FG-TIDA Interregnum Preparation Meeting — 4th Meeting

Source: FG-TIDA Co-Chairs

Date: Virtual, 14 October 2026

WG(s): All

Original: English

Contacts:

• Debora Comparin — Thales, France — debora.comparin@thalesgroup.com
• Amir Banifatemi — Cognizant, United States — amir@cognizant.com

Abstract

This document contains the agenda and minutes of the FG-TIDA 4th preparation meeting (virtual, 14 October 2026, 125 participants, up to 110 connected simultaneously), an additional meeting held during the "Interregnum" period between the launch of the Focus Group (9 July 2026, AI for Good Global Summit) and its first meeting (Paris, 30 November – 1 December 2026).

1. Introduction

This document contains the agenda and minutes of the 4th preparation meeting of the Focus Group on Trust and Identity for Humans and Agentic AI (FG-TIDA), held during the "Interregnum" period: the phase between the launch on 9 July 2026 at the AI for Good Global Summit and the first meeting in Paris on 30 November – 1 December 2026. During this phase, the structure, leadership, and initial deliverables of the Focus Group are prepared, for approval at the Paris meeting.

This additional meeting was convened to take the theme proposals that could not be presented on 30 September 2026 for lack of time (themes #2 and themes #18), together with further theme proposals. Five theme proposals were taken, in four presentations. The meeting also reviewed the practical arrangements for the first in-person meeting in Paris.

2. Meeting Overview

3. Agenda

1. Opening remarks and agenda adoption
2. Plans for the first in-person meeting (Paris, UNESCO building, 30 November – 1 December 2026)
3. What is new since the last call (30 September 2026)
4. Theme proposals — five selected presentations
5. AOB and agreement on next steps

4. Actions

• Debora Comparin, Amir Banifatemi and the Secretariat to publish the finalized Paris meeting agenda by 30 October 2026, to manage registration, logistics and communications for the Paris meeting, and to post the link to the practical information document in the chat and on GitHub.
• All participants intending to attend in Paris to register through the online form by 20 November 2026; seats are limited.
• Henk Birkholz to support the cross-Working Group terminology work, to be introduced at the meeting of 4 November 2026.
• Participants who cannot access GitHub to request access to the GitLab mirror from the FG-TIDA Secretariat (tsbfgtida@itu.int).
• King Yew Choo to send Debora Comparin an email on the seller-side payments question; proposals for new themes or use cases to follow the GitHub procedure.
• Nic Williams to add the points raised in the discussion to themes #2, so that the scope of the deliverables is clear (done on 14 October 2026).
• Ward Duchamps, Iván Abril Palma and Nelson T. to refine the scope of themes #13, taking into account the comments received in the discussion, in the chat and on GitHub, as a basis for the discussion in Paris (first update posted on 15 October 2026).
• Pam Dixon to post the use case on standing delegation and notify the proposers of themes #13, for analysis against their proposal.
• All presenters, including Anto Budiardjo (themes #29) and Arnaud Taddei and Pam Dixon (themes #18 and #5), to send their presentation materials to Debora Comparin by email; Debora Comparin to add them to GitHub with the minutes.
• Arnaud Taddei, Pam Dixon and Cyril Gorlla to discuss offline the composition of themes #18, #5 and #6 (joint Working Group proposal #36).
• All participants with an idea for a Working Group, including on regulatory and government aspects, to log it as an issue in the themes repository, and to use GitHub rather than email for proposals and requests, ahead of the convergence on Working Groups by 30 November 2026.

5. Discussion Summary

5.1 Opening remarks and agenda adoption

Before the start of the meeting, King Yew Choo (True Primary) raised a question on payments for the Paris meeting, following an email of 6 October 2026 to the Co-Chairs: what a seller should check before it starts paid work for an AI agent — the seller side of the example given on 30 September 2026 of a user handing a credit card to an agent — noting that the Terms of Reference list payments among the deliverables. The Chair replied that new themes are not taken on the fly: themes and use cases are submitted on GitHub, the management team selects them and invites proposers to present at each call. He was invited to send an email and to follow the GitHub procedure. Another participant was likewise asked to use GitHub, tagging the Chair, or to write to the Secretariat.

Since Sounil Yu (Vice-Chair) was travelling at the start of the call, Frank Van Damme (Thales) managed admissions. The Chair noted that the leadership had received an overwhelming number of emails and asked participants to use GitHub as much as possible, so that everything is recorded, the process is fair for everybody and requests are easier to handle.

The agenda was adopted as presented.

