Skip to content

Commit 601e1e4

Browse files
chrishooooo-netizenclaude
chrishooooo-netizen
and
claude
authored
spec: v1.2.0-draft - PlatformIdentityBinding VC + Managed Agent deployment identity
* docs: add Managed Agent Support section to README Introduces did:trail:agent:* identifier mode and PlatformIdentityBinding VC as v1.2 spec extensions for platform-hosted AI agents (Anthropic Managed Agents, Azure AI, Google Vertex). Key design: deployer-signed binding, no platform cooperation required for EU AI Act Art. 12 audits. References upcoming Issue #6 for full spec proposal. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs: fix issue reference #6 -> #9 * spec: add v1.2.0-draft - PlatformIdentityBinding VC + Managed Agent deployment identity - Extends §4.2 agent mode with deployment vs. instance distinction - Adds §7.5 PlatformIdentityBinding VC (normative) - Updates ToC and version to 1.2.0-draft - Adds changelog entry referencing Discussion #10 and Issue #9 Closes: partial - full normative text, community input pending --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 26b1d17 commit 601e1e4

2 files changed

Lines changed: 165 additions & 3 deletions

File tree

‎README.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,13 +190,63 @@ The `methods/trail.json` file in this repository is submitted for inclusion in t
190190

191191
---
192192

193+
## Managed Agent Support (v1.2 — in progress)
194+
195+
Platform-hosted AI agents (Anthropic Managed Agents, Azure AI, Google Vertex) challenge a core assumption of the current spec: that an agent has a stable, persistent identity and can directly create its own DID.
196+
197+
In practice, platform agents are **dynamically provisioned per session** — no persistent running instance, no direct registry access. The persistent entity is the *deployment* (a configuration), not the running instance.
198+
199+
did:trail v1.2 introduces two spec extensions to address this:
200+
201+
### Agent Deployment Identity (`did:trail:agent:*`)
202+
203+
A new identifier mode for agent deployments registered by the deploying organization:
204+
205+
```
206+
did:trail:agent:{deployment-suffix}
207+
```
208+
209+
- Registered by the **deployer organization** (which holds a `did:trail:org:*` DID)
210+
- Represents one deployment configuration across all its instances
211+
- Lifecycle tied to the active deployment, not individual sessions
212+
- Linked to the deployer's org DID via `trail:parentOrganization`
213+
214+
### Platform Identity Binding VC
215+
216+
A new VC type (`PlatformIdentityBinding`) that links a platform's internal deployment ID to a `did:trail:agent` DID — **signed by the deployer, not the platform**.
217+
218+
```json
219+
{
220+
"type": ["VerifiableCredential", "PlatformIdentityBinding"],
221+
"issuer": "did:trail:org:acme-corp-eu-a7f3b2c1e9d0",
222+
"credentialSubject": {
223+
"id": "did:trail:agent:acme-sales-agent-v2-de-3f8c",
224+
"platformIdentity": {
225+
"platform": "anthropic",
226+
"deploymentId": "managed-agent-deployment-abc",
227+
"attestedBy": "did:trail:org:acme-corp-eu-a7f3b2c1e9d0"
228+
}
229+
}
230+
}
231+
```
232+
233+
This design means **no platform cooperation is required** for external audit. A BaFin auditor verifying an EU AI Act Art. 12 audit trail does not need to contact Anthropic, Azure, or Google. The deploying organization attests the binding from its own accountability — consistent with the Tier 1 KYB model already in the spec.
234+
235+
The same pattern works across all platforms without platform-specific code in the spec.
236+
237+
Full spec proposal: see [Issue #9](https://github.com/trailprotocol/trail-did-method/issues/9) — community input welcome.
238+
239+
---
240+
193241
## Roadmap
194242

195243
- [x] v1.0 — Specification draft
196244
- [x] v1.0 — W3C DID Registry submission (PR #669)
197245
- [x] v1.1 — Reference implementation (`@trailprotocol/core`) with CLI
198246
- [x] v1.1 — Specification v1.1.0-draft (9 critical improvements)
247+
- [ ] v1.2 — Managed Agent Support (`did:trail:agent:*` + `PlatformIdentityBinding` VC)
199248
- [ ] v1.2 — TRAIL Registry alpha (Early Adopter Program)
249+
- [ ] v1.2 — EU AI Act Art. 12 compliant audit log API
200250
- [ ] v2.0 — Production registry + independent security audit
201251
- [ ] v2.1 — Universal Resolver driver
202252
- [ ] v3.0 — EUDIW integration + B2C extension

