Theme Name

Identity-behaviour-enforcement mismatch for AI agents (working group proposal)

Proposer(s)

Cyril Gorlla (CTGT), proposer of #6. The group joins #4 (Artur Hecker, Evangelos Haleplidis) and #6 under one problem, organized as a problem-based working group that hosts several paths.

Summary

A verified identity and a valid authorization say little about what an AI agent will do on a given task: an agent can pass every check and still act outside what it was authorized to do, its composition can change over its lifetime, and revoking its identity does not reliably stop the behaviour. This working group would study that mismatch and compare the paths that close it. The scope is bounded to one object: a single action, checked at the moment it is taken against a pinned, authored reference, producing a verdict a third party can recompute. Discovery, provenance of authority, collective choice and ecosystem response are handled elsewhere and feed into or consume that object.

Scope / Open Questions

• The problem. Terminology, threat cases, and the conditions under which identity-bound authorization, revocation and enforcement fail, grounded in submitted use cases. This includes revocation paths that do not depend on relying parties rechecking identity status, such as withdrawal of a binding under #29: an action attempted through a withdrawn binding is blocked, with the withdrawal recorded as the reason.
• Paths. Design-trait identity for metamorphing agents (#4, path one). Intent-expressed policy with verification at the moment of action (#4 path two, with #6). Further paths assessed against the same problem, such as the least-agency boundary raised on #4 and the cryptographic enforcement boundary in #26.
• The verdict. Its vocabulary (permit, remediate, block, escalate, indeterminate), adjudication when obligations collide, attested absence of evaluation, and how a relying party appraises a carried verdict.
• Evaluation. Shared fixtures on the UC-4 testbed. A first UC-4 mapping of TIDA6-FX v0.2 (the UC-17 slice) is prepared and under review; it has not yet been run.

Open: which paths are admitted at formation, and how the work is grouped into specifications. Both are for the group once constituted.

Related Work

OASIS XACML 3.0 and NIST SP 800-162 as the classical baseline; IRTF RFC 9315 (intent-based networking); IETF RATS (RFC 9334), EAT (RFC 9711) and AR4SI for attestation linkage; IETF WIMSE; ITU-T X.1285 for the identity layer assumed. Complements SG17 work items XSTR.magAI-behavior (#18) and X.aplm-aia (#23) without duplicating them.

Related Themes

• 5 decides whether the grantor could and did confer authority. This group decides whether the grant still binds for a given action at act time.

• 18 declares the collective-choice operator for a situation. This group checks each action against it, and returns indeterminate when aggregation has no winner.

• 29 decides whether a connection should exist and stay in force. This group checks the actions taken inside it.

• 13 consumes verdicts and reassessment signals across agents. #16 consumes escalated and indeterminate verdicts. #21 reads verdicts across a population. #1 records them.

• WG1 (remote attestation) carries the verdict as a behavioural claim.

Discussion

Draft charter text following CHARTER-TEMPLATE.md exists and can be posted when the management team is ready for charters. Comments welcome below.