5.2 Plans for the first in-person meeting in Paris

The Chair recalled that the Interregnum calls are informal, community-building meetings preparing the structure of the work and the Working Groups. The first official in-person meeting of FG-TIDA will be held on 30 November – 1 December 2026 at the UNESCO building in central Paris, hosted by the French Ministry of the Interior. A collective letter has been sent to ITU members, and the official information has also been sent by email to non-members. Registration through the online form is mandatory to access the meeting; the deadline is 20 November 2026, as seats are limited and lunches and dinners are being organized. The finalized agenda will be published by 30 October 2026. A practical information document (hotel, visa, transportation, weather, access to the building) is linked from the meeting slides, which are available in the GitHub repository with the meeting minutes; participants were asked to check it before writing to the leadership.

• Richard Kerkdijk (TNO) asked what the two days would consist of. The Chair explained that the formalization part — the announcement of the Working Groups, their charters and their chairs — will be short, and that the rest of the two days will be dedicated to progressing the work. The 28 theme proposals will feed into a smaller number of Working Groups, as initial proposals for specifications or technical reports; each Working Group will have slots organized by its chairs, with presentations and working sessions. There will also be special sessions on selected use cases, to keep the work grounded, and a cross-Working Group session on terminology, to give the community a common language; ideas on terminology will be presented at the next call. Amir Banifatemi (Co-Chair) added that the two days may also surface additional input not yet captured, and that the next phases of the Focus Group will be discussed in the following months.
• Justin Philip Flores (Himalogic) asked whether the meeting will be held in the UNESCO headquarters building itself, having seen conflicting information; the Chair confirmed and referred to the practical information document for the address and access details.
• Henk Birkholz (Fraunhofer SIT) volunteered to help with the cross-Working Group terminology work; the offer was noted.

5.3 What is new since the last call

GitLab mirror. Since not every country can access GitHub, and to keep the work inclusive, the FG-TIDA repositories are now mirrored on the ITU GitLab (https://www.itu.int/itad/gitlab/). GitHub remains the master; contributions made on either platform are automatically mirrored to the other. Participants who cannot access GitHub should first create a GitLab account, then request access from the FG-TIDA Secretariat (tsbfgtida@itu.int), giving the reason for the request and the email address to be granted access. The mirror is operational; instructions were also sent by email.

Generic FG-TIDA presentation. As many participants already present FG-TIDA to colleagues, a generic FG-TIDA slide deck has been added to a new folder in GitHub, for reuse so that presenters do not start from scratch.

5.4 Theme presentations

Five theme proposals had been selected. They were taken in four presentations, themes #18 and #5 being presented jointly; since Arnaud Taddei was delayed by another meeting, themes #13 and #29 were taken before themes #18 and #5.

5.4.1 Sovereign Discovery ++ Modularity (Nic Williams, Infoblox) — themes #2

Presented without slides. Many FG-TIDA themes — evaluating the trustworthiness of model outputs, delegation authority, verifying that a human is in the loop — take for granted that a model can find another model. Citing recent restrictions of access to a frontier AI model as a wake-up call, the proposer warned against a future in which a single search entity correlates all models and mediates every interaction between agents, which he described as a sovereignty issue. Discovery covers not only agents but also tool servers, resources and data stores, and needs to be insulated from compulsion: as on today's Internet, where a website can be reached through a search engine, a domain name or an IP address, a client should have several ways to reach an agent, including out of band. FG-TIDA should have an opinion on trust, but as a framework with extensions, since requirements differ (for example, DNSSEC validation is not deployed in every country); each country or organization should be able to decide what it considers trustworthy. Discovery is not a Working Group by itself, but a prerequisite for agentic interactions: the proposer suggested a "foundations" Working Group hosting three or four load-bearing themes, such as discovery and taxonomy/terminology, and invited feedback on whether this is a good idea or whether discovery is considered a solved problem.

