[dmsc] Re: [DMSC] Architecture document proposals - on the post-onboarding security plane

[Guigui Wang <[e-mail]>]

Hi Aijun, and all,

Thank you for collecting the architecture proposals. I have read all three from a security perspective and would like to offer one observation for the architecture discussion.

All three proposals define strong mechanisms at the trust-establishment boundary: the MACP architecture centralizes agent identity and credential issuance in the AMC with the AAAP for authentication and authorization; ACPs covers trusted registration and authentication; and AIN treats intent-route integrity at the forwarding layer. What appears to be unaddressed across all three is the security plane after onboarding - verification of what an authenticated, authorized agent actually does once it is operating through the gateway: the tool calls and MCP invocations it makes, the data it exfiltrates, and whether its per-interaction behavior stays within the policy scope it was admitted with. Section 4.3 of draft-li-dmsc-macp explicitly lists agent internal verification capabilities and notes they are not standardized as architectural components, which I think is precisely the gap.

Authentication establishes that an agent is legitimate; it does not constrain the actions a legitimate agent takes. Credentialed agents can still invoke injected tools, be steered into unintended tool calls through their tool surface, or trigger higher-cost actions than the interaction intended - and the gateway is the natural observation point because it already mediates every cross-domain interaction.

A suggestion for the architecture document: consider distinguishing two security sub-layers at the AI Agent Gateway - (1) admission control (identity, credentials, capability authorization), which all three drafts cover; and (2) interaction verification at the mediation layer (tool/invocation conformance to declared capabilities and policy), which none currently cover. This would not require a new entity: it fits naturally into the gateway-side mediation functions of draft-li-dmsc-macp and into the operational-visibility deliverables in the charter, and it degrades gracefully where gateways do not implement it.

I am happy to write this up as a short contribution describing the conformance checks such a mediation layer could perform, if the group considers the distinction useful.

Best regards,
Guigui Wang