‎spec/did-method-trail-v1.md‎

Lines changed: 115 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# did:trail Method Specification
22

3-
**Version:** 1.1.0-draft
3+
**Version:** 1.2.0-draft
44
**Status:** Draft
55
**Authors:** Christian Hommrich (TRAIL Protocol Initiative)
66
**Contact:** christian.hommrich@gmail.com
@@ -53,6 +53,7 @@ This document is a **Draft** specification submitted for registration in the [W3
5353
- 7.2 [Trust Tiers](#72-trust-tiers)
5454
- 7.3 [Trust Score](#73-trust-score)
5555
- 7.4 [EU AI Act Alignment](#74-eu-ai-act-alignment)
56+
- 7.5 [Platform Identity Binding (Managed Agent Support)](#75-platform-identity-binding-managed-agent-support)
5657
8. [Security Considerations](#8-security-considerations)
5758
- 8.1 [Key Security](#81-key-security)
5859
- 8.2 [Crypto Agility](#82-crypto-agility)
@@ -234,14 +235,20 @@ did:trail:org:acme-corp-eu-a7f3b2c1e9d04f5a
234235
did:trail:org:deutschebank-ai-desk-e2f4a6b8
235236
```
236237

237-
#### `agent` — AI Agent Identity
238-
Identifies a specific AI agent or AI-powered service instance operated by an organization. MUST be associated with a parent `org` DID.
238+
#### `agent` — AI Agent Deployment Identity
239+
Identifies an AI agent **deployment** operated by an organization. A deployment is a named, versioned configuration of an AI system — distinct from any individual running instance. MUST be associated with a parent `org` DID via the `trail:parentOrganization` property.
239240

240241
```
241242
did:trail:agent:acme-corp-eu-rfq-assistant-v1-d4e5f6a7b8c3
242243
did:trail:agent:db-contract-analysis-prod-001-c8d9e0f1a2b4
243244
```
244245

246+
**Deployment vs. Instance:** The `agent` DID identifies the *deployment configuration*, not a running process. This distinction is critical for platform-hosted agents (e.g., Anthropic Managed Agents, Azure AI, Google Vertex AI) that are dynamically provisioned per session. A single `did:trail:agent` DID covers all instances spawned from one deployment configuration, across all sessions, for the active lifetime of that deployment. This maps to the "Deployment vs. Pod" distinction in container orchestration.
247+
248+
**Registration authority:** The `did:trail:agent` DID is created and registered by the **deploying organization** (which MUST hold a `did:trail:org` DID), not by the agent itself. Agents operating on third-party platforms (managed agents) cannot directly interact with the TRAIL Registry. The deployer acts as the accountable principal for all agent instances.
249+
250+
**Lifecycle:** The `did:trail:agent` DID remains active as long as the deployment is active. Deactivation of the deployment DID (§6.4) implicitly revokes all active sessions of that deployment. Individual session termination does not require registry interaction.
251+
245252
#### `self` — Local Verification Mode
246253
DIDs are cryptographically self-contained and verifiable without external registry lookup. Represents the foundational trust tier of the TRAIL ecosystem, providing cryptographic identity verification without organizational attestation.
247254

@@ -1018,6 +1025,99 @@ TRAIL provides technical infrastructure that organizations can use to support th
10181025
| **Art. 49** (Registration) | Providers and deployers must register high-risk AI systems in the EU database | TRAIL Trust Registry can serve as a complementary technical registry alongside the official EU database | TRAIL is NOT the official EU AI database. Registration in TRAIL does not satisfy Art. 49. Organizations MUST register in the official EU database independently. |
10191026
| **Art. 52** (Transparency for Certain AI Systems) | Persons interacting with AI must be informed they are interacting with AI | TRAIL DID can be presented in real-time to verify AI system identity; TRAIL Badge provides visual indicator | TRAIL provides the verification mechanism. Organizations must ensure actual notification is delivered to affected persons in a clear and timely manner. Implementation of UI/UX notification is the organization's responsibility. |
