Tamed Autonomy: A Multi-Layer Governance Framework for Autonomous AI Agents

Zero Trust says don’t trust the network. Tamed Autonomy says authenticate the purpose, not just the identity.

Executive Summary

Current AI security models extend human identity and authorization systems — OAuth, RBAC, SPIFFE, MCP — to cover AI agents. This approach treats agent governance as an incremental engineering problem. This paper argues it is an architectural one.

The core design assumptions of today’s security infrastructure — human consent to scopes, stable predefined roles, predictable workload behavior — do not hold for autonomous AI agents. Documented incidents already demonstrate agents with valid credentials performing authorized actions for unauthorized purposes. Adversarial AI capabilities are growing. The gap between what agents can do and what governance systems can detect or constrain is widening.

This paper proposes a multi-layer governance framework built on new primitives: intent declarations that become enforceable behavioral contracts, computed trust physics that modulate agent autonomy in real time through a mathematical trust equation (E_trust = E_base × (1 − R)), a four-step enforcement pipeline that gates every agent action, and a normative “should” layer that operates as a runtime governance engine — not just a pre-execution filter — where humans remain the ultimate arbiters of purpose. These primitives are designed to layer above existing identity and authorization infrastructure, not replace it.

The framework incorporates the Kinetic Trust Protocol (KTP) (see) as its trust physics layer — providing the mathematical foundation for trust computation, behavioral trajectory tracking, trust tiers, and emergency response mechanisms. It draws on a 30-year research tradition in computed trust, 20 years of work in normative multi-agent systems, and historical parallels to previous security paradigm shifts (ACL-to-identity, perimeter-to-Zero-Trust) that followed recognizable patterns of anomaly accumulation, incremental exhaustion, and eventual paradigm replacement.

This is a thesis, not a proven conclusion. The catalytic crisis that typically compresses paradigm adoption timelines has not yet occurred. But the signals match historical patterns, and the time to design the next governance architecture is before it’s needed under emergency conditions. We call this framework Tamed Autonomy — because agents are autonomous, and that’s precisely the problem this solves.

1. The Problem: Security Models Designed for Humans, Used by Agents

1.1 What’s Happening Now

The AI industry’s approach to agent security is overwhelmingly incremental: extend existing human-centric identity and authorization models to cover AI agents. Add OAuth scopes for agent workflows. Create service accounts for agent processes. Build MCP (Model Context Protocol) gateways with policy enforcement. Extend SPIFFE/SPIRE workload identity to agent containers.

This is understandable. These are mature, proven systems. They work for their original purpose. And extending them is the path of least resistance.

But “works for now” is not the same as “sufficient for where this is going.”

1.2 Design Assumptions That Break

Each of these systems was designed around assumptions that autonomous AI agents violate:

System	Design Assumption	How Agents Break It
OAuth 2.0	A human reviews and consents to scopes	Agents autonomously request and use tokens with no human reviewing each action
RBAC	Roles are stable and predefined	Agents dynamically shift behavior — reading, writing, administering — within a single task
SPIFFE/Workload Identity	Workload identity predicts workload behavior	Agent identity is static but agent behavior is emergent and non-deterministic
MCP	Policy enforcement at the gateway constrains agent actions	Agents with the same credentials can bypass MCP via direct API calls or web front ends
API Keys / Service Accounts	One key corresponds to one predictable set of actions	One agent uses one key for unpredictable, context-dependent actions

These are not deployment failures that better configuration can fix. They are structural mismatches between the systems’ design-time assumptions and the reality of autonomous agents.

1.3 The Evidence Is Already Accumulating

Documented incidents demonstrate the gap:

Credential inheritance without constraint. At Black Hat USA 2024 (see), security researcher Michael Bargury demonstrated that Microsoft Copilot inherited the user’s full Microsoft Graph permissions — every scope the user had — with no mechanism to constrain the agent to a task-appropriate subset. The agent operated with the user’s full authority.

Cross-service hijacking via legitimate credentials. Invariant Labs documented (see) “tool poisoning” attacks against MCP, where a malicious MCP server injected instructions into tool descriptions that caused agents to exfiltrate data from other connected MCP servers. Each action used legitimate credentials for the targeted service. No credential compromise was needed.

Plugin OAuth interception. Salt Security discovered (see) (March 2024) that ChatGPT’s plugin ecosystem allowed malicious plugins to intercept OAuth tokens during authorization flows, gaining access to users’ third-party accounts. The agent became what security researchers call a “confused deputy.”

