FG-TIDA Interregnum Preparation Meeting — 3rd Meeting

Source: FG-TIDA Co-Chairs

Date: Virtual, 30 September 2026

WG(s): All

Original: English

Contacts:

• Debora Comparin — Thales, France — debora.comparin@thalesgroup.com
• Amir Banifatemi — Cognizant, United States — amir@cognizant.com

Abstract

This document contains the agenda and minutes of the FG-TIDA 3rd preparation meeting (virtual, 30 September 2026, 144 participants), held during the "Interregnum" period between the launch of the Focus Group (9 July 2026, AI for Good Global Summit) and its first meeting (Paris, 30 November – 1 December 2026).

1. Introduction

This document contains the agenda and minutes of the 3rd preparation meeting of the Focus Group on Trust and Identity for Humans and Agentic AI (FG-TIDA), held during the "Interregnum" period: the phase between the launch on 9 July 2026 at the AI for Good Global Summit and the first meeting in Paris on 30 November – 1 December 2026. During this phase, the structure, leadership, and initial deliverables of the Focus Group are prepared, for approval at the Paris meeting.

The meeting focused on the theme proposals that will shape the Working Groups. With more than 30 theme proposals received, the leadership selects a few for presentation at each preparation meeting. 3 theme proposals were presented at this meeting; the remaining items could not be taken for lack of time and were deferred to the additional virtual meeting of 14 October 2026.

2. Meeting Overview

3. Agenda

1. Opening remarks and agenda adoption
2. What is new since the last meeting: Use Cases Working Group and specification template
3. Theme proposals — five selected presentations
4. Short intervention by the SG17 Chair: how the ITU process works if FG-TIDA work is later progressed in ITU
5. AOB and next steps

4. Actions

• Debora Comparin to send the invitation for the additional virtual meeting on 14 October 2026, which will take the two theme proposals and the SG17 Chair's intervention on the ITU process not presented at this meeting.
• Proposers of use cases to submit them in the use cases repository; FG-TIDA management to qualify and classify the submitted use cases, with a dedicated session envisaged at the Paris meeting.
• Houda Labiod and Henk Birkholz to collect feedback from participants interested in Remote Attestation for Agentic AI (RA-AAI) on the proposed charter, work items and deliverables (themes #22, wg1-ra-aai).
• Gianpaolo Angelo Scalone to describe the child-aware delegated identity problem as a concrete use case, so that the questions raised in the discussion can feed the relevant technical Working Groups, and to discuss with the Co-Chairs how this work could be hosted within FG-TIDA (dedicated Working Group or otherwise).
• Arnaud Taddei to reply to Patrice Lyons's email on the overall direction of the Focus Group.
• All participants to continue the discussion of the presented themes in the themes repository.

5. Discussion Summary

5.1 Opening remarks and agenda adoption

The Chair welcomed participants and noted that, given the size of the call, all participants were muted by default and invited to raise their hand to speak. Two new members of the ITU secretariat supporting the Focus Group introduced themselves: Thomas Basikolo (TSB), the Counsellor of FG-TIDA, working alongside Xiaoya Yang, Counsellor of Study Group 17; and N'Goran Franck Konan (TSB), data scientist, who will support the Focus Group throughout. Participants who have problems with access, log-in or contributing on GitHub can contact them as well as the Co-Chairs.

The agenda was adopted as presented.

5.2 What is new: Use Cases Working Group and specification template

Use Cases Working Group. The Working Group announced at the previous meeting is now live and accepting submissions in the use cases repository. Use cases ground the work of the Focus Group in concrete situations, described in a common template, and are indexed in a small database that can be queried. To contribute, participants open a new issue with the template and add a row to the index table in the README. Several use cases had already been submitted before the announcement; the Chair thanked the community. Submissions from all sectors and perspectives are welcome. Next steps are to qualify and classify the submitted use cases; given the traction of this work, a dedicated session is envisaged at the Paris meeting.

Specification template. A common specification template is now available. Documents are written in reStructuredText (similar to Markdown, better suited to describing APIs) and compiled automatically into HTML and PDF in the FG-TIDA layout, so that contributors only write text. Each Working Group will have its own folder and repository; a dry run was done for Remote Attestation (published version). Readers can consult a specification directly online without downloading anything.

Questions and clarifications:

• Amir Banifatemi (Co-Chair) clarified that specifications will be attached to Working Groups once these are created; material gathered now will be sorted later.
• Islam Gouda asked whether a theme submitted as a GitHub issue had been posted or was awaiting assignment to a Working Group. The Chair explained that over 30 theme proposals have been received; a selection is presented at each call, an additional call was added on 14 October for this reason, and the presentations will inform the Working Group structure, to be fixed by 30 November.
• Duncan Sparrell (sFractal Consulting) asked whether there is a template for technical reports, as opposed to specifications. The Chair explained that the same template is used for all FG-TIDA documents, since the Focus Group does pre-standardization work; if a group decides to progress its work in a standards body, it would then follow the ITU route and templates, or those of the IETF, W3C or another relevant body.

