Pith. sign in

REVIEW 4 major objections 8 minor 5 cited by

A Novel Zero-Trust Identity Framework for Agentic AI: Decentralized Authentication and Fine-Grained Access Control

T0 review · 4 major / 8 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper contends that current IAM protocols cannot govern autonomous agents and proposes a DID- and VC-based framework with a cross-protocol global session layer for real-time revocation.

desk verdict A coherent position paper on agentic IAM whose only truly new piece, cross-protocol session management, is also the least supported. read the letter →

arxiv 2505.19301 v2 pith:B42CEDMD submitted 2025-05-25 cs.CR cs.AIcs.MA

Ken Huang , Vineeth Sai Narajala , John Yeoh , Jason Ross , Ramesh Raskar , Youssef Harkati , Jerry Huang , Idan Habler
show 1 more author
Chris Hughes
This is my paper
classification cs.CRcs.AIcs.MA
keywords AgenticAIIdentityandaccessmanagementMulti-agentsystemsDecentralizedidentifiersVerifiablecredentialsZero-knowledgeproofsAgentNameServiceSession
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that identity and access management protocols built for human users and static machine accounts, such as OAuth 2.0, OpenID Connect, and SAML, cannot safely govern autonomous AI agents that are created and destroyed quickly, delegate authority to sub-agents, and communicate over different protocols. It proposes a purpose-built framework in which each agent holds a decentralized identifier (DID) plus verifiable credentials that attest to its capabilities, provenance, and security posture, and in which discovery is capability-aware rather than name-only. The claim is that this combination, together with a global session-management and policy-enforcement layer, can deliver the real-time revocation and consistent authorization that multi-agent systems require. If the paper is right, secure deployments of heterogeneous autonomous agents will need identity capabilities beyond current human-centric IAM standards.

What carries the argument

The central object is the Agent ID: a DID-anchored, VC-enriched identity profile that includes a cryptographic root, controller and provenance information, a machine-readable scope of behavior, an authorized toolset, and lifecycle status. The load-bearing mechanism is the unified global session management layer, composed of a logically centralized Session Authority, a distributed Session State Synchronizer that keeps a real-time ledger of active global sessions, and Adapter Enforcement Middleware that hooks into protocol adapters for A2A, MCP, and HTTP to enforce local decisions and terminate sessions on global revocation. The Agent Naming Service links a structured naming convention to DIDs, making discovery capability-aware, while the session layer is what makes the framework's revocation differentiator work.

What would settle it

Measure end-to-end revocation latency in a testbed with thousands of ephemeral agents holding concurrent sessions over A2A, MCP, and HTTP, timing from a global logout command at the session authority until the last adapter blocks a request; if that latency exceeds the application's session-consistency requirement, or if any adapter continues to accept requests from a terminated session under normal operation, the framework's core differentiator fails.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central claim is that a new IAM paradigm is necessary, not merely an extension of existing protocols. The authors contend that OAuth 2.0, OpenID Connect, and SAML fail for multi-agent systems because they assume a single, persistent principal; they grant coarse-grained, static scopes; they cannot model delegated authority chains; and they lack global consistency when an agent's permissions must be revoked across every protocol at once. The proposed architecture anchors each agent in a DID and supplements it with cryptographically signed verifiable credentials for role, capability, provenance, and compliance, enables zero-knowledge proof presentations to limit disclosure, uses an Agent Naming Service for capability-aware discovery, and adds a unified session authority with adapter middleware so revocation and policy changes propagate across agent protocols in near-real time. The paper presents this as the foundational trust infrastructure for agentic AI.

Load-bearing premise

The framework collapses if a logically centralized session authority and a distributed state synchronizer cannot propagate global revocations and policy changes across heterogeneous protocols in real time without unacceptable latency or inconsistency, and the paper itself defers scalability and performance validation to future work.

Editorial extensions

If this is right

  • Enterprises deploying multi-agent systems will need an IAM layer that issues and revokes agent-level credentials rather than human-scoped tokens before agents can safely access APIs and data.
  • Capability-aware discovery via an Agent Naming Service lets authorization decisions start before the first message is sent, because an agent can verify a peer's attested capabilities and compliance before choosing to interact.
  • Global revocation becomes practical across heterogeneous protocols: one session-authority decision can terminate sessions through A2A, MCP, and HTTP adapters at once.
  • Fine-grained auditing and non-repudiation follow from the same primitives, since DID signatures and logged VC identifiers give each agent action a verifiable cryptographic anchor.
  • Zero-knowledge proofs allow agents to satisfy policy checks, such as holding a compliance credential, without revealing the underlying attributes, making audits privacy-preserving.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The framework's value does not depend on every component being novel; if the session layer works, the contribution is an integration architecture for known cryptographic primitives, and the decisive test is engineering feasibility rather than cryptographic novelty.
  • The same DID, VC, and session structure could extend to other autonomous non-human principals, such as IoT fleets or software supply-chain bots, which share the properties of ephemerality and delegated action.
  • The proposal implicitly predicts that protocol-level security extensions to A2A and MCP will not suffice on their own, and that an external cross-protocol enforcement plane will be needed; this is testable by watching whether agent protocols adopt built-in revocation semantics.
  • A measurable adoption benchmark is whether real deployments meet the paper's own KPIs, particularly revocation time and authorization latency, at production-scale multi-agent workloads.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 8 minor