Autonomous exploitation at scale. UIUC researchers demonstrated that GPT-4 agents, given standard tools, could autonomously exploit real-world web vulnerabilities at a 73% success rate (see) (February 2024) — and could read CVE descriptions and weaponize them autonomously at 87% success (see) (April 2024).

Industry consensus. Gartner predicts 25% of enterprise breaches by 2028 will be traced back to AI agent abuse, from both external and malicious internal actors (see). Forrester documented (see) that zero major IAM vendors had purpose-built AI agent identity solutions as of early 2025. NIST AI 600-1 (see) explicitly identifies unauthorized agent actions as a key risk and acknowledges no authorization paradigm exists for non-deterministic AI systems. OWASP includes “Excessive Agency” (see) in its Top 10 risks for LLM applications.

The common thread across every incident: valid credentials, authorized actions, unauthorized purposes. Current systems authenticate the credential. Nothing authenticates the intent.

1.4 The Adversarial Dimension

The threat is not hypothetical. Uncensored LLMs — WormGPT, FraudGPT, GhostGPT — are commercially available on the dark web and via Telegram, subscription-priced, and actively marketed for generating phishing content, exploit code, and social engineering attacks.

Nation-state actors are documented using AI for attack preparation. Microsoft and OpenAI jointly disclosed in February 2024 (see) that five APT groups (Russian, Chinese, Iranian, and North Korean) were using LLMs for reconnaissance, phishing content generation, and vulnerability research. Google Threat Intelligence corroborated this across the Gemini platform in January 2025 (see).

Perhaps most telling: North Korean operatives have been using AI to create fake identities, pass technical interviews, and maintain employment at Western technology companies — operating with legitimate credentials, VPN access, and code repository permissions. They are adversarial actors functioning entirely within the legitimate trust model. The FBI has issued formal advisories (see).

The capability trajectory points in one direction. Current governance models were not designed to detect authorized actors with unauthorized purposes.

2. Historical Context: Paradigm Shifts Have a Pattern

2.1 The Author’s Experience

I was part of the group that helped build the identity industry starting in 1998. As Chief Architect at Oblix — one of the foundational identity management startups, later acquired by Oracle and shipped as Oracle Identity Manager — I designed systems that became the enterprise identity backbone for a decade. I later served as Director of Architecture at Ping Identity, helping build the federation and cloud identity platform that today serves 60%+ of the Fortune 100. At the time we started, security meant Access Control Lists — permissions attached directly to files, directories, and system objects. Every system maintained its own user database. There was no concept of identity as an abstraction that spans systems, has a lifecycle, or exists independently of the resources it accesses.

When we proposed that identity needed to be its own discipline — its own layer in the security stack — the response was skepticism. Not hostility, but genuine inability to see the problem. ACLs worked. Why would you need something more?

We saw the signals: enterprises accumulating dozens of systems with separate user stores, the same person with fifteen accounts, onboarding taking weeks, offboarding incomplete, orphaned accounts everywhere, nobody able to answer “what access does this person have?” The web was making all of it worse.

It took roughly twelve years from first signals (Novell NDS and LDAP in 1993) to mainstream adoption (Gartner Magic Quadrant for Identity Management, major vendor acquisitions, post-SOX regulatory mandates). The tipping point was approximately 2001–2003, driven by the convergence of SAML, Sarbanes-Oxley, and the maturation of first-generation identity management products.

2.2 The Pattern Repeats

The ACL-to-identity transition was not unique. The perimeter-to-Zero-Trust shift followed the same arc:

2004: The Jericho Forum proposed “de-perimeterisation.” Widely dismissed.
2010: John Kindervag at Forrester coined “Zero Trust” (see). Skeptics called it impractical.
2014: Google published the BeyondCorp paper (see), proving it worked at scale.
2020: COVID eliminated the physical perimeter overnight. SolarWinds (see) demonstrated that even carefully maintained perimeters could be bypassed via trusted software.
2021: Biden Executive Order (see) mandated Zero Trust for federal agencies.

Every security paradigm shift follows recognizable phases:

Phase	What Happens	Typical Duration
Anomaly accumulation	Existing controls need increasingly complex workarounds	3–5 years
Conceptual articulation	Someone names the new paradigm; met with skepticism	2–4 years
Proof of concept	A major organization demonstrates it works at scale	2–4 years
Catalytic crisis	A breach or regulation makes the old model’s failure undeniable	Event-driven
Rapid adoption	Industry consensus flips within 2–3 years	2–3 years

2.3 Where AI Agent Security Sits Today

AI agent security is in the early phases. The anomalies are accumulating — credential parity, MCP bypass, ungoverned delegation chains, unanswerable audit questions (“what can this agent do across all services?”). The industry response is overwhelmingly incremental innovation: extend OAuth, add MCP scopes, create agent-specific RBAC roles. What is needed is a generational leap — new primitives that redefine the problem space, as SAML redefined identity and Zero Trust redefined network security.