5.3 Overall direction of the Focus Group

Patrice Lyons asked about the overall objective: use cases can be numerous and company-specific, and technical reports often have a specific technology in mind; is the aim interoperability across the spectrum, and would there be an overall specification coming out of ITU, for example for healthcare?

• Amir Banifatemi (Co-Chair) recalled that the Terms of Reference frame the effort: the Focus Group seeks to understand all aspects of digital, agentic and human identity in order to build an interoperable framework. The themes proposed so far are being presented in sequence so that the group can learn about them, identify overlaps and create the Working Groups to be announced on 30 November; those Working Groups will set the direction of the Focus Group. Domains such as healthcare, financial services and telecommunications will be taken into account, including regulatory and country-specific obligations, so that the proposals are broad enough to be adapted by all players. FG-TIDA is a Focus Group under ITU-T Study Group 17 (Security).
• Arnaud Taddei (SG17 Chair) added that the aim is to gather a rich set of use cases across all sectors to avoid blind spots in the foundations; the risk is rather to receive use cases outside the purview of ITU, and ten use cases had already been described within a short time. He noted that he was speaking from Tunis, after a telehealth meeting with Dr Bilel Jamoussi, in the presence of the WHO Head of Digital Health.

5.4 Delegation depth in multi-agent chains

Jon Rav Shende (Thales), new to the group, raised delegation depth as a potential blind spot: a human authorises an agent, which may invoke another agent, which may invoke a tool or service. At each hop, it must be clear whose authority is exercised, what was actually delegated, whether further delegation was permitted, and whether that authority is still valid. He suggested a use case testing identity and authority across a multi-agent delegation chain, based on audit challenges met in a previous role.

The Chair noted that these problems were already raised in several theme proposals and that the purpose of the consolidation is to create Working Groups broad enough to host them. Gianpaolo Angelo Scalone (Vodafone) indicated that his ITU-T work item on telco-grade identity (XSTR.ATHENA) links delegation to the identity and the purpose of the agent.

5.5 Theme presentations

Five theme proposals had been selected for this meeting, with about ten minutes each. Three were presented; the remaining two (#18 and #2) were deferred to 14 October for lack of time.

• Remote Attestation for Agentic AI — RA-AAI (Houda Labiod, Huawei; Henk Birkholz, Fraunhofer SIT) — themes #22; slides: "RA-AAI WG Roadmap v1.0". The mission proposed is to define open, interoperable and privacy-preserving standards for verifiable remote attestation of autonomous AI agents — their model, code, tools (MCP), data, policies and execution environments — so that any user can verify any agent from any environment. The core problem: today one can prove where code runs (confidential computing), but not what an agent is, which tools it can use and which policies constrain it; the trust surface now covers the platform, runtime, model, tools, policy, identity and behaviour. Agentic AI breaks traditional attestation: from a static binary hash to a dynamic, stateful agent with memory, tools and prompts; from a single model to a composite (model, code, tools, policy, data); from host-centric to delegation-centric trust (agent A must verify agent B before delegating); from infrastructure-only to provable behaviour and constraints; from one-time at boot to continuous attestation. The key user question is how a user giving an agent a credit card can know that it will not exfiltrate data or ignore their policy. Three questions structure the work: what, how and when to attest.
• In scope: an agent manifest as a standard signed artefact (EAT, JWT/CWT; for example a bill of materials); an attestation evidence profile binding infrastructure attestation (e.g. TDX, SEV-SNP, H100 quotes) to the manifest; a verification protocol by which a verifier (user, enterprise or another agent) validates evidence and establishes a secure channel; privacy-preserving disclosure; integration into agentic protocols. Out of scope: training attestation, data provenance (consumed, not defined), benchmarking and security evaluation, new TEE hardware design.
• Organisation: work item 0 (foundation and charter), work items 1–3 (what, how, when to attest) and work item 4 (liaison with SDOs: IETF, TCG, ITU-T, CCC, GlobalPlatform, W3C); governance by rough consensus, with co-chairs, empowered editors and a bi-weekly plenary.
• Approach: reuse IETF RATS building blocks (EAT, CMW, CoRIM, EAR), extend them with an agent profile, and resolve three integration questions — the trust vector, the discovery and conveyance of evidence inside A2A/MCP, and risk-keyed freshness tied to protocol events such as tool calls and delegation.
• Deliverables (preliminary): D1 charter and problem statement, with a state-of-the-art survey (IETF RATS/WIMSE/OAuth, TCG, GlobalPlatform); D2 agent attestation specification (manifest, evidence profile, verification); D3 privacy-preserving disclosure; D4 integration into agentic protocols; white papers, starting with one on RA challenges for AI agents; and events (workshops, webinars). The slides recalled that FG-TIDA is a pre-standardization platform: the artefacts can later be proposed to the most suitable SDO (IETF, ITU, GlobalPlatform, etc.), and any SDO can collaborate.