The discussion raised strong interest:

• Henk Birkholz (Fraunhofer SIT) asked whether trust is essentially a decision, such as which certification paths are in a trust anchor store. The proposer agreed: if ITU-T or the Focus Group has no opinion on the data types to include and on what trust looks like, the community will end up with a default answer it may not like, or depend on another party to provide it. The harder problem is a framework in which agents meeting different national requirements — for example, one country requiring agents to be bound to a national ID — can still interact, as was done for telephone numbers. In the chat, Henk Birkholz noted that trust and trustworthiness are often conflated, which makes terminology a north star for the group, and Abbie called for metrics enabling participants to make a trust decision, trust being relative and varying per transaction.
• Islam Gouda asked how trust could be conceptualized and measured within a government, a city or an organization. The proposer answered that a trustworthy agent rests on provenance: data observed over a sufficiently long period, backed by assertions and attestations that are hard to forge or alter; some can be cryptographically anchored, others rely on human-in-the-loop or organizational trust, and any compelling trust framework will combine several facets.
• Pam Dixon (World Privacy Forum) pointed to themes #5 and its charter on provenance of authority, which lay the groundwork for this, and noted that the OpenTelemetry work on spans and traces already quantifies much of what was described; discovery would need to interface with it.
• Venkatesh Subramanian (Cognizant) asked whether the scope covered trust within an organization, across organizations or across the Internet. The proposer preferred to start with the Internet and with collaborating organizations, every company having its own view of its internal network.
• A participant asked how discovery could be separated from trust establishment, and what interoperability gap existing discovery mechanisms cannot address across sovereign trust domains. The proposer described destination authorization: today nothing stops a client from reaching any resource it can route to, whereas an agent should be able to state why it needs a resource for a task — much as a no-fly list is applied when a ticket is bought rather than at airport security. Sovereign trust entities could exchange metadata expressing permissible behaviours, discovery being the natural control point for enforcement; existing mechanisms solve outbound discovery and inbound attestation, but not the bridge between them.
• Amir Banifatemi (Co-Chair) suggested covering evaluation and investigation beyond discovery: enforcement and remediation differ between jurisdictions, and the behaviour of LLM-based agents changes over time, so a positive first evaluation at discovery needs to be followed by continued governance. In the chat, Cyril Gorlla (CTGT) and Justin Philip Flores (Himalogic) supported this point. The proposer welcomed contributions to widen the scope.

The Chair asked the proposer to add the points of the discussion to the GitHub issue, so that the scope of the deliverables is clear.

5.4.2 Ecosystem-level Agent Defense (Ward Duchamps, Thales; Iván Abril Palma, Integral Management Society; Nelson T.) — themes #13

Ward Duchamps introduced agents as a new species that will vastly outnumber humans. Recent incidents show that agents can escape their isolation and tend to collaborate, which creates new risks — miscoordination, conflict, collusion, organized mission drift — up to an ecosystem that fails while every participant appears to act correctly. The theme aims at a self-regulating ecosystem in which independent participants help detect, share and contain ecosystem-level failures: incidents will still happen, but they should be identified fast and their blast radius contained. The proposed architecture has three layers exchanging shared objects, plus a reusable testbed:

• F1 — Distributed sensing: capturing signals of trouble across the ecosystem and managing the lifecycle of each signal from birth to resolution.
• F2 — Collective interpretation (ecosystem awareness), presented by Iván Abril Palma: combining signals, blind spots and uncertain observations of agents that keep changing their rules and behaviour, without a "giant brain" (through distributed, centralized or mixed computation), so as to return requalified context to the other layers. Unlike a pool of alerts or population statistics, ecosystem awareness extracts new information from the context. The main challenge is to share a minimal collective map among potentially competing or deceptive agents without the map itself becoming a source of harm.
• F3 — Response coordination, presented by Nelson T.: who is authorized to step in, the response deadline and the fallback if no response comes. Objections and missed deadlines are recorded; a missed deadline triggers the agreed fallback without automatically implying fault. A decision, an acknowledgement, an attempted action and the observed effect (including recovery) are distinguished. Depending on the situation and local authority, actions range from monitoring and additional authentication to restricting access, revoking permissions, isolating a component or stopping an activity.
• UC4 testbed: tests F1, F2 and F3 individually or together through controlled experiments and counter-tests, with traceable setups, evidence and results. It also supports the research of other themes, whose experiments may in turn inform theme #13, in agreement with their source authors.

Ward Duchamps concluded that the challenge is to teach agents how to behave and to judge their behaviour, delegating part of this teaching and judging to the agents themselves.