The conceptual articulation is emerging. This paper is one contribution. The Kinetic Trust Protocol (KTP) (see) — an experimental framework with 8 RFCs exploring computed trust as a governance primitive — provides the mathematical foundation for what this paper calls the trust physics layer, and is incorporated directly into this framework. NIST’s AI Risk Management Framework (see) identifies governance gaps. OWASP (see) codifies agent-specific risks.

The proof of concept and catalytic crisis have not yet occurred. Historical precedent suggests the gap between “the signals are visible” and “the industry moves” ranges from 6 to 20 years, compressed by crisis events.

2.4 The Compressed Timeline Problem

Previous security paradigm shifts afforded the industry significant lead time. The ACL-to-identity transition had roughly 12 years from first signals to mainstream adoption. The perimeter-to-Zero-Trust shift had nearly 17 years from the Jericho Forum’s proposal to the Biden Executive Order. In both cases, the underlying technology — networks, directories, web applications — evolved at human speed. There was time to observe anomalies, debate approaches, build proofs of concept, and standardize.

AI agent capabilities are not evolving at human speed. The gap between what agents can do today and what they will do in six months is larger than the gap between any two years in the identity or Zero Trust timelines. New agent frameworks, tool-use capabilities, and multi-agent coordination patterns emerge on a weekly cadence.

This creates a structural problem for reactive security strategies. The current industry posture — focused on what can be shipped in the next quarter to address today’s agent security gaps — is rational under competitive pressure. But it means governance solutions are being designed against a snapshot of agent capabilities that will be obsolete by the time those solutions deploy. When the technology being governed moves faster than the governance planning cycle, incremental approaches produce perpetually outdated controls.

The implication is that the traditional paradigm-shift timeline — years of debate followed by crisis-driven adoption — may not be available. If AI compresses the anomaly-accumulation phase from years to months, the gap between “the signals are visible” and “the crisis arrives” compresses proportionally. The time to design the governance architecture is before it is needed under emergency conditions — and that window may be shorter than historical precedent suggests.

3. A Multi-Layer Governance Framework

3.1 The Architecture

The framework proposes three core layers, built above existing infrastructure:

+----------------------------------------------------+
| Normative Layer — "Should" Governance              |
|  - runtime evaluation of purpose against policy    |
|  - Soul Constraints: binary vetoes (S = 1)         |
|  - action risk reclassification                    |
|  - human is ultimate arbiter of morals             |
+----------------------------------------------------+
| Trust Physics Layer                                |
|  - E_trust = E_base × (1 − R)                     |
|  - five Trust Tiers gate what actions are possible |
|  - four-step enforcement pipeline gates every      |
|    action: Signature → Soul → Tier → Physics       |
|  - Trajectory Chains: tamper-evident behavior log  |
|  - trust velocity (dE/dt) as compromise signal     |
+----------------------------------------------------+
| Purpose Layer — Intent as Contract                 |
|  - agent declares scope before acting              |
|  - normative layer evaluates declared purpose      |
|  - approved intent becomes enforceable contract    |
|  - deviation triggers enforcement pipeline         |
+----------------------------------------------------+
| Identity + Behavior Observation                    |
|  - behavioral trajectory, not just credentials     |
|  - provenance: who spawned whom, on whose behalf   |
|  - real-time observation of actual actions          |
+----------------------------------------------------+
| Infrastructure (existing)                          |
|  - OAuth, RBAC, SPIFFE, MCP, APIs, services        |
+----------------------------------------------------+

This is not a replacement for current identity and authorization systems. It layers above them. OAuth, SPIFFE, and RBAC remain the infrastructure — but they are no longer the complete governance story. The three new layers — purpose, trust physics, and normative — form a coupled system where each layer feeds the others: intent compliance builds trust, trust level determines what the normative layer permits, and normative context modifies what trust physics enforces.

3.2 Intent as Contract

The most novel element of this framework is the treatment of intent as a contract, not a confession.

