[Theme] Completeness and Coordination of FG-TIDA standardization activities

Theme Name

Completeness and Coordination of FG-TIDA standardization activities

Proposer(s)

Rémy F.
IN Groupe

Summary

The uptake of AI Agent identity requires the preparation of the necessary supporting technical documentation, including technical reports, specifications, standards and implementation guidance, to ensure interoperable use.
This is one of the goals of the FG-TIDA which has been established. ToR

The current structuring of activities from FG-TIDA follows a bottom-up approach, starting from concrete themes and use cases collected from all stakeholders. This approach ensures close alignment with industrial and user needs and contributes to the high relevance and practical value of the FG-TIDA activities.

Long-term sustainability also requires a complementary top-down view of the standardization needs associated with AI agent identity and trust. This view should help FG-TIDA organize its work, assess completeness, identify gaps, coordinate related themes and use cases, and clarify interfaces with other standards development organizations.

First, thanks to that identification and description it will be possible to better coordinate FG-TIDA activities with other SDOs also working on the AI Agent identity topic (or related matter) to identify overlap and complementarity, and thus ultimately organise coordination.
Secondly, by mapping onto these identification and description the current activities of FG-TIDA (themes and use cases) it will be possible to better manage internal work by:

• Identifying area which are properly covered;
• Identifying gaps in the standardisation activities which should deserve specific activities;
• Identifying themes or use cases for which a particular coordination is needed as they either overlap or overlap different standardisation needs;

Ultimately, it will be very useful to ensure the completeness of the FG-TIDA activities and be able to demonstrate it outside FG-TIDA.

A first analysis shows that the overall standardisation needs to be addressed for the uptake of AI Agent Identity could be structured around the following topics:

• Terminology;
• Identity;
• Authority;
• Policy;
• Runtime;
• Evidence;
• Governance technical requirements;

Scope

As part of this theme, the following aspects could be further analysed:

• Identify and describe the standardisation needs associated with AI Agent Identity organised around a shared set of topics;
• Analyse and map of the relevant activities carried out by the other relevant standards development organisations (SDOs) and related initiatives;
• Map the FG-TIDA themes and use cases selected by FG-TIDA according to these topics;
• Identify overlaps and complementarities, dependencies with other SDOs;
• Identify gaps within FG-TIDA activities;
• Identify themes or use cases for which a particular coordination is needed as they either overlap or overlap different standardisation needs;
• Prepare recommendation regarding themes and use cases, that may require standardisations coordination, contributions or liaison activities within FG-TIDA or with other SDOs.

Out of Scope

This theme will not replace the technical work carried out within individual FG-TIDA themes, define the detailed requirements of those themes, or decide which external standard should be adopted. Its role is to provide a common landscape, coverage analysis and coordination framework that supports decisions by the relevant FG-TIDA governance and technical groups.

Objectives / Deliverables

1. Standardisation Needs Framework
   A structured description of the standardization needs for AI agent identity and trust, initially organized around terminology, identity, authority, policy, runtime, evidence and governance technical requirements.

2. FG-TIDA Coverage Map
   A mapping of FG-TIDA themes and use cases to the standardization needs framework, including primary and secondary coverage.

3. External Standards Landscape
   A mapping of relevant activities in other standards development organizations and related initiatives, with identified scope, maturity and relationship to FG-TIDA work.

4. Overlap, Dependency and Coordination Matrix
   An analysis of themes and use cases that overlap, depend on one another, or span multiple standardization needs and therefore require explicit coordination.

5. Gap Analysis
   A documented assessment of standardization needs that are not covered, are only partly covered, or lack an identified owner or external coordination path.

6. Recommendations
   Recommendations concerning themes or new use cases coordination for standardization contributions, liaison priorities, sequencing and areas requiring further discussion.

7. External Completeness Narrative
   A concise explanation of how FG-TIDA activities collectively address the standardization needs for interoperable AI agent identity and trust, including clearly stated boundaries and dependencies

Related Work

Relevant external work includes activities concerning AI, digital identity, trust services, authorization, attestation, software and AI supply chains, governance and interoperability in other SDOs.

The analysis should also consider applicable regulatory and assurance frameworks where they create technical standardization needs or coordination requirements.

Related Themes

This theme is horizontal and relates to the full FG-TIDA portfolio. The following themes are particularly relevant because they represent major areas of the proposed standardisation-needs framework:

• #32 — Terminology: Terminology provides the common vocabulary and definitions needed to describe the standardization landscape consistently.

• #5 — Provenance of Authority for Agentic AI: covers where agent authority originates, what a grant contains and how authority and restrictions travel. It is a primary reference for the authority topic.

• #22 — Remote Attestation for Agentic AI: examines what agent state should be attested, how it should be attested and when appraisal is required. It is a primary reference for the runtime and evidence topics.

• #23 — Security framework and requirements for authorisation and privilege lifecycle management of AI agents: addresses authorisation decisions and the lifecycle of agent privileges. It spans the authority, policy, runtime and governance technical requirements topics.

• #35 — Supply Chain: addresses models, datasets, software dependencies, provenance and changes across the AI supply chain. It contributes to the identity, runtime, evidence and governance technical requirements topics.

• #36 — Identity-behaviour-enforcement mismatch for AI agents: links identity, authored references, behavioural evaluation and runtime enforcement around a specific action. It spans the identity, policy, runtime and evidence topics and is a strong example of a theme requiring cross-topic coordination.

• #1 — Accountability and attribution after an agent has acted: addresses the records required to reconstruct which agent acted, under which authority and within which scope. It is a primary reference for the evidence and governance technical requirements topics.

• #10 — Network-Native Governance and Trust Enforcement for Agentic AI: addresses continuous governance, monitoring, revocation, enforcement and audit. It is a primary reference for governance technical requirements and also spans authority, policy and runtime.

• #29 — The Should Problem: governed connection decisions across organisational boundaries: addresses whether a governed connection should be established and remain in force, including the evidence available to counterparties. It spans the authority, policy, evidence and governance technical requirements topics.

Other themes and use cases should be included in the coverage map as the framework develops. The relationships above identify the most direct interfaces and do not imply exclusive ownership of any topic.

Open Questions

1. Are terminology, identity, authority, policy, runtime, evidence and governance technical requirements the right top-level topics, or should the framework include additional or differently grouped areas?
2. What criteria should be used to determine whether a standardization need is fully covered, partly covered, externally covered or not covered?
3. How should primary coverage, secondary coverage, dependencies and overlaps be represented without implying ownership that has not been agreed?
4. Which external organizations and work items should be included in the first standards-landscape mapping, and how should maturity and liaison priority be assessed?
5. How should the mapping be governed, reviewed and updated so that it remains useful throughout the lifetime of FG-TIDA?