Summary. The paper argues that traditional IAM protocols (OAuth 2.0, OIDC, SAML) are fundamentally inadequate for AI agents in multi-agent systems and proposes a purpose-built zero-trust framework. The framework combines Decentralized Identifiers (DIDs), Verifiable Credentials (VCs), Zero-Knowledge Proofs (ZKPs), an Agent Naming Service (ANS), dynamic access control, and a four-layer architecture whose Layer 4 provides unified global session management and cross-protocol policy enforcement. The authors illustrate the framework with conceptual flows for ANS discovery, JIT VC-issued MCP tool access, A2A messaging, audit logging, monitoring, and incident response, and they analyze deployment models and security considerations using the MAESTRO threat taxonomy. The paper does not report an implementation, formal analysis, or measurements; Section IX.A explicitly defers scalability, performance, and standardization to future work.

Significance. If the framework's claims were validated, the paper would make a useful contribution to a timely problem: the identity, provenance, and revocation requirements of autonomous agents differ from human-centric IAM in ways that existing protocols address only partially. The manuscript is strongest as a position paper: it gives concrete design sketches, example Rego policies, a deployment decision matrix, and an honest discussion of governance and future work. The open-source Agent ID SDK mentioned in Section III.D is a concrete step beyond pure prose. However, the paper's central differentiator—Layer 4's real-time, consistent cross-protocol revocation—is specified only at a naming-and-flow level, with no consistency model, latency bounds, or benchmark evidence. Because that layer is what distinguishes the proposal from a combination of known DID/VC/ZKP building blocks, the paper currently supports a research agenda more strongly than a validated architecture.

major comments (4)
  1. [Section IV.B.4 and Section IX.A] The paper's most distinctive contribution, Layer 4's 'real-time control and consistent revocation,' is specified only by naming the components (SA, AEM, SSS) and a happy-path logout flow. The SSS is described as a 'highly available, low-latency distributed data store' maintaining a 'real-time ledger' of active sessions, but no consistency model, availability class, or latency bound is given. Under CAP, an AP/eventually-consistent store can serve stale session state to an AEM after a revocation, re-creating the lingering-access failure the framework claims to solve; a CP store has no evidence here of meeting real-time bounds at the scale of millions of ephemeral agents. Section IX.A explicitly defers scalability and performance to future work. Since the paper's contribution claim in Section VIII rests on this layer, the authors should either specify the SSS consistency and partition behavior with target revocation latencies and a benchmark plan, or explicitly downgrade the claim to a design goal.
  2. [Section II.A.2] The motivating claim that OAuth 2.0, OIDC, and SAML are 'fundamentally inadequate' is supported by illustrative examples that mostly demonstrate operational burden, configuration choices, or protocol combinations, rather than in-principle expressiveness limitations. For example, the discussion of complex delegation does not mention OAuth 2.0 token exchange (RFC 8693) or JWT-based authorization claims (RFC 9068), and the revocation example does not discuss RFC 7009 combined with audience-restricted tokens or DPoP. The authors should state a concrete requirement that existing protocols cannot express in principle, or replace 'fundamentally inadequate' with a softer claim such as 'incur significant operational overhead and security risk.' Without this adjustment, the motivation overreaches.
  3. [Section V.D and Section VIII] The framework claims 'instantaneous global session invalidation' and 'non-repudiation,' but the manuscript contains no formal or semi-formal invariant relating global session state to local AEM decisions. The logout flow describes what happens on a new request, but it does not specify how an in-flight long-running MCP call or A2A message is terminated, whether write-actions are rollback-safe, or what happens when an AEM is offline during a revocation. Section VIII's KPI list includes 'Revocation Time' without a target value or measurement method. I recommend adding explicit enforcement semantics for Layer 4 (e.g., on-read check, on-write check, push with acknowledgment, and time bounds) and stating which guarantees are intended under which failure assumptions.
  4. [Section VII.B] The security analysis is an enumeration of threats paired with unproven 'mitigated by' statements rather than an analysis. For a framework whose central promise is security, this leaves unexamined important questions, such as whether an AEM that trusts a cached SSS state can be poisoned, whether ZKP-based selective disclosure preserves non-frameability when agent keys are stolen, and how the 'trust score' influences the PDP without creating a new denial-of-service vector. The authors should either explicitly label Section VII as a threat taxonomy intended to guide future work, or provide at least an informal security argument for the key flows in Sections V.A and V.D.
minor comments (8)
  1. [Section I] The sentence beginning 'In this Cloud Security Alliance paper [1], We listed...' mixes a citation marker with first-person plural and incorrectly capitalizes 'We'; please recast the sentence and ensure the referenced CSA blog is cited consistently in the reference list.
  2. [Section IV.B.4] In the global logout flow, step (c) says the SA 'may push notifications' while step (d) says the AEM acts 'on SSS check (or push)'; the pull semantics versus push semantics should be stated explicitly, because the revocation guarantee depends on which one is used.
  3. [Section V.A, Listing 3] The Rego example uses `input.resource.schema IN allowed_tool.targetSchemas`; Rego uses lowercase `in` for membership, and `allowed_tool` is not bound in the rule's scope as written. Please correct the conceptual listing so that it is valid Rego or clearly labeled as pseudocode.
  4. [Section III.D] The five-step protocol for 'Secure Protocol for Assuming Runtime IDs' would benefit from a note on which entity authorizes the request and how the policy for role changes is enforced; as written, step 2 says 'Verification: Issuer verifies primary DID and policies' but does not say whose policies.
  5. [Section V.E] In the final paragraph, 'the AN DIDs' should be 'the ANS DIDs' or 'the agent DIDs.'
  6. [Section VII.D] The phrase 'undeterministic behavior' should be 'nondeterministic behavior.'
  7. [Figures] Figures 1–5 are referenced in the text, but no figure content or captions appear in the manuscript; if this is a formatting artifact, please supply the figures, and otherwise remove the references.
  8. [Section VIII] The KPI list mixes outcome metrics with product features and gives no definitions; add a sentence explaining how each KPI would be measured (e.g., 'Revocation Time' from SA notification to AEM enforcement, under what load).