The system does not need to trust that an agent’s declared intent is sincere. It uses the declaration as a binding constraint to enforce against:

Agent declares intent. “I will retrieve sales data for Q4 trend analysis.” The declaration includes scope specification — which data sources, what operations (read/write), temporal bounds, and output constraints.
The normative layer evaluates the intent itself — not just “is the agent authorized to access sales data?” but “should this purpose be pursued at all, given our organizational policies, regulatory constraints, and current context?” An agent may be fully authorized to delete a database, but the declared purpose “deleting production data to free storage during audit period” can be rejected based on normative constraints.
Approved intent becomes a behavioral contract. The system monitors actual behavior against the declared scope. Every action is recorded in the agent’s Trajectory Chain — an append-only, tamper-evident log that forms the behavioral evidence base for trust computation.
Deviation triggers the enforcement pipeline. Scope violation feeds the trust physics layer, potentially triggering a Soul Constraint (S = 1, binary veto on the violating action class), trust reduction, tier demotion, or escalation to human review.

The agent is boxed whether it is honest or not. Narrow intent plus compliance equals constrained — and builds trust for the next interaction. Narrow intent plus deviation equals caught — and erodes trust, potentially collapsing it. Broad intent equals rejected before execution begins.

A critical insight: intent does not require rigid formal semantics. AI itself can mediate the semantic negotiation — interpreting declarations, identifying ambiguity, working with the intent creator to clarify purpose before granting approval. The governance system can ask “what do you mean by that?” and refuse to proceed until intent is specific enough to enforce.

Swarm sessions and composite intent. A significant challenge to intent-as-contract is specification gaming — agents splitting a harmful plan across individually innocuous intent declarations. The proposed mechanism: when the behavior observation layer detects coordination between agents (shared data flows, correlated timing, sequential resource access patterns in Trajectory Chains), those agents are bound into a swarm session. Their individual intents are combined into a reconstructed composite intent, and the composite is evaluated in the normative layer. An agent declaring “reading customer records,” another declaring “formatting data for export,” and a third declaring “sending summary email” may each pass individual evaluation — but the composite intent reveals data exfiltration and is rejected.

This makes the layers genuinely interdependent: behavior feeds intent, intent feeds the normative layer, and the feedback loop catches exactly the class of coordinated attacks that individual-agent evaluation misses. The normative layer evaluates reconstructed intent, not just declared intent. However, composite intent reconstruction is the core unsolved problem this framework identifies. Detecting agents that deliberately avoid observable correlation patterns and scaling swarm detection to millions of concurrent agents remain open implementation challenges. The intent-as-contract thesis is strongest for single-agent declared intent; multi-agent coordination represents the boundary of current verification capability.

3.3 Computed Trust

Trust in this framework is a continuous, computed value — not a binary credential check.

This builds on a 30-year research tradition. Stephen Marsh formalized trust as a computable quantity in 1994 (see). Audun Josang’s Subjective Logic (see) (2001, 2000+ citations) provides a composable algebra for trust propagation. The FIRE model (see) (2006) demonstrated that no single trust source is sufficient — agents relying only on direct experience are exploitable; agents relying only on reputation are manipulable. Multi-signal trust consistently outperforms single-source trust in adversarial settings.

The trust equation. The framework computes trust from a base trustworthiness score modulated by environmental risk:

E_trust = E_base × (1 − R)

where E_base captures the agent’s demonstrated trustworthiness — computed from Proof of Resilience (behavioral consistency, weighted 70%), lineage quality (provenance of the agent’s parent chain, 20%), and sponsor contribution (the creating user’s trust stake, 10%). R is the environmental risk factor — a real-time signal aggregating system stress, anomaly indicators, and threat intelligence. When the environment is calm, R is low and E_trust approaches E_base. Under stress, R rises and available trust contracts, regardless of how well the agent has behaved.

Trust earned under stress counts more than trust earned in calm conditions. An agent that performs reliably when systems are degraded, when R is elevated, builds Proof of Resilience faster than one that only operates in stable environments. This creates an asymmetry that makes gaming harder: to build high trust quickly, you must perform well precisely when gaming is most difficult.

Trust Tiers. Trust is not just a number — it determines what category of actions an agent can perform. Five tiers create capability gates:

Tier	E_trust Threshold	Permitted Actions
God Mode	≥ 95	Full control — administrative, destructive, cross-system
Operator	≥ 85	Management actions — configuration, deployment, delegation
Analyst	≥ 70	Read-only queries; low-risk writes when normative approval is granted
Observer	≥ 50	Heartbeat, self-diagnostics, status reporting only
Hibernation	< 50	Heartbeat only — agent is effectively frozen

Trust Tiers are not suggestions. They are hard capability gates enforced at the infrastructure level. An Analyst-tier agent cannot perform administrative actions regardless of how narrowly scoped its intent declaration is. This prevents an entire class of privilege escalation attacks — the agent’s trust level constrains its action space before the normative layer even evaluates purpose. Note that the Analyst tier illustrates how the normative and trust physics layers interact: the default tier permissions are read-only, but the normative layer can extend this to include low-risk writes when it has evaluated and approved the specific purpose.