Discussion:

• Sounil Yu (Vice-Chair) noted that any writable surface on the Internet is a channel for communication, and asked whether the scope should first be bounded to the sensing problem, since the rest of the stack depends on it. Iván Abril Palma answered that this is still a research question; communications could be qualified and categorized (epistemic hand-off descriptors), and collective interpretation could still detect, later, an attack such as one carried out through shared artifacts on a model-hosting platform, by pooling the doubts of many agents. Ward Duchamps agreed that sensing is the most important problem and possibly the starting point for standardization, but that sensing alone brings no value: the complete value chain must be built. Sounil Yu pointed to the chat, including a comment by Jon Rav Shende, suggesting to bound something other than every possible channel, to keep the scope realistic.
• Tirath Ramdas compared the approach with existing threat-intelligence sharing platforms. Nelson T. explained that the testbed fixes variables so that experiments on F1, F2 and F3 can be measured against an oracle.
• Pam Dixon (World Privacy Forum) raised a complicating use case: a user confers standing delegation to the company running the agents, which then confers it to every act of the ensuing agents, making each act legally binding in any jurisdiction and undermining any binding model. She will post the use case and ping the proposers, who welcomed it.

The Chair noted the record level of engagement of this theme on GitHub, asked the proposers to refine its scope with the comments received, and indicated that the topic will be resumed in Paris.

5.4.3 The Should Problem: governed connection decisions across organisational boundaries (Anto Budiardjo, Padi) — themes #29

Technology tends to focus on what systems can do rather than whether they should do it. The proposer presented CNS/CP, an open-source technology developed in a working group of OSTERA, using its public website. CNS/CP decides whether two systems may connect and on what terms. It sits as a connection layer between an identity layer (X.509 and other identity systems) and an application layer (protocols such as MCP for agents, or Modbus and BACnet in the field). Key concepts are:

• Node — in agentic AI, an agent; context — the role in which a node operates.
• Connection profile — a named, immutable document in a single registry, somewhat like DNS; but while DNS names endpoints, connection profiles name what happens between two entities, always in the roles of provider and consumer.
• Realm and governor — the realm bounds all systems and connections; the governor sets the policy inside it.
• A six-step process in two phases: admission — enroll (a node asserts its identity to the governor, which checks it with identity providers of its choice), authorize (the governor accepts the context claimed by the node), declare (the node states which profiles it can provide or consume) — and operation — reconcile (matching profiles and contexts), bind (a direct binding between the two nodes) and operate (exchange of the properties and channel defined by the profile). When either end withdraws its declaration, the binding stops, and a record of what happened over the connection is kept.

The example shown was a card reader and an HVAC unit sharing occupancy data.

Discussion:

• Jon Rav Shende (Thales) asked how CNS/CP addresses indirect communication through shared artifacts or data stores, and what prevents agents from bypassing the governor. The proposer answered that nothing prevents agents from communicating outside the realm: CNS/CP governs the connection and checks that it should exist; what happens inside it is constrained to the paths defined by the connection profile, which can be far richer than the example, including negotiation between the two ends.
• Cyril Gorlla (CTGT), proposer of themes #6, saw a clean split: theme #29 decides whether a connection should exist and stay in force, while theme #6 checks each action inside the binding against declared intent, with a verdict a third party can recompute.

The Chair asked all presenters to send their materials by email for inclusion in GitHub with the minutes.

5.4.4 Trustworthiness of multi-objective agentic AI and Provenance of Authority — joint presentation (Arnaud Taddei, SG17 Chair; Pam Dixon, World Privacy Forum) — themes #18 and themes #5 / PR #15

Slides: "Seeing what a population of agents decides — a control plane for trustworthy multi-objective agentic AI" (v4.1), linked to the ITU-T work item XSTR.magAI-behavior (Question 16/17) and building on Pam Dixon's talk at the SG17 workshop (Geneva, 9 July 2026). As screen sharing failed, the Chair displayed the deck. With ten minutes available for 24 slides, the presentation covered slides 1 to 11.