Circularity Check

3 steps flagged · score 4.0 of 10

Central inadequacy argument is independent; circularity is confined to self-cited components (ANS, MAESTRO) and a Layer-4 revocation claim stipulated in its component's definition rather than derived or measured.

  1. ansatz smuggled in via citation [Section IV.A(C) 'Foundational Pillars'; Section V.A 'Agent IDs in the IAM Process' (refs [9]/[33])]
    "Agent Naming and Discovery Service (ANS): An ANS, inspired by DNS but tailored for agents, enables secure and reliable discovery based on capabilities, protocols, providers, and versions, not just names [33]."

    The framework's discovery pillar and the capability-aware naming convention used throughout Section V are adopted by citation from the authors' own prior work (refs [9] and [33], both with overlapping authorship), where the ANS design is a proposal rather than a ratified standard. The paper then treats ANS as a 'critical enabler' of its access-control, logging, and incident-response use cases, so the framework's adequacy partially rests on a self-citation that supplies no independent evidence. This is not the source of the paper's central inadequacy claim, which is argued from protocol-level examples with external citations, so the circularity burden from this step is partial.

  2. self citation load bearing [Section VII.A-B 'Security Considerations' (ref [45], MAESTRO framework)]
    "Securing the Agentic AI IAM framework is paramount, analyzed here using the MAESTRO framework [45]. ... framework vulnerabilities allowing session hijacking (mitigated by continuous re-validation via AEM/SSS)."

    The security validation of the proposed framework is conducted using MAESTRO, and ref [45] is the same first author's Cloud Security Alliance blog post rather than an external standard or verified model. The threat-mitigation pairs point back to the framework's own unvalidated components (AEM/SSS for session hijacking, secure ANS resolution for discovery compromise, DIDs/VCs for impersonation), so the analysis maps the framework onto its own stipulated mechanisms and introduces no independent evidence of security. This self-referential structure supports the paper's organizational claims but does not validate them, and it does not touch the independent inadequacy argument.

1 more flagged steps
  1. self definitional [Section IV.B.4 'Layer 4: Unified Global Session Management & Policy Enforcement Layer'; Section VIII 'Innovative Contributions']
    "Layer 4: Unified Global Session Management & Policy Enforcement Layer: A critical innovation for consistent, real-time establishment, tracking, management, and enforcement of IAM policies, including global logout and session invalidation, across heterogeneous agent communication protocols. ... Session State Synchronizer (SSS): Highly available, low-latency distributed data store maintaining a real-time ledger of active global agent session contexts, their mappings to protocol-specific sessions, and current validated capabilities/status."