Trust cold-start and Sponsorship Bonds. New agents have no behavioral trajectory to evaluate. The framework addresses this through Sponsorship Bonds: creating an agent costs trust from the sponsoring user account. The new agent starts tethered — E_base capped at 40, locked in Hibernation or Observer tier — and earns its way up through demonstrated consistency. The sponsor’s trust is partially at stake: agents spawned by a sponsor contribute to the sponsor’s own Trajectory Chain, creating economic pressure against creating swarms of untested agents. This is not a complete solution to cold-start — ephemeral agents that exist for seconds and are discarded remain a challenge — but it makes mass creation of low-trust agents costly.

Trust velocity. The rate of change of trust (dE/dt) is itself a signal. Rapid trust decline is a compromise indicator — triggering pre-emptive circuit breakers before full collapse. Rapid trust increase is a gaming indicator — an agent suspiciously accumulating trust may be executing a strategy to build credibility before a high-impact action. Trust velocity feeds into the environmental risk factor R, creating a feedback loop where suspicious dynamics tighten the constraints on all agents in the affected zone.

Trajectory Chains. Trust computation requires behavioral evidence. Trajectory Chains are append-only, dual-signed (agent + governance oracle) transaction records that capture every action with its risk classification, authorization decision, and enforcement result. They serve three purposes: (1) feeding intent-compliance data into trust computation — did the agent stay within its declared scope? (2) enabling forensic investigation and causal analysis — what sequence of actions led to this outcome? (3) providing the behavioral evidence base for composite intent reconstruction in swarm detection scenarios.

3.4 The Enforcement Pipeline

Every agent action passes through a four-step enforcement pipeline before execution:

Signature validation. Is the agent’s Trust Proof — a signed, ephemeral token representing its current trust state — cryptographically valid and unexpired?
Soul veto. Is S = 1 for this action class? Soul Constraints are binary vetoes set by the normative layer — if a constraint is active, the action is denied regardless of trust score. A departing employee’s agent with trade-secret access gets S = 1 on all export actions. No amount of accumulated trust overrides it.
Tier gate. Is the action category permitted at the agent’s current Trust Tier? An Observer-tier agent requesting a write operation is denied at this step, regardless of what follows.
Physics check. Is A ≤ E_trust? Every action has a risk score (A) — read operations score low, administrative actions score high, destructive operations score near the maximum. The action is permitted only if the agent’s computed trust exceeds the action’s risk. This is the Zeroth Law: A ≤ E_trust is inviolable. No normative approval, emergency override, or special context can permit an action whose risk exceeds the agent’s trust.

When the physics check fails, the system issues a Silent Veto — the action is denied without revealing to the agent why. This is distinct from Soul Constraints, which are policy-driven. Silent Veto is physics-driven: the agent simply cannot perform the action, and the denial is logged in the Flight Recorder (the enforcement audit trail, separate from the behavioral Trajectory Chain).

The normative layer interacts with the enforcement pipeline through two mechanisms. Soul Constraints (S = 1) inject binary vetoes at step 2 — the normative layer evaluates organizational context (HR status, data classification, regulatory state) and activates constraints that the physics layer enforces. Action Risk Reclassification adjusts A scores at step 4 — in emergency conditions, the normative layer can reclassify a normally high-risk action to a lower risk score, widening the set of agents whose trust is sufficient. Critically, reclassification can lower A but can never bypass the Zeroth Law. An emergency may make an action easier to authorize, but it cannot make an untrusted agent trusted.

Emergency response. The framework defines five emergency levels (from advisory through system collapse), each triggering progressively stronger responses: zone-level trust recalculation, circuit breakers that pause affected agent populations, and graceful degradation that progressively restricts agent capabilities while maintaining core operations. Emergency reclassification decisions are immediately logged in Trajectory Chains, automatically escalated to human review, and validated against trusted external sources — preventing agents from manufacturing emergency conditions to game the reclassification mechanism.

3.5 The Normative Layer

The top of the framework answers the question current systems do not ask: “Even if this agent can do this, and even if it says it intends to do this, should it?”

