The Should Problem: whether a particular connection between two parties should be formed, and stay in force

Proposer(s)

Anto Budiardjo, Padi

Summary

Agent communication, authentication and authorization mechanisms address important parts of an interaction, but do not by themselves provide a common account of why a particular governed connection should be formed and remain in force: who admitted each party, under what rules, for how long, and what happens when any of that changes. This theme proposes that the decision to connect be treated as an object of standardisation. It would be declared in a form a counterparty can read, made under identifiable rules by an identifiable party, accompanied by a defined account of what evidence a counterparty can inspect, bounded in time, and given defined behaviour when it changes. It matters because the FG's own framing asks whether, and under what conditions, an entity should be trusted to act, and today the answer lives in a bilateral agreement, a configuration file, or someone's head, and is rarely legible to the other party.

Scope / Open Questions

• What is declared: what a party states about the interaction it is prepared to enter, including the roles involved and the terms.
• Who decides: which party or process admits each party and applies the rules, and how the other side can tell.
• What evidence is available to a counterparty about that decision, and how much of it must be inspectable rather than taken on trust.
• How long permission lasts, and what freshness a counterparty can rely on.
• What happens when it changes: expiry, amendment or withdrawal while the connection is live.
• Which common conventions and trust relationships are minimally necessary across organisations and jurisdictions.

The theme does not propose to answer whether a given connection is safe, lawful or wise, and it claims no execution authority. It does not issue or verify identity; it consumes an authenticated identity from whatever infrastructure the parties already use. It also does not assume that shared conventions remove the need for one party to have a basis for trusting the other's assertions. Part of the work is finding the minimum common conventions and trust relationships that organisations need to share.

Related work that may be needed as the theme develops: how conformance is demonstrated, how any shared registry or naming infrastructure is governed, and which domains need their own conventions and who writes them.

Related Work

Agent communication and access mechanisms that address parts of an interaction: MCP, A2A, OAuth 2.0 (RFC 6749), TLS 1.3 (RFC 8446).

I lead the work on CNS/CP (Connectivity Naming System using Connection Profiles), which is being started at OSTERA and is one candidate approach to this problem. It pairs named, resolvable Connection Profiles that describe an interaction with a governed process by which a Node is admitted and authorized and complementary Capabilities are bound under a Realm's published rules. The specification and a reference implementation (Project Arete) are open at cnscp.io. I am not asking the FG to adopt it. I am asking that the problem be recognised as in scope, and that any approach, this one included, be tested against the questions above.

Related Themes

5 covers where an agent's authority originates and how it travels.

9 is a joint thread on authority that was never clearly authored, examining a difficult case across #5, #6 and #1.

6 asks whether an action matches declared intent.

1 reconstructs accountability after an agent has acted.

Discussion