    The Section VIII claim that Layer 4 ensures 'that a policy decision or revocation, once made, is effectively and immediately enforced wherever an agent might interact' is supported only by the component definitions in IV.B.4, where SSS is stipulated as a 'real-time ledger' and 'primary source of truth for AEMs regarding session validity.' The headline property of real-time consistent revocation is written into the component's definition and then restated as the 'critical innovation'; it is not derived from any analysis or measurement. Section IX.A concedes that the SSS 'face[s] significant scalability and performance hurdles' and defers benchmarking, confirming the property is an assumption rather than an established result.

full rationale

The paper's central claim — that OAuth 2.0, OIDC, and SAML are fundamentally inadequate for autonomous multi-agent systems — is argued in Section II from protocol-level properties (coarse-grained static scopes, single-principal assumptions, weak delegation chains, lack of context awareness, token revocation gaps) with external citations ([10]–[24]); it does not depend on the proposed framework and is therefore not circular. The paper makes no empirical predictions, fits no parameters, and invokes no uniqueness theorem, so the strongest circularity patterns do not apply. The moderate burden comes from three steps. First, the ANS discovery pillar and its capability-aware naming convention are adopted wholesale from the authors' own prior IETF draft and arXiv paper ([9], [33]) and then treated as a 'critical enabler' of the framework's use cases, which is self-citation supplying the design rather than external support. Second, the security analysis uses MAESTRO ([45]), the same first author's prior taxonomy, with mitigations pointing back to the framework's own unvalidated components (AEM/SSS, ANS), making the validation self-referential. Third, the headline Layer-4 'innovation' of real-time consistent revocation is stipulated in the definition of the SSS ('real-time ledger ... primary source of truth') and then presented as an achievement; Section IX.A's explicit deferral of scalability and performance is weighed here and limits the severity, since the paper honestly scopes the claim as future work rather than presenting a measured result. Because the central inadequacy argument is independent and the self-citations, while present, do not force the central conclusion, the appropriate score is 4.

Assumptions & free parameters 0 free parameters · 5 assumptions · 4 invented entities

The framework does not fit numeric parameters, but it rests on several unverified modeling assumptions about the adequacy of DID and VC technology, the feasibility of real-time cross-protocol session revocation, and the validity of the authors' own ANS and MAESTRO frameworks. The central proposal is an architecture, so the ledger lists these domain assumptions and self-referential dependencies rather than fitted constants.

assumptions (5)
  • domain assumption Traditional IAM protocols (OAuth 2.0, OIDC, SAML) are fundamentally inadequate for multi-agent systems.
    The paper asserts this in Section II.A.2 with illustrative examples, but provides no empirical or formal demonstration that the failure modes are unavoidable or that existing extensions (e.g., token exchange) cannot be adapted.
  • domain assumption DIDs and VCs provide a sufficient cryptographic foundation for agent identity.
    The framework builds on W3C standards (refs [26] and [27]) without addressing known limitations such as DID method fragmentation or VC revocation latency.
  • domain assumption A logically centralized Session Authority and distributed Session State Synchronizer can provide real-time global revocation across heterogeneous protocols.
    Section IV.B.4 proposes this as 'a critical innovation,' but Section IX.A admits scalability and performance remain future work. The latency bounds and consistency guarantees are unspecified.
  • ad hoc to paper The Agent Name Service (ANS) from the authors' prior work is a viable discovery mechanism.
    ANS is cited from references [9] and [33], authored by overlapping authors, and is treated as a foundation without independent validation in this paper.
  • ad hoc to paper The MAESTRO framework provides a valid threat model for analyzing the proposal.
    Section VII uses MAESTRO [45], authored by the first author, as the analytic lens, without comparing to alternative threat models.
invented entities (4)
  • Cross-Protocol Session Authority (SA)
    purpose: Logically centralized component for global session oversight, policy distribution, and global logout.
    Described only at block-diagram level in Section IV.B.4; no protocol specification, implementation, or latency data.
  • Adapter Enforcement Middleware (AEM)
    purpose: Lightweight plugins into protocol adapters to enforce local session termination and intercept requests.
    Proposed in Section IV.B.4; no implementation or integration details beyond a high-level flow.
  • Session State Synchronizer (SSS)
    purpose: Distributed data store maintaining a real-time ledger of active global session contexts.
    Section IV.B.4 asserts high availability and low latency, but no design for consistency, partitioning, or failure handling is given; scalability is flagged as future work in Section IX.A.
  • Agent ID Provider Network (AIPN)
    purpose: A proposed DID registry for agent identity.
    Mentioned in Section IV.B.1 as an example DID registry; no specification or deployment details.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Novel Zero-Trust Identity Framework for Agentic AI: Decentralized Authentication and Fine-Grained Access Control." pith.science (2026). https://pith.science/paper/B42CEDMD