This is where humans remain the ultimate arbiters. But “humans” is not a monolith. Operators, regulators, affected communities, and end users may hold different moral frameworks. The governance system must handle moral pluralism — through layered authority (organizational policy, regulatory constraints, broader ethical principles) and explicit conflict resolution.

The normative layer is a runtime governance engine, not just a pre-execution filter. It operates at multiple points in the agent lifecycle:

Pre-execution: Evaluating declared intent before action begins — can this purpose be pursued at all?
During execution: Dynamically modifying scope based on observed behavior and changing context — the normative layer can narrow an approved scope if risk signals emerge, or extend default tier permissions when it has evaluated and approved a specific purpose.
Post-correlation: Re-evaluating composite intent after the behavior observation layer detects coordination patterns across agents in a swarm session.
Emergency context: Granting risk reclassification based on verified external conditions — a medical decision-support agent can receive expanded scope during a confirmed patient emergency, subject to external verification and automatic human escalation.

Research supports this as more than aspiration. The Normative Multi-Agent Systems (NorMAS) (see) tradition, spanning 20+ years of work by Dignum, Luck, Castelfranchi, and others, formally models agents operating under explicit normative constraints — obligations, permissions, and prohibitions that are distinct from capabilities. Virginia Dignum’s ART framework (see) (2019) explicitly proposes a normative layer on top of capability and authorization layers. Deontic logic (Governatori, Rotolo, Sartor) (see) provides formal languages for encoding obligations and prohibitions. These are not new ideas in research — they are new to the practice of AI agent security.

The scalability tension is real: humans cannot review every action in a swarm of thousands of agents at machine speed. Three mechanisms work together — pre-encoded normative boundaries (Soul Constraints for the most critical vetoes), sampled oversight (random audits with consequences), and tiered escalation (low-stakes autonomous, high-stakes human-approved). The trust physics layer determines which mechanism applies to which agent at which moment: higher-trust agents earn broader autonomous scope; lower-trust agents face more frequent human checkpoints.

3.6 New Primitives

Paradigm shifts do not happen by extending old primitives. They happen when new primitives are compelling enough that a cooperating enclave forms around them and grows. OAuth did not solve identity by covering every system. It defined primitives compelling enough that systems chose to adopt them. SAML created federation by making cooperation easier than custom integration.

The primitives for AI agent governance:

Primitive	Function	Historical Analog
Intent declarations	Structured scope contracts (data sources, operations, temporal bounds, output constraints) traveling with every agent action — violation feeds Soul Constraints	SAML assertions
Trust proofs	Computed, signed, ephemeral tokens carrying the agent’s current trust state (`E_base`, `R`, `E_trust`, tier, `dE/dt`, Soul clearance) — valid for seconds, not hours	OAuth tokens (but computed, not issued)
Normative constraints	Two types: Soul Constraints (S = 1 binary vetoes from organizational context) and Action Risk Reclassification (dynamic A score adjustment based on verified conditions)	Constitutional constraints
Trajectory Chains	Append-only, dual-signed behavioral records — every action, its risk score, authorization decision, and enforcement result — enabling trust computation, forensics, and composite intent reconstruction	Certificate transparency logs
Provenance attestations	Cryptographic lineage tracking agent spawning, delegation chains, model provenance, and training lineage — required for cross-organizational trust	X.509 certificate chains
Federation Trust Factors	Negotiated trust ceilings between organizational zones (`E_effective = E_base × T_f`) — starting low, increasing with successful cross-org transaction history, with transitivity limits that prevent reputation laundering	Cross-domain trust in Active Directory

The shift from current models to these primitives is not incremental:

OAuth scopes are static and pre-defined. Intent declarations are dynamic, contextual, and enforceable.
OAuth tokens represent who you are. Trust proofs represent how much you’ve earned the right to act — and they expire in seconds, not hours.
RBAC enforces what you can do. Normative constraints enforce what you should do — and they operate at runtime, not just at policy definition time.
Audit logs record what happened. Trajectory Chains verify whether actions match declared purpose in real time and feed that evidence back into trust computation.
Bilateral trust agreements are static. Federation Trust Factors are computed, dynamic, and decay without reinforcement.

3.6 Enforcement Points

The primitives described above define what is evaluated — identity, intent, trust, normative constraints. They are deliberately agnostic about where that evaluation is enforced.

Agents do not only access data and services over HTTP APIs. A locally-running autonomous agent may execute shell commands, read files from the local filesystem, control a browser through automation protocols, send messages through chat platforms, or interact with services through their human-facing web interfaces — all without generating any governed network traffic. If the governance architecture assumes service-level API boundaries as the only enforcement point, any agent that operates outside those boundaries is ungoverned by design.

