[ai-control] Re: VDAC proposal: Addressing the "What if the AI agent lies?" enforcement gap

[Blue Dog <[e-mail]>]

Hello Mark, Srecko,

I agree with Mark’s reading of the current charter scope. It seems
important to keep technical enforcement, crawler
authentication/authorization, and auditing outside the AIPREF deliverables
unless the WG is explicitly rechartered.

One way to make the boundary useful, while still allowing VDAC-like
mechanisms to compose with AIPREF later, may be to keep the AIPREF work
focused on mechanically consumable preference expressions:

   - stable preference vocabulary;
   - clear attachment mechanisms;
   - scope of applicability for each preference expression;
   - precedence and reconciliation when multiple expressions apply;
   - enough normalization or canonicalization guidance that another system
   can reference the same expression unambiguously.

Then an enforcement or accountability mechanism could consume AIPREF
expressions as input, but would define its own identity, acceptance,
authorization, logging, and dispute-handling semantics outside AIPREF.

I think that separation would help avoid overloading the preference
vocabulary with enforcement-specific assumptions, while still making the
output useful to later systems that want to build accountability or
contractual workflows around it.

Best regards,

Songbo Bu

On Sun, 24 May 2026 12:37:30 +1000, Mark Nottingham
mnot=[e-mail] wrote:

Hello Srecko,

Our charter explicitly makes “technical enforcement of preferences” out of
scope:
https://datatracker.ietf.org/wg/aipref/charter/

That’s not to say that we might not try to tackle it after a charter
revision, however.

Cheers,

On 23 May 2026, at 11:03 pm, Srecko Jovancevic [e-mail]
wrote:

Hi AIPREF Team,
I have been following the discussions around defining vocabulary and
attachment mechanisms for AI preferences. While establishing a standardized
vocabulary is a crucial first step, it inherently leaves a major open
question: What happens when an agent ignores the rules, or simply lies
about its compliance?
To address this exact enforcement and verification gap, I have published an
Internet-Draft: Verifiable Data Access Contract (VDAC).
The core philosophy of VDAC is to move from unilateral declarations (like
robots.txt or headers) to a cryptographically bound, bilateral agreement
between the Site and the Agent.
How VDAC Complements AIPREF (The “Pick and Compose” Stack)
In the latest 01 revision, VDAC has been intentionally architected as a
modular, identity-agnostic layer. It can easily ingest and wrap the
vocabulary AIPREF is developing:
The Contractual Handshake: The Site publishes its terms (potentially using
AIPREF vocabulary). The Agent must cryptographically sign an Acceptance
Document. This creates a dual-signed Contract Document before data access
begins.
Cryptographic Accountability: Subsequent HTTP requests are bound to this
contract via a unique Contract Identifier header.
Automated Enforcement & Compliance: VDAC defines a framework for mutual log
reconciliation (reconciliation manifests that protect end-user privacy) and
introduces explicit headers (VDAC-Violation, VDAC-Self-Report) to handle
automated sanctions when quotas or path restrictions are breached.
Instead of reinventing the wheel on identity, VDAC allows the architecture
to be composed seamlessly with various identification methods (whether
SAIP, VICDM, or DNS-based keys).
I believe VDAC provides the missing “teeth” to the AI regulation stack by
giving content publishers a technical, verifiable mechanism to ensure that
agreed intent is actually honored.
I would love to get the group’s feedback on how we can align VDAC with the
current AIPREF work items.
Draft link: https://datatracker.ietf.org/doc/draft-jovancevic-vdac/01/
Best regards, Srećko Jovančević

–
ai-control mailing list – [e-mail]
To unsubscribe send an email to [e-mail]

–
Mark Nottingham https://www.mnot.net/

–
ai-control mailing list – [e-mail]
To unsubscribe send an email to [e-mail]