@misc{pith2026250519301,
  author       = {Pith},
  title        = {Pith review of: A Novel Zero-Trust Identity Framework for Agentic AI: Decentralized Authentication and Fine-Grained Access Control},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/B42CEDMD}},
  note         = {Machine review of arXiv:2505.19301}
}
read the original abstract

Traditional Identity and Access Management (IAM) systems, primarily designed for human users or static machine identities via protocols such as OAuth, OpenID Connect (OIDC), and SAML, prove fundamentally inadequate for the dynamic, interdependent, and often ephemeral nature of AI agents operating at scale within Multi Agent Systems (MAS), a computational system composed of multiple interacting intelligent agents that work collectively. This paper posits the imperative for a novel Agentic AI IAM framework: We deconstruct the limitations of existing protocols when applied to MAS, illustrating with concrete examples why their coarse-grained controls, single-entity focus, and lack of context-awareness falter. We then propose a comprehensive framework built upon rich, verifiable Agent Identities (IDs), leveraging Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs), that encapsulate an agents capabilities, provenance, behavioral scope, and security posture. Our framework includes an Agent Naming Service (ANS) for secure and capability-aware discovery, dynamic fine-grained access control mechanisms, and critically, a unified global session management and policy enforcement layer for real-time control and consistent revocation across heterogeneous agent communication protocols. We also explore how Zero-Knowledge Proofs (ZKPs) enable privacy-preserving attribute disclosure and verifiable policy compliance. We outline the architecture, operational lifecycle, innovative contributions, and security considerations of this new IAM paradigm, aiming to establish the foundational trust, accountability, and security necessary for the burgeoning field of agentic AI and the complex ecosystems they will inhabit.

Figures

Figures reproduced from arXiv: 2505.19301 by the authors.

Figure 1
Figure 1. Core Architecture and its layers V. AGENT IDS IN THE IAM PROCESS This section provides an in-depth exploration of how these constructs enable robust fine-grained access control, ensure secure and non-reputable logging, facilitate effective real-time monitoring and anomaly detection, and empower agile, targeted incident response. A critical enabler for many of these use cases is the Agent Name Service (ANS by [33]), … view at source ↗
Figure 2
Figure 2. Agent discovery process using the Agent Name Service (ANS)/ [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Fine-grained access control enforcement when RiskAnalyzerBot requests access to sensitive financial data. [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Ephemeral agent authorization using Just-In-Time (JIT) Verifiable Credentials for Model Context Protocol (MCP) tool access. [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: Secure agent-to-agent communication using Google’s A2A protocol for critical security alerts. [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 5 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. From Multi-Agent Systems and the Semantic Web to Agentic AI: A Unified Narrative of the Web of Agents

    cs.AI 2025-07 conditional novelty 6.0 of 10

    The paper organizes Multi-Agent Systems, the Semantic Web, and LLM-based agents into one narrative in which the location of semantic effort migrated from platform, to data, to model.

  2. Engineering Trustworthy Agentic AI for Critical Systems

    cs.AI 2026-07 conditional novelty 5.0 of 10

    A survey claiming that agentic AI trustworthiness is a single cross-domain problem and outlining a framework for graded, certifiable assurance.

  3. AI Agents with Decentralized Identifiers and Verifiable Credentials

    cs.CR 2025-10 conditional novelty 4.0 of 10

    A prototype shows AI agents can authenticate using ledger-anchored W3C DIDs and verifiable credentials, but LLM-orchestrated security steps fail often and once skipped authentication.

  4. Agent Capability Negotiation and Binding Protocol (ACNBP)

    cs.AI 2025-06 reject novelty 4.0 of 10

    ACNBP is a proposed standard for secure agent capability negotiation with an extension mechanism, but it lacks formal verification, experiments, and independent evaluation.

  5. The Age of Sensorial Zero Trust: Why We Can No Longer Trust Our Senses

    cs.CR 2025-07 unverdicted novelty 3.0 of 10

    A position paper argues that organizations should apply Zero Trust verification principles to human sensory perception to defend against deepfake and voice-clone fraud.