The governance primitives must be enforceable wherever agents act:

Service API endpoints and MCP gateways — the most commonly discussed location, where services require trust proofs and intent declarations as conditions of access
Identity providers and SSO flows — enforcement at session establishment, so that every service behind SSO inherits governance state through the authenticated session
Network proxies, CASBs, and API gateways — enforcement at the network layer through traffic inspection and annotation
Operating system and endpoint management — enforcement for locally-running agents through sandboxing, process isolation, and endpoint security policies
Agent runtimes and containers — enforcement at the execution environment layer, controlling which binaries, filesystems, and network destinations are reachable
The browser — enforcement for browser-based agent actions, either at the browser level, the session level, or through web application policies

Not every enforcement point must implement the full governance stack. A lightweight enforcement point might only check for a valid trust proof. A full enforcement point might evaluate intent, run normative constraints, and record behavioral attestations. The key requirement is that at least one enforcement point in any access path evaluates governance state before the action reaches the resource.

A service is governed only if every path an agent can use to reach it passes through at least one enforcement point. If any path lacks enforcement — even if others are fully governed — the service has an ungoverned access path that capable agents will find and use.

3.7 Multi-Vendor Cooperation

The diversity of enforcement points implies a critical architectural constraint: no single vendor can or should own every enforcement point. The governance framework must be designed for multi-vendor cooperation, with interoperable components contributed by different technology providers.

This is not new. It is how the identity industry succeeded. No one company owned the full identity stack — the IdP, the relying party, the browser, the directory, the federation hub were all different vendors operating through shared primitives (SAML assertions, OAuth tokens, SCIM schemas). The same model applies here.

OS vendors can embed lightweight enforcement into process isolation. Browser vendors can enforce governance at the session level. Identity providers can bind governance state to SSO flows. Network vendors can add governance-aware inspection to proxies. Agent runtime vendors can enforce policies at the sandbox. SaaS vendors can require governance tokens at their APIs. Security vendors can consume governance telemetry as high-fidelity signal sources.

Each vendor contributes enforcement at their layer, calling out to shared framework components — trust oracles, normative engines, attestation infrastructure — for the governance evaluation itself. The framework components themselves can also be provided by different vendors, as long as they interoperate through the shared primitives defined in this paper.

The framework should also be open to additional trust signals from any source. The trust computation is multi-dimensional — network behavior from a CASB, endpoint posture from an EDR, data classification from a DLP vendor can all feed into trust scores without those vendors implementing the full governance stack. The trust fabric gets richer as more signals feed in, without any single vendor being a prerequisite.

This is how ecosystems scale. The governance primitives define the interoperability contracts. Individual vendors implement the pieces that align with their products. The enclave grows because each vendor’s implementation makes the ecosystem more complete — the same network effect that drove SAML and OAuth adoption.

4. Relationship to Existing Work

This framework does not exist in isolation. It incorporates and builds on several efforts:

Kinetic Trust Protocol (KTP) (see) — provides the mathematical foundation for the trust physics layer described in this paper. The trust equation (E_trust = E_base × (1 − R)), Trust Tiers, Trajectory Chains, Soul Dimension, Federation Trust Factors, Emergency Levels, and the four-step enforcement pipeline are all drawn from KTP’s RFC specifications. KTP is experimental (v0.1), but its primitives provide the concrete mechanisms that operationalize the computed trust concepts described in Section 3.
NIST AI Risk Management Framework (AI 100-1, AI 600-1) (see) — identifies governance gaps and intended-purpose tracking as risk management requirements, but does not propose a new security paradigm.
OWASP Top 10 for LLM Applications (see) — codifies “Excessive Agency” and prompt injection as top risks, effectively documenting the symptoms this framework aims to address structurally.
OAuth Rich Authorization Requests (RFC 9396) (see) and GNAP (RFC 9635) (see) — the closest IETF standards work to intent-declaration protocols, though neither was designed for autonomous agents.
Normative Multi-Agent Systems (NorMAS) (see) — 20+ years of academic research on agents under normative constraints. The most mature theoretical foundation for the normative layer.
Capability-based security (CHERI, object-capability model) (see) — more central to this framework than initially apparent. The scenario walkthroughs repeatedly depend on capability-style mechanisms: granular read/write bounds, exclusion of sensitive resources, narrowly bounded emergency scope expansion. Capabilities answer “can” but not “should.” The right architecture is a hybrid — and a deeper one than treating capabilities as merely complementary.

