Microsoft Corporation

Chicago IL US rdurga@microsoft.com https://orcid.org/0009-0003-7014-355X

Security Network Working Group AI Agents Model Context Protocol RFC 8785 JCS Zero Trust This document specifies a deterministic cryptographic verification profile for execution traces, delegation chains, and weight-custody manifests generated by autonomous artificial intelligence (AI) agents operating across Model Context Protocol (MCP), Agent-to-Agent (A2A), and enterprise system-of-record boundaries. The profile binds JSON Canonicalization Scheme (JCS, RFC 8785) pre-image serialization, Ed25519 (RFC 8032) and ECDSA P-256/P-384 signatures, JSON Web Key (JWK, RFC 7517) thumbprint pinning, and fail-closed revocation and freshness checks so that relying parties can independently verify whether an agent action was authorized prior to commit.

Introduction Autonomous AI agents increasingly invoke external tools, modify enterprise state, and delegate subtasks across multi-agent boundaries using protocols such as the Model Context Protocol (MCP) and Agent-to-Agent (A2A) transport envelopes. Without a deterministic, cryptographically verifiable execution receipt, a relying party cannot distinguish between a self-reported agent log and an independently verifiable commitment record. This specification formalizes the fail-closed verification invariants implemented in the open-source AgentTrust ("agentrust-io/trace-spec", "agentrust-io/agent-manifest", and "agentrust-io/weight-custody-manifest") conformance suites and empirically evaluated in , , and .

Conventions and Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Deterministic Pre-Image Canonicalization (RFC 8785 JCS) To prevent cross-language signature verification drift between Python, TypeScript/JavaScript, and Rust verifiers, every execution trace envelope MUST be serialized according to the JSON Canonicalization Scheme prior to digest calculation or signature verification:

• Non-string dictionary keys MUST be rejected with a deterministic type error rather than silently coerced.
• Lone UTF-16 surrogates (U+D800 through U+DFFF) and non-finite IEEE 754 floating-point values (NaN, +Infinity, -Infinity) MUST cause canonicalization to fail closed.
• Duplicate JSON object member names within signed payloads MUST be rejected during parsing before signature appraisal.

Strict Base64url and JWK Public-Key Hygiene Verifiers evaluating detached signatures, witness receipts, or JWK bundles MUST enforce canonical unpadded base64url encoding (Section 5 of ):

• Padding characters ("="), non-alphabet whitespace, or non-zero trailing pad bits MUST be rejected.
• Verification bundles MUST NOT contain private JWK parameters ("d", "p", "q", "dp", "dq", "qi", "oth"). Any trust bundle containing a private key parameter MUST be rejected immediately.
• JWK thumbprints and confirmation claims ("cnf.jwk") MUST be validated against the pinned trust store prior to revocation list evaluation.

Parent-Linked Delegation Chain Verification When an orchestrator agent delegates authority to a sub-agent, each hop record MUST include a "parent_record_hash" field containing the lowercase hexadecimal SHA-256 digest of the canonicalized parent record. A verifier evaluating an N-hop delegation chain MUST verify:

1. Cryptographic signature validity of every hop i in 0..N-1.
2. Hash continuity: hop[i].parent_record_hash == SHA256(JCS(hop[i-1])).
3. Scope attenuation: hop[i].granted_scopes is a strict subset of or equal to hop[i-1].granted_scopes.
4. Temporal monotonicity: hop[i].issued_at >= hop[i-1].issued_at and hop[i].expires_at <= hop[i-1].expires_at.

Security Considerations Verifiers that accept boolean literals as integer timestamps (for example, in runtimes where boolean is a subclass of integer) or that silently truncate recursive argument walks without flagging depth exhaustion introduce fail-open bypass vectors. Implementations MUST validate exact integer types for sequence numbers, epochs, and clock-skew bounds, and MUST fail closed when structural nesting bounds are exceeded.

IANA Considerations This document has no IANA actions.

References Normative References Informative References