10201027

1028+
### 7.5 Platform Identity Binding (Managed Agent Support)
1029+
1030+
Platform-hosted AI agents (e.g., Anthropic Managed Agents, Azure AI, Google Vertex AI) are dynamically provisioned per session and cannot directly interact with the TRAIL Registry. This section defines the `PlatformIdentityBinding` Verifiable Credential type, which enables deploying organizations to establish a cryptographically verifiable link between a platform's internal deployment identifier and a registered `did:trail:agent` DID — without requiring platform cooperation.
1031+
1032+
#### 7.5.1 Motivation
1033+
1034+
When an enterprise deploys an AI agent on a third-party platform, two identity namespaces exist:
1035+
1036+
1. **Platform namespace** — An internal deployment identifier assigned by the platform operator (e.g., `managed-agent-deployment-abc`). This identifier is platform-specific and not externally resolvable without platform cooperation.
1037+
2. **TRAIL namespace** — The `did:trail:agent` DID registered by the deploying organization, externally resolvable and cryptographically verifiable.
1038+
1039+
An external auditor (e.g., a BaFin compliance officer verifying EU AI Act Art. 12 conformance) needs to establish that a specific platform deployment corresponds to the organization's registered identity — without contacting the platform operator. `PlatformIdentityBinding` provides this link.
1040+
1041+
#### 7.5.2 PlatformIdentityBinding Credential
1042+
1043+
The `PlatformIdentityBinding` credential is issued by the **deploying organization** (not by the platform). The deployer's `did:trail:org` DID MUST be the credential issuer.
1044+
1045+
**Normative definition:**
1046+
1047+
```json
1048+
{
1049+
"@context": [
1050+
"https://www.w3.org/2018/credentials/v1",
1051+
"https://trailprotocol.org/ns/credentials/v1"
1052+
],
1053+
"type": ["VerifiableCredential", "PlatformIdentityBinding"],
1054+
"issuer": "did:trail:org:acme-corp-eu-a7f3b2c1e9d04f5a",
1055+
"validFrom": "2026-04-01T00:00:00Z",
1056+
"validUntil": "2027-04-01T00:00:00Z",
1057+
"credentialSubject": {
1058+
"id": "did:trail:agent:acme-sales-agent-v2-de-3f8c",
1059+
"platformIdentity": {
1060+
"platform": "anthropic",
1061+
"deploymentId": "managed-agent-deployment-abc",
1062+
"attestedBy": "did:trail:org:acme-corp-eu-a7f3b2c1e9d04f5a"
1063+
}
1064+
},
1065+
"credentialStatus": {
1066+
"id": "https://registry.trailprotocol.org/1.0/status/2026-04#17",
1067+
"type": "StatusList2021Entry",
1068+
"statusPurpose": "revocation",
1069+
"statusListIndex": "17",
1070+
"statusListCredential": "https://registry.trailprotocol.org/1.0/status/2026-04"
1071+
}
1072+
}
1073+
```
1074+
1075+
**Field definitions:**
1076+
1077+
| Field | Requirement | Description |
1078+
|-------|-------------|-------------|
1079+
| `issuer` | MUST | The `did:trail:org` DID of the deploying organization. MUST match `credentialSubject.platformIdentity.attestedBy`. |
1080+
| `credentialSubject.id` | MUST | The `did:trail:agent` DID of the deployment. |
1081+
| `platformIdentity.platform` | MUST | Lowercase identifier of the platform operator. Registered values: `anthropic`, `azure`, `google`, `aws`, `other`. |
1082+
| `platformIdentity.deploymentId` | MUST | The platform's internal deployment identifier, as assigned by the platform operator. |
1083+
| `platformIdentity.attestedBy` | MUST | The `did:trail:org` DID of the attesting organization. MUST equal `issuer`. |
1084+
| `validFrom` / `validUntil` | MUST | Validity period of the binding. SHOULD not exceed 12 months. |
1085+
| `credentialStatus` | MUST | Revocation status entry conforming to W3C VC Status List 2021. |
1086+
1087+
#### 7.5.3 Verification Requirements
1088+
1089+
A verifier receiving a `PlatformIdentityBinding` credential MUST:
1090+
1091+
1. Resolve `credentialSubject.id` via the TRAIL Registry and verify the `did:trail:agent` DID is active.