• The proposers invited feedback from participants interested in joining.

• Child-Aware Delegated Identity for Agentic AI (Gianpaolo Angelo Scalone, Vodafone) — themes #25 (Age-Aware Identity and Delegated Authority for Agentic AI). Core question: how can an AI agent know that it represents a child, and safely preserve that protection across services? Today a child moves across devices, agents and services (tutor, game, shopping, companion) while each interaction starts again as an unknown user: age is asked repeatedly, consent is fragmented, rules are inconsistent and revocation is not portable. The proposed trust model is to delegate protection, not personal data: (1) a trusted root — telco identity and an accountable guardian; (2) delegation of a child profile, parental authority and scope; (3) a minimal proof — age band or protection class, not full identity; (4) age-appropriate agent policy and permissions; (5) control through audit, update and revocation, with lifecycle feedback. An illustrative journey showed a parent setting a child profile, the telco identity issuing a signed, scoped, privacy-preserving credential, an AI tutor applying age-appropriate rules, a shopping agent inheriting the limits without re-collecting identity, and a guardian's policy change propagating. Five design principles: child first, data minimisation, explicit and auditable delegated authority, portability, and agency and remedy (correction, appeal, human escalation); the theme explicitly avoids a universal child identifier, persistent tracking and unnecessary correlation. Proposed scope for TIDA covers the identity and attribute model for a child profile, delegation, age-band assertions, consent/scope/expiry/revocation semantics, cross-agent portability, privacy and unlinkability, auditability, conflict handling across laws, human escalation and interfaces with policy enforcement layers. The decision requested from TIDA was to open a dedicated theme, framed as requirements, safeguards and interfaces rather than a product: "How can an AI agent reliably protect a child without needing to know who the child is?"

• The presentation opened a lively debate. In the discussion, the proposer confirmed that the theme also covers the case where the agent receives no attribute at all (client-side enforcement), and distinguished delegated authority (what an agent may do on the child's behalf: spending, consent, data sharing) from content delivery (what reaches the child), identifying the boundary between the two as an open question. Related themes: #10 (network-native governance) and #34 (ATHENA telco-grade identity and delegation architecture). The slides are available in the theme issue.

• Security framework and requirements for authorization and privilege lifecycle management of AI agents (Ying Wang and Ye Tao, China Unicom) — themes #23. The privileges of an AI agent are not static: they are created at initialization, adjusted as tasks evolve, suspended during hibernation, re-validated on activation and fully revoked at completion or termination. Authorization decides whether, when and to what extent an agent may exercise privileges; privilege lifecycle management governs the states those privileges pass through; the two are sequential and tightly coupled, within or across trust domains. The gap is that each lifecycle phase and each authorization dimension raises its own security challenges, and existing mechanisms do not yet provide a coherent, end-to-end approach. The expected output is an authorization framework covering the identified security dimensions, security requirements for each lifecycle phase, and cross-cutting governance requirements. The presentation showed a sequence diagram of the authorization process and a privilege lifecycle model with five phases: initialization (least privilege bound to a verifiable identity), change (real-time evaluation of any modification), hibernation (suspension and cryptographic isolation), activation (mandatory re-assessment before restoration) and revocation and recovery (irreversible, with cascading clean-up). The draft scope covers the threats to, and security requirements for, the authorization of AI agents and each phase of privilege lifecycle management; the underlying authorization protocols and infrastructure (OAuth, GNAP, X.1250-series IdM systems) are out of scope.

Follow-up questions on all three themes continue in the respective GitHub issues.

5.6 Items deferred to 14 October 2026

For lack of time, the two remaining theme presentations — themes #18 (Trustworthiness of multi-objective agentic AI: a collective-choice formalism, Arnaud Taddei) and themes #2 (Sovereign Discovery ++ Modularity) — and the short intervention by the SG17 Chair on how the ITU process works, should part of the FG-TIDA work later be progressed in ITU, could not be taken. It was agreed to take them at the additional virtual meeting of 14 October 2026.

5.7 AOB and next steps

The meeting closed shortly after the scheduled time. Participants were encouraged to continue the discussion on GitHub and the mailing list (fgtida@lists.itu.int). The Working Group structure is to be fixed by 30 November 2026, at the first in-person meeting in Paris.

Annex A — Schedule of FG-TIDA Preparation Meetings

Most recent meeting first.

First in-person meeting: 30 November – 1 December 2026, Paris (UNESCO), hosted by the French Ministry of the Interior.

Second in-person meeting: 26–27 January 2027, Geneva.

Annex B — Meeting Participants

Wednesday 30 September 2026 (14:00–15:31 CEST) — 144 participants, from the Microsoft Teams attendance report (169 connections, merged where the same person reconnected; up to 137 connected simultaneously). AI note-takers and interpretation bots (Leexi Assistant, read.ai, DeepL Voice) are omitted. Names as shown in Teams; affiliations added where known; (tbc) = to be confirmed.