[Audit] Re: Next Wave of Updates for the Proposed Audit Charter - please review and comment

["Diego R. Lopez" <[e-mail]>]

Hi Mirja,

Regarding intent and intent declarations, I totally agree the AUDIT scope should not consider any kind of specific modeling or format for expressing them. But I believe it is important to remark the connection we are going to consider is to these declarations (whatever their format) and not to what can be considered a unspecified, general expression, that could even be associated to something so vaporous as a wish list. My point (and, as far as I can tell, the one in the other post you mention) is to make clear the WG will consider formalized intent declarations, making clear is not the goal to define such formalism.

Be goode,

--
“Esta vez no fallaremos, Doctor Infierno”

Dr Diego R. Lopez
Telefonica
https://www.linkedin.com/in/dr2lopez/

e-mail: [e-mail]<mailto:[e-mail]>
Mobile: [phone]
---------------------------------

On 14/10/2026, 12:01, <[e-mail]> wrote:

AVISO/WARNING: Este correo electrónico se originó desde fuera de la organización. No haga clic en enlaces ni abra archivos adjuntos a menos que reconozca al remitente y sepa que el contenido es seguro / This email has been originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.


Hi Diego,

Thanks for your feedback. Yes, these seem good and  concrete improvements to the clarity of the charter text, so PRs would be great!

On your first point about user intent. This was also raised by at least one other person. So yes I agree there is a need for clarification. Based on your comment I wonder how much we should consider some kind of explicit user declaration as in scope for this group or is that a separate effort and we assume it may or may not be there to be recorded?

Mirja

Am 14.10.2026 um 10:43 schrieb Diego R. Lopez <[e-mail]>:


Hi,

I have found some time to go through the proposed charter. As I already said a few times before, I strongly support the idea behind AUDIT and I believe the current proposed charter is close to be in a final shape, and I must say I believe the proposed deliverables seem totally accurate to me. Anyway, reading the latest version I have identified a few possible changes that could improve it:


  *
First, "user intent" is mentioned a couple of times. While other related terms (such as "agent behavior" or "action") can be related to specific information, an unqualified mention to "user intent" sounds too fuzzy. I would use a more concrete wording, such as "user intent statement", "user intent declaration", or even directly "user request".

  *
Second, I would reformulate the second paragraph of the "Scope an Goals" section, in the aim of making it clearer. Like this:

The group will address the mechanisms enabling systems to record, exchange, and verify audit-relevant information across all interactions in a communication chain including the user, one or multiple agents or subagents, and tools. These mechanisms will include a reference architecture, the necessary data representations, and the extensions or adaptations to existing communication protocols for inter-domain correlation.


  *
Third, I find the paragraph listing the building blocks not clear enough on the proposed WG scope. I would reformulate it as:

The working group will compose existing building blocks for identity (WIMSE), attestation (RATS), authorization (OAuth family), transparency logging (SCITT), context propagation (W3C Trace Context or other context identifiers), and privacy-protecting profiles of conversation containers (vCon). The WG will focus on defining the interfaces to and profiles of the auditing components, as well as the additional protocol elements, data models, and best practices needed to integrate them coherently for the agent auditing case.


  *
And a few nits:
     *
In the first line "including those based on LLM-based machine learning systems" sounds weird, what about "including those based on LLM techniques"
     *
The statement "...enabling collect and correlation of different kinds..." also sounds weird. I would use "...enabling the collection and correlation of different kinds..."
     *
In the first bullet within the scope section it appears an "authoriazation"
     *
In the fourth bullet you have "...to collect, aggregate, verify, and transparency log records". I would use "...to collect, aggregate, verify, and transparently log records"

I can prepare a PR with these points if you find them agreeable...

Be goode,

--
“Esta vez no fallaremos, Doctor Infierno”

Dr Diego R. Lopez
Telefonica
https://www.linkedin.com/in/dr2lopez/

e-mail: [e-mail]<mailto:[e-mail]>
Mobile: [phone]
---------------------------------
On 17/09/2026, 17:03, <[e-mail]> wrote:

Dear AUDIT enthusiasts,

there have been various changes/updates to the charter draft that we
would like to highlight now, prominently. Please have another look!

https://github.com/mirjak/audit-bof-preparation/blob/350c086f7f0c5b64abb20361ee6f96b3c4d0fec7/audit-charter.md

The link above is pinned for your review. The current state can be seen
at the direct link to main, of course (at the time of posting that diff
is empty):

https://github.com/mirjak/audit-bof-preparation/blob/main/audit-charter.md

This snapshot definitely is not the last one! Our work on the charter
continuous and that is also why we really appreciate your recent
feedback so much. We are looking forward to more reviews at this stage -
as that will enable a BoF session at the next IETF meeting.

We are closing in to the BoF request cut-off. Correspondingly, we added
the request proposal from last time to github and already included a
minimal viable set of changes based on your feefback for review:

https://github.com/mirjak/audit-bof-preparation/blob/a7fb78dcf756b814cd7b47cf4b084ac1bb439042/bofreq-kuhlewind-agent-use-of-delegation-and-interaction-traceability-audit.md

The link above is also pinned for review consistency. The current state
can be reviewed on main:

https://github.com/mirjak/audit-bof-preparation/blob/main/bofreq-kuhlewind-agent-use-of-delegation-and-interaction-traceability-audit.md


Thanks for all your input! Sometimes, it was a bit of a hassle to work
through some of the AI-assisted content. Currently, we were able to
manage that, but it is always, really appreciated to receive crisp,
concise, and human-composed contributions, of course.


Viele Grüße,

Mirja and Henk
_______________________________________________
Audit mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is confidential and privileged information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is confidential and privileged information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição