumit & Steven,

With hat:

We've merged some parts of Steven's PR.

I do not think it's wise to list specific security mechanisms in the
charter.

With no hat:

My reading of the current charter is that the WG is not blocked from
exchanging references to security mechanisms that an agent uses.

Regards,

OS





On Tue, Sep 8, 2026 at 1:31 PM Sumit Ahuja <[e-mail]> wrote:

> Orie,
>
> I read the spec and the repo. Three things, all checkable.
>
> TRACE is built on the stack the charter already coordinates with. The wire
> envelope is EAT, RFC 9711. The transparency claim is a SCITT receipt URI.
> The subject is a SPIFFE identifier. So it is a record format sitting on
> RATS and SCITT, which is the case for the Coordination entry rather than
> for a new deliverable. On Steven's PR specifically, I read TRACE as
> evidence that the existing Coordination approach is right, not that the
> charter needs to say more.
>
> Second, and this one bears on the evidence-requirements amendment rather
> than on TRACE. Sentence (2) of that amendment would require verification
> "without contacting any service, including for key resolution." TRACE
> reached the same question and answered it the other way. From
> LIMITATIONS.md:
>
> "Pure offline verification cannot prove non-revocation. Signature validity
> is permanent; trust is not... Spec 3.2.1 accordingly requires verifiers to
> consult current revocation status at verification time, which is by
> definition an online step."
>
> Two efforts found the same limit and resolved it in opposite directions. A
> shipped v0.2 spec mandates the online check that the proposed charter text
> would forbid. That seems worth knowing before the text goes to the AD,
> whichever way the group decides.
>
> Third, on the volume point. TRACE has a technical charter, an antitrust
> policy, named maintainers, a sponsor contributing engineering, CI, a PyPI
> package, a separate conformance test suite, and a launch at the
> Confidential Computing Summit in June. ADOPTERS.md lists nobody. That is a
> real project without production users yet, which is a different thing from
> noise.
>
> Your EU AI Act guess is right and the spec states it: Article 12
> tamper-evident logging for high-risk systems, applying from around December
> 2027, with DORA and HIPAA carrying equivalent audit-trail requirements
> today.
>
> Sumit P. Ahuja
> Main Labs
>
> On Sat, Sep 05, 2026 02:46 PM, Orie <[e-mail]> wrote:
>
>> Hi Steven,
>>
>> I do not think it is wise to refer to AUDIT (a non wg mailing list / not
>> an IETF WG) in the draft charter.
>>
>> I have observed a huge amount of AI generated text describing verifiable
>> conversation records, and the exchange of evidence or endorsements between
>> agent systems.
>> At this point the volume of AI-generated dialogue on this subject has
>> made me (and I suspect other IETF readers) suspicious of any real human
>> interest in the topic.
>>
>> This is the closest thing I could find to support your argument that this
>> text belongs in the agentproto charter:
>>
>>
>> https://www.linuxfoundation.org/press/linux-foundation-welcomes-trace-to-advance-verifiable-runtime-evidence-for-ai-workloads
>>
>> https://github.com/agentrust-io/trace-spec
>>
>> This information is days old, does anyone on this list have any further
>> insight into how relevant or not this LF project / topic is to the
>> AgentProto charter?
>>
>> I gather this is related to the EU AI Act?
>> - https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-12
>> - https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-15
>> - https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-4
>>
>> Regards,
>>
>> OS
>>
>>
>>
>>
>>
>>
>> On Sat, Sep 5, 2026 at 12:52 PM Steven Mih <[e-mail]> wrote:
>>
>>> Hi Orie,
>>> I opened a small PR with 3 edits, no new deliverables: adding
>>> SCITT/RATS/proposed AUDIT to coordination; treating evidence of dialog
>>> events the same way the reference architecture already treats identity and
>>> authorization (reused, not defined); and letting dialog primitives carry a
>>> reference to a signed record by content digest in dialog context.
>>> https://github.com/ietf-artarea/charters/pull/84
>>> Steven
>>>
>>> On Sat, Sep 05, 2026 at 7:56 AM, Chris Hood <[e-mail]> wrote:
>>>
>>>> Overall, for solely a communications protocol, this is good. I only
>>>> have one pet peeve to address.
>>>>
>>>> Remove autonomous from the charter. It's a misused marketing term.
>>>>
>>>> "An AI agent is a software system that uses AI models to complete tasks
>>>> under authority delegated by a human user or another AI agent."
>>>>
>>>> Rationale: autonomous is a claim no protocol can verify and no
>>>> deliverable in this charter depends on. Every capability an agent exercises
>>>> is granted, scoped, and revocable, and the charter's own identity
>>>> consideration says so, revocation, scoping, auditability.
>>>>
>>>> The delegated-authority framing matches the deliverables and avoids
>>>> baking contested vocabulary into a chartered definition that will be cited
>>>> for years. SAE deprecated autonomous from vehicle taxonomy for the same two
>>>> reasons, engineering accuracy and legal accountability.
>>>>
>>>> Chris
>>>>
>>>>
>>>> -------- Original message --------
>>>> From: Orie <[e-mail]>
>>>> Date: 9/5/26 6:45 AM (GMT-08:00)
>>>> To: [e-mail]
>>>> Subject: [Agentproto] Charter Update
>>>>
>>>> Hi,
>>>>
>>>> The proponents and chairs have revised the draft charter:
>>>>
>>>> https://github.com/ietf-artarea/charters/blob/main/agentproto/charter.md
>>>>
>>>> Our goal is to submit this to our Area Director, Charles, next week.
>>>>
>>>> Regards,
>>>>
>>>> Orie & Leslie
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Agentproto mailing list -- [e-mail]
>>>> To unsubscribe send an email to [e-mail]
>>>>
>>>
>>> _______________________________________________
>> Agentproto mailing list -- [e-mail]
>> To unsubscribe send an email to [e-mail]
>>
>