[Audit] Re: Proposed charter change to clarify VCON relationship

["Heime.Jorgen" <[e-mail]>]

​

Thanks, Mirja. I strongly agree with both points.

1. On (a): Extension ownership belongs to the working group maintaining the protocol (VCON), under its own charter and review procedures. AUDIT should not prescribe or govern extensions for external formats.

2. On (b): Making the charter wording generic—focusing on reusing existing, preferably IETF-specified formats where possible, and describing VCON as a suitable candidate for coordination—is the right architectural boundary. AUDIT should remain format-agnostic.

Heime

-------- Original Message --------
On Tuesday, 10/06/26 at 01:09 Mirja Kuehlewind (IETF) <ietf=[e-mail]> wrote:

> I replied on GitHub but now realized it might be most useful to bring my feedback here for further discussion. This is what I wrote:
>
> Two comments:
>
> a) I think it's for the vcon charter to say if and where extension should be done; and not the audit charter to define what the vcon should do or not do. There are other examples e.g. for IPv6 extensions or TCP extensions where the charters either define one or the other model, meaning extensions can be done in other groups (with review/approval of e.g. 6man) or all extensions should be done in the maintenance group (like. e.g. TCPM). But it's the group that specifies maintains the protocol that has to define this in their charter.
>
> b) I think we can't not say "will leverage the VCON format" as long as it doesn't exist. I would prefer to make this sentence a bit more generic and e.g. say: the group will use existing formats wherever possible, preferable specified in the IETF, such as VCON. Or even an additional sentence saying something like: VCON is considered a suitable record format and the audit group will work with the vcon group to ensure the specified format addresses the auditing needs.
>
>> On 2. Oct 2026, at 18:57, Jonathan Rosenberg <[e-mail]> wrote:
>>
>> I've opened a PR against the charter to revise the second deliverable, to clarify the relationship with VCON explicitly:
>>
>> https://github.com/mirjak/audit-bof-preparation/pull/61
>>
>> Here is what I wrote:
>>
>> One or more Standards Track RFC(s) that identify and reuse existing or specify new IETF data models that can represent audit information about agents and delegated systems (e.g., interaction records, references to the identities of participating entities, delegation context, authorization state over time, or action provenance). For interaction records - the expectation is that the group will leverage the VCON format. Extensions to VCON to add data needed to model AI agent conversations will happen within the VCON group, and AUDIT will reference and (as needed) introduce profiles or use cases for it. This applies in general - if existing data models are identified the RFC(s) might create profiles that scope them to a degree of disclosure that is appropriate for audits.
>>
>> Thx,
>> Jonathan R.
>> _______________________________________________
>> Audit mailing list -- [e-mail]
>> To unsubscribe send an email to [e-mail]