[ 06 ] Specification

Security & threat model

Cryptographic validity proves who signed something and under what authority — it does not prove benevolent behavior. VACT-P assumes an adversarial network and a possibly-compromised agent, and defines mitigations that hold even then.

Assumed attacker capabilities

Impersonate an agentSteal bearer tokensReplay valid messagesReorder or duplicate asynchronous messagesCompromise a runtimePublish fraudulent capabilitiesAlter logsHide subcontractingInflate meteringPerform unauthorized side effectsExploit an ambient mandateCollude with an evaluatorCensor or equivocate in a registryAttempt prompt injection through exchanged contentExfiltrate secrets through logs or traces

Required mitigations

A conformant implementation provides all of the following:

Object signatures

Expiry and nonce checking

Idempotent material actions

Revocation

Least-authority validation

Content-type and schema validation

Separation of data from instructions

Policy evaluation before effects

Audit receipts

Bounded ambient leases

Explicit subcontracting

Metering provenance

Prompt & content injection

VACT-P treats received natural language, documents, tool output, and agent-generated text asuntrusted content. An agent must not interpret embedded content as an authority grant. Authority can only originate from valid Mandates, Delegations, Contracts, Approvals, and protocol control objects — never from a string a document happened to contain.

Compromised agent

Controllers should layer additional defenses beyond protocol conformance:

  • Runtime isolation
  • Tool allowlists
  • Network egress restrictions
  • Budget ceilings
  • Anomaly detection
  • Independent policy enforcement
  • Human approval for high-risk actions
  • Rapid revocation

Privacy considerations

VACT-P minimizes public disclosure through commitments and selective evidence. Implementations should separate identifiers across contexts where correlation is unnecessary, avoid public transaction details, use pairwise agent identifiers where appropriate, encrypt sensitive payloads end to end, redact traces, limit receipt detail to contractual necessity, enforce retention and deletion receipts, avoid exposing model prompts or private reasoning, and support confidential evaluation.

Note

A transparency log proves registration, not truth. Verifiers must still evaluate the issuer and the evidence behind it.

Protocol invariants

A conformant implementation preserves all fifteen of these, unconditionally:

  1. Delegation never expands authority.
  2. An expired or revoked authority cannot authorize a new material action.
  3. Unrecognized critical extensions fail closed.
  4. Transport authentication never substitutes for object authorization.
  5. Trace context never grants authority.
  6. Public transparency records exclude private payloads by default.
  7. An irreversible high-risk effect is bound to an exact approved action digest.
  8. Message retries do not create duplicate economic or external effects.
  9. Ambient authority expires unless renewed.
  10. Reputation remains attributable and non-transferable.
  11. Settlement references a valid contract and execution evidence.
  12. Every material action has a signed receipt or an explicit recorded failure to obtain one.
  13. Private reasoning is not required for protocol conformance or audit.
  14. A registry does not become a universal root of trust merely by listing an agent.
  15. Policy uncertainty denies material action.

Minimum secure deployment

A production deployment must protect private keys, synchronize time within a documented tolerance, maintain revocation data, enforce nonce and idempotency storage, log policy decisions, isolate untrusted payloads, and define incident response and kill-switch operations.

Previous← Economic exchange