Reference graph

Works this paper leans on

46 extracted references · 36 canonical work pages · cited by 5 Pith papers

  1. [1]

    Agentic AI identity management approach,

    K. Huang, “Agentic AI identity management approach,” Cloud Security Alliance Blog, March 2025. [Online]. Available: https://cloudsecurityall iance.org/blog/2025/03/11/agentic-ai-identity-management-approach

    work page 2025

  2. [2]

    Guide to attribute based access control (abac) definition and considerations,

    V . C. Hu, D. F. Ferraiolo, D. R. Kuhn, A. Schnitzer, K. Sandlin, R. Miller, and K. Scarfone, “Guide to attribute based access control (abac) definition and considerations,” National Institute of Standards and Technology, Tech. Rep. NIST SP 800-162, 2019. [Online]. Available: https://doi.org/10.6028/NIST.SP.800-162

    doi:10.6028/nist.sp.800-162 2019

  3. [3]

    Blockchain enabled policy-based access control mechanism to restrict unauthorized access to electronic health records,

    N. Yaqub, J. Zhang, M. I. Khalid, W. Wang, M. Helfert, M. Ahmed, and J. Kim, “Blockchain enabled policy-based access control mechanism to restrict unauthorized access to electronic health records,” PeerJ Computer Science , vol. 11, p. e2647, 2025. [Online]. Available: https://doi.org/10.7717/peerj-cs.2647

    work page doi:10.7717/peerj-cs.2647 2025

  4. [4]

    What is just-in-time (jit) access?

    V . Shastri, “What is just-in-time (jit) access?” CrowdStrike, January 2025, accessed: May 23, 2025. [Online]. Available: https://www.crowdstrike. com/en-us/cybersecurity-101/identity-protection/just-in-time-access/

    work page 2025

  5. [5]

    Ferber, Multi-Agent Systems: An Introduction to Distributed Artificial Intelligence

    J. Ferber, Multi-Agent Systems: An Introduction to Distributed Artificial Intelligence. Addison-Wesley, 1999

    work page 1999

  6. [6]

    European Parliament and Council, “Regulation of the European Parlia- ment and of the Council on Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act) and Amending Certain Union Legislative Acts,” Official Journal of the European Union, 2023

    work page 2023

  7. [7]

    AI Agents Face One Last, Big Obstacle,

    S. Rosenbush, “AI Agents Face One Last, Big Obstacle,” The Wall Street Journal, May 2025

    work page 2025

  8. [8]

    IDs for AI Systems,

    A. Chan et al., “IDs for AI Systems,” arXiv preprint arXiv:2406.12137 , 2024

    arXiv 2024

Show all 46 references
  1. [9]

    Agent name service (ans): A universal directory for secure ai agent discovery and interoperability,

    H. Ken, V . S. Narajala, I. Habler, and A. Sheriff, “Agent name service (ans): A universal directory for secure ai agent discovery and interoperability,” arXiv preprint arXiv:2505.10609 , 2025. [Online]. Available: https://arxiv.org/abs/2505.10609

    2025 arXiv

  2. [10]

    The OAuth 2.0 Authorization Framework,

    D. E. Hardt, “The OAuth 2.0 Authorization Framework,” Internet Engineering Task Force, RFC RFC 6749, 2012. [Online]. Available: https://doi.org/10.17487/RFC6749

    2012 doi

  3. [11]

    OpenID Connect Core 1.0 incorporating errata set 1,

    OpenID Foundation, “OpenID Connect Core 1.0 incorporating errata set 1,” OpenID Foundation Standards, 2014. [Online]. Available: https://openid.net/specs/openid-connect-core-1 0.html

    2014

  4. [12]

    Security Assertion Markup Language (SAML) V2.0 Errata,

    OASIS, “Security Assertion Markup Language (SAML) V2.0 Errata,” OASIS Standard, 2005

    2005

  5. [13]

    The kerberos network authentication service (v5),

    C. Neuman, T. Yu, S. Hartman, and K. Raeburn, “The kerberos network authentication service (v5),” Internet Engineering Task Force, RFC RFC 4120, July 2005, accessed: May 23, 2025. [Online]. Available: https://datatracker.ietf.org/doc/html/rfc4120

    2005

  6. [14]

    Lightweight directory access protocol (ldap): The protocol,

    J. Sermersheim, “Lightweight directory access protocol (ldap): The protocol,” Internet Engineering Task Force, RFC RFC 4511, June 2006, accessed: May 23, 2025. [Online]. Available: https: //datatracker.ietf.org/doc/html/rfc4511

    2006

  7. [15]

    Introducing the model context protocol,

    Anthropic, “Introducing the model context protocol,” Anthropic News, November 2024, accessed: May 23, 2025. [Online]. Available: https://www.anthropic.com/news/model-context-protocol

    2024

  8. [16]

    Specification and documentation for the model context protocol,

    modelcontextprotocol (Organization), “Specification and documentation for the model context protocol,” GitHub, 2025, accessed: May 23, 2025. [Online]. Available: https://github.com/modelcontextprotocol/modelconte xtprotocol

    2025

  9. [17]

    Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategies,

    V . S. Narajala and I. Habler, “Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategies,” arXiv preprint arXiv:2504.08623 , 2025. [Online]. Available: https://arxiv.org/abs/2504.08623

    2025 arXiv

  10. [18]

    Enhancing grid security by fine-grained behavioral control and negotiation-based authorization,

