[Theme] Trust and Identity Binding between Agentic AI and Embodied Systems

Theme Name

Trust and Identity Binding between Agentic AI and Embodied Systems

Proposer(s)

Haoran Deng, State Radio Monitoring Center of China

Summary

Embodied AI enables agentic AI to control robots, sensors, actuators, and other systems that produce effects in the physical world. Verifying an agent’s digital identity alone is insufficient; relying parties also need a verifiable binding among the agent, its runtime environment, the physical system, and the human or organizational authority behind its actions. Without such a binding, an authorized agent may act through a substituted or compromised device, while a trustworthy device may be controlled by an unauthorized agent.

As Clause 2 of the FG-TIDA Terms of Reference explicitly includes agentic AI when leveraged by embodied AI, FG-TIDA needs to examine the corresponding identity and trust requirements.

Scope / Open Questions

This theme proposes to focus on the following three areas.

Identity-binding models for agentic AI and embodied systems

Study how identities and relationships should be represented among the logical agent, foundation model, runtime environment, controller, and physical device, and how a relying party can determine which physical system an agent currently controls.

Key questions include:

• Which entities need distinct and verifiable identities?
• How should one-to-many, many-to-one, and dynamically changing relationships between agents and physical devices be represented?
• How can authorization to access a device be distinguished from actual control of that device?

Lifecycle management and trustworthy verification of the binding

Study how the binding between an agent and an embodied system is established, verified, updated, suspended, and revoked, including whether the binding remains valid when the model, software, firmware, controller, or physical components change.
Key questions include:

• Who should establish and attest the binding, and what identity or remote-attestation evidence is required?
• How can the authenticity, freshness, integrity, and replay resistance of binding evidence be ensured?
• How can agent impersonation, device substitution, identity cloning, control hijacking, and replay of obsolete bindings be detected?

Attribution of physical actions and cross-system interoperability

Study how a physical action can be reliably associated with a specific agent, runtime instance, physical device, and source of authority, and how the corresponding evidence can be interpreted across different vendors and trust domains.

Key questions include:

• What information must be recorded to establish which agent performed an action, through which device, and under what authority?
• How should attribution be handled in multi-agent, multi-device, and human-takeover scenarios?
  Are common evidence semantics, binding-assurance levels, and assessment criteria needed to enable cross-platform verification?

Potential Deliverables

Possible outputs of this theme could include:

• A set of use cases, a threat model, and a taxonomy of identity relationships between agents and embodied systems;
• Requirements for establishing, verifying, updating, suspending, revoking, and terminating an agent-to-embodiment binding;
• Minimum evidence, record-keeping requirements, assurance levels, and assessment criteria for binding verification and physical-action attribution;
• A gap analysis of existing identity, credential, device-attestation, and remote-attestation approaches, together with recommendations for future standardization and coordination.

Boundaries / Out of Scope

This theme would not address:

• Robot perception, world-model training, motion planning, closed-loop control, or the general performance of embodied AI;
• The development of new agent communication protocols;
• General AI governance or legal-liability frameworks;
• National device-registration systems or nationally determined identity content.

The theme is limited to identity, trust, authorization, attestation, interoperability, and technical accountability in embodied AI contexts.

Related Work

• FG-TIDA Terms of Reference, particularly Clause 2 concerning agentic AI leveraged by embodied AI, together with the deliverables on identity architectures, trust lifecycle management, interoperability, and assessment criteria.
• ITU-T Focus Group on Embodied AI for Multimedia Technologies (FG-EAI), which studies embodied AI capabilities such as physical-world understanding, learning, closed-loop control, and human-machine interaction. A possible boundary is that FG-EAI studies embodied intelligence capabilities, while FG-TIDA examines the associated identity and trust mechanisms.
• IETF RFC 9334, Remote ATtestation procedureS Architecture, which provides an architectural model for generating, conveying, and appraising attestation evidence.
• TCG DICE Attestation Architecture, which provides technical foundations for device identity and layered software-state attestation.
• GlobalPlatform device-attestation work, concerning trusted devices, secure components, and device-state attestation.
• W3C Decentralized Identifiers Core and the Verifiable Credentials Data Model 2.0, which provide general models for representing and exchanging verifiable identity claims.
• ITU-T X.509 and related public-key infrastructure work, which may provide building blocks for binding the identities of devices, operators, and other entities.

These existing efforts provide components for identity, credentials, device attestation, or runtime-state attestation. This theme would examine whether and how these components can jointly establish that a particular agent, acting under a particular authority, controlled a particular physical system in a verified state when an action occurred.

Related Themes

• Theme #12 — Agent Trust Mechanics: addresses credentials, runtime assurance, memory, and confidential computing within an agent. This theme would extend the trust relationship from the agent to the physical system.
• Theme #5 — Provenance of Authority for Agentic AI: addresses where an agent’s authority originates and how it travels. This theme would bind that authority to the physical execution chain.
• Theme #1 — Accountability and Attribution after an Agent Has Acted: addresses verifiable reconstruction after an action. This theme would contribute embodiment-specific identity, state, and evidence requirements.
• Theme #16 — Operational Human Oversight Integration for Agentic AI Trust Systems: addresses human intervention and control. This theme would examine identity and attribution when control shifts between a human and an agent.
• Theme #19 — Lifecycle-Wide Privacy Protection: provides relevant privacy and minimum-disclosure requirements for device identifiers, location, ownership, and physical-action records.

Discussion

The central question of this proposal is:

What evidence is required for a relying party to establish that a verifiably identified agent, acting under valid authority, controlled a particular physical system in a verified state when a particular action occurred?

This topic could develop as a standalone theme or as a dedicated workstream within broader work on the agent identity and trust stack, remote attestation, or trust lifecycle management.

Because the topic lies at the intersection of agentic AI trust and embodied systems, coordination with FG-EAI and relevant ITU-T Study Groups would be important. FG-TIDA should focus on identity and trust requirements, while avoiding duplication of work on perception, control, and general embodied-intelligence capabilities.

Contributions from experts in embodied AI, robotics, trusted computing, remote attestation, digital identity, IoT security, and human-machine collaboration would be particularly welcome.