Four questions to the W3C AI Agent Protocol Community Group

Sources cited in this piece · our letter to the list: Four open questions on the Agentic Web report (2026-09-24): preimage defense, address assurance, trust leases, statement granularity, sent to public-agentprotocol@w3.org on 18 October 2026, on the wall as archive No. 0009 — primary source, quoted verbatim · the reply it drew from the author of draft-pidlisnyi-aps (21 October 2026, No. 0011) and our answer the same day (No. 0012), quoted verbatim from the same archive · the other October 2026 traffic on that list, quoted from the same public archive by subject and date (individuals are referred to by role, not named) · our prior reading of the report: w3c-review, and our own first-pass answers: four-answers.

On 18 October 2026 we sent four open questions to the public mailing list of the W3C AI Agent Protocol Community Group. They are our questions, but they are not about us. They are four rows of the agentic stack that we could not find answered — not in the Community Group's technical report on Agentic Web protocols dated 24 September 2026, and not anywhere else we looked.

One thing should be said before anything else, because it is the kind of detail that otherwise gets discovered later and read as spin — and because its conclusion has since reversed: the letter now stands in the public archive, as No. 0009, dated 18 October. The manual-review queue that this piece originally worried about did not stop the letter and, on the evidence of the archive, did not even slow it much. We are publishing the four questions here together with everything they have drawn so far, because a public question and the record of what it drew belong under the same roof.

1. The letter, in its own words

The message opens by saying who is writing, and it says it in the plainest available terms: “We are the authors of draft-li-rttp-iqa-addressing-00 (in ISE review), the specification behind two provisionally registered URI schemes at IANA: Resonant Time Transfer Protocol (rttp, CRI 27) and Identity Quality Assurance (iqa, CRI 28).” It records that we read the report line by line and published the reading, and it states the posture before the questions, because the posture is the part that tends to be misread: “We enter the discussion with four public questions rather than claims — each one is a gap we could not find an answer to, in the report or anywhere else.”

Then the four, printed here as they were sent.

Q1 — Preimage defense. “DID documents answer "who holds the key" — but which layer answers preimage defense against impersonation of an in-use authority? Is detecting a swapped identity document a matter of protocol, or of luck?”

Q2 — Address assurance. “discovery depends on the discoverability of description documents — who vouches for the address of a description document itself? Should addressing be split out of "discovery" and specified as an independent layer?”

Q3 — Trust leases. “TLS certificates have validity periods — does an agent's trust have a lease? Which layer carries the freshness and expiry of statements?”

Q4 — Granularity. “must cross-platform interoperability take the "platform" as its unit (federated), or can it sink to the "statement" as its unit (registry-free)? Are the two granularities complementary?”

The letter does not leave its own questions hanging on our side either, and it says so: “We have also published our own first-pass answers to all four, so the questions do not hang unanswered on our side either… offered as one hand-in among possible answers, not a claim to the last word.”

One correction we owe the reader, because it is a correction we owe ourselves first. The letter as sent closed by offering to present briefly at one of the Community Group's biweekly meetings. That offer was written before we had finished thinking about what we actually want to commit to. The honest position is not that we cannot attend — it is that nothing behind these four questions needs us in the room. So we state the position here in the form we can keep: we will discuss all four asynchronously, in writing; and if the group wants the four questions put in front of a meeting, we will supply the written material — a short brief, or the figures already published — for someone else to present, and answer any question in writing afterwards. Everything behind these rows is built to be checked without us: run the conformance vectors, replay the derivation, verify the envelope offline. Asking us to show up would put a person where a procedure should be, and that is the one thing we refuse to do — to ourselves and to the reader.

2. The first echo: a revoke inside the lease window

On 21 October, three days after the letter's date, the first substantive reply arrived — from the author of draft-pidlisnyi-aps, an independent Internet-Draft called the Agent Passport System: a delegation-and-enforcement layer in which authority narrows monotonically along seven dimensions as it is delegated, and each step is checked at an execution boundary. Different layer, same stack. The reply skipped the pleasantries and went straight at Q3, with the sharpest counterexample the thread has seen so far. His own design first, verbatim: “in Agent Passport System a delegation carries its own expiry and can be revoked before it, and the check runs at the moment of action rather than when the statement is fetched.” Then the question, verbatim: “A 120-second lease bounds how stale a cached statement can be, but an action in second 119 can still rely on a statement its issuer revoked in second 10. How does rttp handle a revoke inside the lease window?”