    H. Koshutanski and K. Hristov, “Enhancing grid security by fine-grained behavioral control and negotiation-based authorization,” International Journal of Information Security , vol. 7, no. 5, pp. 327–341, 2008

    2008

  11. [19]

    Solving the transitive access problem for the services oriented architecture,

    M. Thompson, A. Essiari, and S. Mudumbai, “Solving the transitive access problem for the services oriented architecture,” in Proceedings of the IEEE International Conference on Web Services (ICWS 2007) , 2007, pp. 390–397

    2007

  12. [20]

    SCPAC: An Access Control Framework for Diverse IoT Platforms Based on OAuth2.0,

    A. Bouhairie and A. Hair, “SCPAC: An Access Control Framework for Diverse IoT Platforms Based on OAuth2.0,” in 2021 International Conference on Promising Electronic Technologies (ICPET) , 2021, pp. 1–6

    2021

  13. [21]

    Next generation session management for 3d teleimmersive interactive environments,

    S. Ren, S. M. Roy, Y . Gao, K. Nahrstedt, and R. Wang, “Next generation session management for 3d teleimmersive interactive environments,” Multimedia Tools and Applications , vol. 54, no. 3, pp. 545–577, 2009

    2009

  14. [22]

    Trust and identity manage- ment in cloud and distributed systems,

    R. A. Shaikh, E. Adi, and H. Koshutanski, “Trust and identity manage- ment in cloud and distributed systems,” in Security in Computing and Communications (SSCC 2015) , ser. Communications in Computer and Information Science, X. Lin and Y . Xiang, Eds. Springer, 2015, vol. 536,...

    2015

  15. [23]

    A practitioner’s guide to managing non-human identity risks,

    L. Choda, “A practitioner’s guide to managing non-human identity risks,” Video, KuppingerCole Analysts, May 2025, accessed: May 23, 2025. [Online]. Available: https://www.kuppingercole.com/watch/practitioner s-guide-non-human-risks-eic25

    2025

  16. [24]

    A comprehensive formal security analysis of oauth 2.0,

    D. Fett, R. Kuesters, and G. Schmitz, “A comprehensive formal security analysis of oauth 2.0,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS ’16) , 2016, pp. 1204–1215

    2016

  17. [25]

    A guide to keyless and passwordless authentication,

    SSH Communications Security, “A guide to keyless and passwordless authentication,” SSH Communications Security Website, n.d., retrieved May 23, 2025. [Online]. Available: https://www.ssh.com/academy/secret s-management/keyless-passwordless-authentication-guide

    2025

  18. [26]

    Decentralized Identifiers (DIDs) v1.0,

    World Wide Web Consortium (W3C), “Decentralized Identifiers (DIDs) v1.0,” World Wide Web Consortium (W3C), W3C Recommendation, July 2022. [Online]. Available: https://www.w3.org/TR/did-core/

    2022

  19. [27]

    Verifiable Credentials Data Model v1.0,

    ——, “Verifiable Credentials Data Model v1.0,” World Wide Web Consortium (W3C), W3C Recommendation, November 2021. [Online]. Available: https://www.w3.org/TR/vc-data-model/

    2021

  20. [28]

    Verifiable Credentials Data Model v2.0,

    M. Sporny et al., “Verifiable Credentials Data Model v2.0,” World Wide Web Consortium (W3C), W3C Working Draft, May 2024. [Online]. Available: https://www.w3.org/TR/vc-data-model-2.0/

    2024

  21. [29]

    Agentic AI DID SDK: Decentralized Identifiers and Zero-Knowledge Proofs,

    K. Huang, “Agentic AI DID SDK: Decentralized Identifiers and Zero-Knowledge Proofs,” GitHub Repository, 2025. [Online]. Available: https://github.com/kenhuangus/agent-id-sdk

    2025

  22. [30]

    OWASP Top 10 Non-Human Identities Risks - 2025,

    “OWASP Top 10 Non-Human Identities Risks - 2025,” OWASP Foundation Report, OW ASP, 2025. [Online]. Available: https://owasp.or g/www-project-non-human-identities-top-10/2025/top-10-2025/

    2025

  23. [31]

    The State of Non-Human Identity Security,

    “The State of Non-Human Identity Security,” Cloud Security Alliance Survey Report, Cloud Security Alliance, 2024. [Online]. Available: https://cloudsecurityalliance.org/artifacts/state-of-non-human-identity-s ecurity-survey-report

    2024

  24. [32]

    The knowledge complexity of interactive proof systems,

    S. Goldwasser, S. Micali, and C. Rackoff, “The knowledge complexity of interactive proof systems,” SIAM Journal on Computing , vol. 18, no. 1, pp. 186–208, 1989

    1989

  25. [33]

    Agent Name Service (ANS): A universal directory for secure AI agent discovery and interoperability,

    K. Huang, V . S. Narajala, I. Habler, and A. Sheriff, “Agent Name Service (ANS): A universal directory for secure AI agent discovery and interoperability,” Internet Engineering Task Force, Internet-Draft draft-narajala-ans-00, May 2025. [Online]. Available: https://datatracker...