1092+
2. Resolve `issuer` via the TRAIL Registry and verify the `did:trail:org` DID is active and at Tier 1 or above.
1093+
3. Verify that `issuer` equals `credentialSubject.platformIdentity.attestedBy`.
1094+
4. Verify the credential signature against the issuer's public key.
1095+
5. Verify the credential has not been revoked via `credentialStatus`.
1096+
6. Verify `validFrom` and `validUntil` bounds against the current timestamp.
1097+
1098+
A verifier MUST NOT require platform operator cooperation to complete verification. The binding is self-contained and externally auditable.
1099+
1100+
#### 7.5.4 Accountability Model
1101+
1102+
The `PlatformIdentityBinding` design preserves the Tier 1 accountability principle: the deploying organization is the accountable principal, not the platform operator. The deployer:
1103+
1104+
- Creates and maintains the `did:trail:agent` DID
1105+
- Issues and signs the `PlatformIdentityBinding` credential
1106+
- Is responsible for revoking the credential if the deployment is decommissioned or compromised
1107+
1108+
This design is platform-agnostic: the same pattern applies to Anthropic Managed Agents, Azure AI services, Google Vertex AI deployments, and future platforms without requiring platform-specific extensions to this specification.
1109+
1110+
#### 7.5.5 EU AI Act Art. 12 Audit Trail
1111+
1112+
For high-risk AI deployments subject to EU AI Act Article 12 (Record-Keeping), the `PlatformIdentityBinding` credential enables a cross-jurisdictional audit trail that:
1113+
1114+
- Does not require platform cooperation to access
1115+
- Is cryptographically bound to the deploying organization's verified identity
1116+
- Is accessible to EU regulatory bodies without triggering CLOUD Act concerns
1117+
- Can be independently verified by any party holding the TRAIL Registry's public key
1118+
1119+
Organizations claiming EU AI Act Art. 12 compliance via TRAIL SHOULD maintain `PlatformIdentityBinding` credentials for all managed agent deployments and ensure revocation occurs within the timeframes specified in §8.6.
1120+
10211121
---
10221122

10231123
## 8. Security Considerations
@@ -1655,6 +1755,18 @@ Note: The JCS output differs from the input in key ordering (`@context` sorts be
16551755

16561756
## 15. Changelog
16571757

1758+
### v1.2.0-draft (2026-04-10)
1759+
1760+
This release adds normative support for platform-hosted AI agent deployments (Managed Agents). It addresses the structural gap identified in v1.1.0-draft: the assumption that an agent has a persistent identity and can directly interact with the TRAIL Registry does not hold for agents dynamically provisioned per session by third-party platforms.
1761+
1762+
| # | Change | Sections Affected |
1763+
|---|--------|-------------------|
1764+
| 1 | **Extended `agent` mode — Deployment vs. Instance distinction** — The `agent` identifier mode now explicitly represents a *deployment* (configuration), not a running instance. Added normative text on registration authority (deployer org), lifecycle semantics, and platform-hosted agent support. | §4.2 |
1765+
| 2 | **Added `PlatformIdentityBinding` VC type** — New credential type enabling deploying organizations to cryptographically link a platform's internal deployment ID to a `did:trail:agent` DID. Signed by deployer, not platform. No platform cooperation required for audit. Full normative definition including field requirements, verification algorithm, accountability model, and EU AI Act Art. 12 audit trail guidance. | §7.5 (new) |
1766+
1767+
Community discussion: [GitHub Discussion #10](https://github.com/trailprotocol/trail-did-method/discussions/10)
1768+
Tracking issue: [Issue #9](https://github.com/trailprotocol/trail-did-method/issues/9)
1769+
16581770
### v1.1.0-draft (2026-03-04)
16591771

16601772
This release addresses 9 critical improvements identified during community review and internal audit of v1.0.0-draft.

0 commit comments

Comments
 (0)