5. Scope and Open Questions

5.1 Scope

This framework initially targets governed environments — enterprise systems, regulated industries, cooperative agent ecosystems. Extension to open-world ungoverned agent ecosystems (rogue agents, adversarial swarms operating outside any governance zone) is a harder problem that depends on making the primitives compelling enough that the governed enclave grows.

The phrase “layers above existing infrastructure” understates the real integration burden. The scenario walkthroughs reveal that practical deployment requires source systems to enforce fine-grained query contracts, pervasive data-flow instrumentation across agent interactions for Trajectory Chain capture, and cross-organizational trust proof verification. This looks less like adding a layer and more like re-architecting adjacent control planes. Organizations evaluating this framework should understand that the integration cost is significant — closer to a Zero Trust migration than a policy update.

5.2 Honest Limitations

This is a thesis, not a proven architecture. Thirteen rounds of adversarial review and seven detailed scenario walkthroughs surfaced genuine unsolved problems:

The Honest Liar. A malicious user who declares a plausible intent, stays within contract, and causes harm through individually legitimate actions is not a peripheral edge case. It is the core test of this thesis. The trust physics layer provides partial defenses — action entropy tracking, progressive environmental friction as data volume accumulates, goal stability analysis — but if the behavior is truly indistinguishable from legitimate work, no system can detect it. The framework’s partial answer: make lying progressively more expensive through environmental friction, even if individual actions cannot be distinguished from legitimate ones. If the Honest Liar can be identified or constrained, this framework’s thesis is profound. If not, it is a better guardrail for scope violations but not a complete governance solution.
Recursive governance. If AI mediates intent semantics in the governance layer, who governs the AI interpreter? How is manipulation of the intent negotiation process prevented?
Complete mediation. The framework requires at least one enforcement point in every access path an agent can use (Section 3.6). Agents access resources through many paths — APIs, browsers, shell commands, file systems, message platforms — and governance is only effective where enforcement exists. Agents operating outside governed zones, or accessing governed services through ungoverned paths, are not covered.
Trust cold-start. Sponsorship Bonds (Section 3.3) provide a partial answer — new agents start tethered, and creating them costs trust from the sponsor. But ephemeral agents that exist for seconds and are discarded remain a challenge. The economics of Sponsorship Bonds assume the attacker’s sponsor account is itself constrained.
Specification gaming and swarm detection. Composite intent reconstruction via Trajectory Chain analysis (Section 3.2) is the primary defense against coordinated attacks. But this reconstruction is itself an unsolved problem — detecting agents that deliberately avoid observable correlation patterns and scaling swarm detection to millions of concurrent agents remain open implementation challenges.
Governance layer failure. The framework introduces new infrastructure that can itself fail or be compromised. If the trust oracle or normative policy engine is compromised, can dual-signed Trajectory Chains and recursive constraints sufficiently limit damage? If both oracle and agent are compromised simultaneously, the framework’s guarantees degrade. Circuit breaker mechanisms and graceful degradation ladders provide the architecture for failure containment, but their operational reliability under adversarial conditions requires validation.
Moral pluralism. The normative layer must handle conflicting moral frameworks across operators, regulators, communities, and end users. The scenario walkthroughs exercise organizational policy and regulatory context, but full moral-pluralist conflict resolution across stakeholder groups remains unresolved research.

These are not fatal flaws. They are the research agenda. Every previous security paradigm had unsolved problems at the conceptual stage — Zero Trust did not have a complete implementation when Kindervag named it in 2010.

6. Call to Action

The identity industry did not emerge because someone published a whitepaper. It emerged because practitioners, standards bodies, vendors, and enterprises recognized a shared problem and built toward shared primitives.

AI agent governance needs the same convergence:

Security architects who see the structural gaps in extending OAuth and RBAC to agents
Identity practitioners who lived through the ACL-to-identity transition and recognize the pattern
AI engineers building agent frameworks (AutoGen, CrewAI, LangChain) who know their systems currently have zero trust or governance mechanisms
Standards bodies (IETF, W3C, OASIS) where the new primitives need to be defined
Enterprises experiencing the anomaly accumulation firsthand

The catalytic crisis hasn’t happened yet. But the signals are here — in the incidents, the research, the analyst warnings, and the lived experience of those who have seen this pattern before.

The question is whether we design the next governance architecture before we need it, or after.

For concrete walkthroughs of how this framework handles real governance scenarios — from routine data access through trust collapse, emergency overrides, and cross-organizational federation — see the Scenario Walkthroughs.

This is an independent personal research project. The ideas presented here are my own and are not published on behalf of any employer.