    2025

  26. [34]

    extensible access control markup language (xacml) version 3.0,

    OASIS, “extensible access control markup language (xacml) version 3.0,” OASIS Standard, Tech. Rep., January 2013, accessed: May 23,

    2013

  27. [35]

    Policy language,

    Open Policy Agent, “Policy language,” Open Policy Agent Documentation, 2025, accessed: May 23, 2025. [Online]. Available: https://www.openpolicyagent.org/docs/policy-language/

    2025

  28. [36]

    Build Security Into Your Network’s DNA: The Zero Trust Network Architecture,

    J. Kindervag, “Build Security Into Your Network’s DNA: The Zero Trust Network Architecture,” Forrester Research, Tech. Rep., 2010

    2010

  29. [37]

    Zero trust architecture,

    S. Rose, O. Borchert, S. Mitchell, and S. Connelly, “Zero trust architecture,” National Institute of Standards and Technology, Tech. Rep. NIST SP 800-207, August 2020. [Online]. Available: https://doi.org/10.6028/NIST.SP.800-207

    2020 doi

  30. [38]

    LLM and GenAI data security best practices,

    E. G. Junior, S. Clinton, C. Hughes, V . S. Narajala, and T. Holmes, “LLM and GenAI data security best practices,” Feb. 2025. [Online]. Available: https://www.researchgate.net/publication/391204648 LLM a nd GenAI Data Security Best Practices

    2025

  31. [39]

    Understanding a2a — the protocol for agent collaboration,

    laxmih (Google Cloud Community), “Understanding a2a — the protocol for agent collaboration,” Google Cloud Community Blog, May 2025, accessed: May 23, 2025. [Online]. Available: https: //www.googlecloudcommunity.com/gc/Community-Blogs/Understandi ng-A2A-The-Protocol-for-Agent-C...

    2025

  32. [40]

    A survey of agent interoperability protocols: Model context protocol (mcp), agent communication protocol (acp), agent-to-agent protocol (a2a), and agent network protocol (anp),

    A. Ehtesham, A. Singh, G. K. Gupta, and S. Kumar, “A survey of agent interoperability protocols: Model context protocol (mcp), agent communication protocol (acp), agent-to-agent protocol (a2a), and agent network protocol (anp),” arXiv preprint arXiv:2505.02279 , 2025

    2025 arXiv

  33. [41]

    Multi-agentic system threat modelling guide OWASP GenAI security project,

    K. Huang, A. Sheriff, J. Sotiropoulos, R. F. Del, and V . Lu, “Multi-agentic system threat modelling guide OWASP GenAI security project,” Apr. 2025. [Online]. Available: https://www.researchgate.net/p ublication/391204915 Multi-Agentic system Threat Modelling Guide OW ASP GenA...

    2025

  34. [42]

    Securing genai multi- agent systems against tool squatting: A zero trust registry-based approach,

    V . S. Narajala, K. Huang, and I. Habler, “Securing genai multi- agent systems against tool squatting: A zero trust registry-based approach,” arXiv preprint arXiv:2504.19951 , 2025. [Online]. Available: https://arxiv.org/abs/2504.19951

    2025 arXiv

  35. [43]

    Building a secure agentic AI application leveraging A2A protocol,

    I. Habler, K. Huang, V . S. Narajala, and P. Kulkarni, “Building a secure agentic AI application leveraging A2A protocol,” 2025. [Online]. Available: https://www.arxiv.org/abs/2504.16902

    2025 arXiv

  36. [44]

    Fipa contract net interaction protocol specification,

    FIPA TC C, “Fipa contract net interaction protocol specification,” Foundation for Intelligent Physical Agents, Tech. Rep. FIPA Standard SC00029H, December 2002, accessed: May 23, 2025. [Online]. Available: http://fipa.org/specs/fipa00029/SC00029H.html

    2002

  37. [45]

    Agentic AI Threat Modeling Framework: MAESTRO,

    K. Huang, “Agentic AI Threat Modeling Framework: MAESTRO,” Cloud Security Alliance Blog, February 2025, uRL not provided in source. Accessed: May 23, 2025

    2025

  38. [2025]

    Available: http://docs.oasis-open.org/xacml/3.0/xacml-3 .0-core-spec-os-en.html

    [Online]. Available: http://docs.oasis-open.org/xacml/3.0/xacml-3 .0-core-spec-os-en.html

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.