• The black box (Arnaud Taddei). Inside a population of multi-objective agents, three things are decided and never written down: who is grouped with whom, how the group aggregates conflicting objectives, and who may change either. The box need not be opened; it needs to declare these three things and emit what it does, so that the gap can be measured: trustworthiness of agentic AI = declared rules + observable behaviour + a measurable gap between the two.
• Example system. Using a simplified 6G architecture, in which the control plane is implemented by agents, the presenters showed the trust stack the control plane needs, designed bottom-up and audited top-down: identity, provenance of authority, authored grouping, choice regime and mode, a named operator, the declaration, telemetry, measurement and the decision on whether an action is admissible now. The running scenario is a data centre going down, with agents ranking four actions (fail over, degrade, isolate, shut down) differently and having to output one.
• Telemetry (Pam Dixon). OpenTelemetry, an open standard developed by a very large community, records every agent invocation and act as spans and traces: who acted, when and on whose call. This provides a baseline registry of actions, but does not say which group was authorized to act, which operator was declared, or who may change them.
• Who is grouped (Pam Dixon). Agentic AI acts on clusters, and Kleinberg's impossibility theorem binds such systems: no clustering method has all the desirable properties, so clusters must be authored, not discovered, and the question moves up the chain to who has the authority, under what provenance, to author which groups — "you cannot calm the ocean by raking the sand": content moderation rakes the sand, fixing the grouping before clustering calms the ocean. Federation-of-agents structures, with an orchestrator routing and checking policy, show that this works, provided every grouping carries who authored it, under what mandate, how it can be contested and when it can be revised, verified at assignment, at composition and at re-advertisement, since groups are assembled at runtime.
• Provenance of Authority (Pam Dixon). Standing of authority is one property with two determinations: at origination, whether the grantor could and did confer; at act time, whether the grant continues to bind — both under the legal regime governing the mandate, and neither established downstream by an artifact. Without provenance of authority at the protocol layer, no legislation or instruction can reach the agents.
• How a group chooses (Arnaud Taddei). Treating the criteria (resilience, safety, security, robustness, accountability) as voters with fixed rankings over the four actions, plurality selects "shut down", Borda selects "fail over" (the least contentious option), and pairwise (Condorcet) comparison yields a cycle with no winner, in which case the agentic system cannot decide. Nobody changed their mind; only the aggregation changed. Arrow's impossibility theorem (1951) explains why no rule escapes these trade-offs; in practice, dictatorship behaviours, where some agents force their choice on others, are already observed.
• Wrap-up. Theme #18 proposes a list of interoperable methods for the future agentic control plane, grounded in mathematics and in declaration, which could also help regulators see which kind of regulation applies to which construct of agentic AI. Pam Dixon added that the impossibility theorems cannot be escaped; the variables have to be controlled beforehand.

Discussion:

• Islam Gouda asked where the human element sits in governance. Arnaud Taddei answered that many kinds of humans may be in the loop (for a 6G network: operations, traffic, rating, customer relations), and that the approach precisely avoids needing one human per agent: through declared groupings, one human can oversee a group of agents, and collective-choice theory gives ways to understand and manage clashes — for instance through a trustworthiness policy stating which collective-choice operator applies in which circumstances, for regulatory, business or other reasons. Pam Dixon added that humans determine the norms, but they need to be written into the protocol layer (such as A2A), where clustering happens, so that the protocol layer is normatively decided rather than a free-for-all.
• Cyril Gorlla (CTGT) noted that the declared policies (in these circumstances, this operator) are exactly what theme #6 checks each action against, and that a cycle with no winner would return an indeterminate verdict rather than a forced one; he offered to help. Arnaud Taddei welcomed the composition and proposed to discuss it offline; Pam Dixon recalled that theme #6 consumes theme #5, and would in turn connect to theme #18.
• Iván Abril Palma recalled the undecidability results for sufficiently complex systems (Turing, Gödel): cycles such as the one presented cannot be resolved, which is where dictator behaviours appear; composing this residual uncertainty would feed the broader uncertainty map of ecosystem awareness (theme #13). Arnaud Taddei added that measurement is essential: even if agents apply the declared operator, an adversary who understands the collective-choice problem could force a drift from one operator to another, much like an attack on an election.

5.5 AOB and next steps

Manuel Costa Cabral (ANACOM) asked whether a topic or Working Group on regulatory and government issues is being considered. The Chair replied that nothing has been decided: anyone with an idea for a Working Group should log it as an issue on GitHub, to be selected and presented for early feedback; the brainstorming continues until 30 November 2026, when the community will converge on the Working Groups.

The short intervention by the SG17 Chair on the ITU process, deferred from 30 September 2026, was not taken at this meeting.

The Chair thanked the presenters and participants. The next call, on 4 November 2026, will be the last Interregnum call before the Paris meeting. Questions can be addressed to the Co-Chairs or the Secretariat.

Annex A — Schedule of FG-TIDA Preparation Meetings

Most recent meeting first.

First in-person meeting: 30 November – 1 December 2026, Paris (UNESCO), hosted by the French Ministry of the Interior.

Second in-person meeting: 26–27 January 2027, Geneva.

Annex B — Meeting Participants

Wednesday 14 October 2026 (15:00–16:30 CEST) — 125 participants, from the Microsoft Teams attendance report (147 connections, merged where the same person reconnected; up to 110 connected simultaneously). AI note-takers (Leexi Assistant, read.ai, Otter.ai) and invitees with no recorded connection are omitted. Names as shown in Teams; affiliations added where known; (tbc) = to be confirmed.