It is a good question, and the honest answer begins by conceding its premise: the lease bounds the exposure, it does not eliminate it — and the design says so rather than hiding it. Our reply, posted to the wall the same day, made the bound explicit in three moves. First, default revocation is non-renewal: trust is re-earned every 120 seconds or it lapses, so the cheapest revoke an issuer can perform is to stop re-attesting, and the statement ages out at the next lease boundary — worst-case exposure equals the lease length itself, accepted in exchange for verification that completes offline. Second, explicit revocation is not an out-of-band promise: the iqa scheme's closed action set includes revoke, specified as withdrawing the subject's standing — a state transition at the named organ, toward ghost in the four-state set. Third, the lease is a floor, not a ceiling: for actions whose risk profile cannot tolerate the window, the verifier runs a live standing read at the moment of action — which is exactly what the Agent Passport System does at its execution boundary. The sentence we would keep from our own reply, verbatim: “So the honest formulation is: Resonant Time Transfer Protocol (RTTP) does not push revocations inside the window; it prices the window.”

What the exchange confirmed is the convergence, not the difference, and our reply said so, verbatim: “your APS runs the check at the action, ours re-earns the trust at the lease boundary — both are bounded exposures, with different bounds and different trust roots (monotonic delegation chains versus derived addresses plus signed statements).” That maps onto Q4: delegation-chain enforcement and statement-level verification look complementary rather than rival — a delegation could carry an IQA statement as one of its narrowing dimensions without either layer borrowing the other's authority. And the shape of the first echo is itself evidence for the claim the four questions were built on: the first answer came from a delegation layer, answering a freshness question — the rows are real, neighbouring layers feel them, and they are answerable.

3. What the wall was already talking about

The letter landed in a room that was already having conversations, and the room matters as much as the question. The October archive of that list holds, leaving our own thread aside, four substantive threads and two calendar notices. Read them as a map of where the Community Group's attention actually is.

The largest thread by reply count is “An open map of agentic standards work, including this group” (15 October, with two replies the same day). Somebody is drawing a map of the standards landscape and, by the subject line's own admission, putting this Community Group on it. That is the single most useful thing on the wall for anyone working on addressing, because a map is where a layer either appears as a row or is silently absorbed into whichever neighbouring box the mapper happened to have.

The second is “Intro + a lifecycle/presence contribution offer (Living Agents Protocol)” (7 October). A lifecycle-and-presence contribution is an offer about exactly the row our Q3 asks about: what it means for an agent to be present, to persist, and to stop being present. We have a specific answer to that row — a 120-second lease with a closed four-state set — and an independent party arriving at the same row from a different direction is the best possible sign that the row is real and not an artefact of our own vocabulary.

The third is “Proposal: cost and budget metadata for the AI Agent Protocol” (5 October, with replies on 6 and 7 October) — a concrete metadata proposal, which is a useful signal about the group's character: this is a body that writes specifications, not one that only holds discussions.

And the two calendar notices bracket the month: “Event Canceled: AI Agent Protocol CG Meeting” (1 October) and “Event Updated: AI Agent Protocol CG Meeting” (19 October), both posted by the W3C Calendar system. Meetings get scheduled, cancelled, and rescheduled here as a matter of routine. That is worth stating plainly, because a calendar notice is easy to misread as a signal about oneself, when it is only a room changing its time.

4. Why questions, and why now

The choice to arrive with questions rather than a proposal is deliberate, and it is worth defending in public because it is usually read as modesty when it is actually a method. A proposal asks a group to adopt something, which invites the group's immune response. A question asks a group to answer something, which invites the group's expertise. If the group's own mechanisms already answer all four, then the correct outcome is that the four rows get filled by the report's own design and our specification goes back to being a narrow answer to a narrow problem.

The honest status, stated so that nobody has to infer it: the letter stands in the public archive as No. 0009, replies are possible, and the first substantive one arrived on 21 October — aimed, as it happens, straight at Q3. This piece is published now not to rescue the questions from a queue; the queue is no longer the story. The record of the questions belongs next to the record of what they drew.

5. What we think the four rows are

We have published our own answers, so this section is short and it is not a pitch.

Q1 is a question about derivation. If an address is looked up, then impersonation is a race between the attacker and whoever notices; if an address is computed from a canonical authority, then producing a second authority that yields the same address is a second-preimage problem, and its cost is arithmetic rather than organisational. That is the property behind RTTP (rttp://), the scheme that answers where and when — Resonant Time is the name: an address with no time bound is only an agent DNS.

Q2 is a question about whether addressing is its own layer or a sub-clause of discovery. Our position is that it is its own layer, and that discovery should be left to whoever wants to build it — a derived address does not need a directory in order to be correct.

Q3 is a question about time. A statement without an expiry is a statement nobody re-checks, which is why IQA (iqa://) puts a 120-second standing on every statement it carries, with a closed four-state set and fail-closed parsing, and why verification is local arithmetic — so that the three offline tests, disconnection, survival, and explanation, mean something. That is the scheme that answers whether.

Q4 is a question about the unit of interoperability. We think the platform is the right unit for governance and the statement is the right unit for verification, and that the test for choosing a unit is simple: pick the unit you can verify without asking anyone's permission.

In one line: rttp resolves where and when; iqa states whether — and where the two agree, action begins.

6. What we are actually offering

Stated once, plainly, so that there is no ambiguity about what we will and will not do.

We will discuss all four questions in writing, on the list or anywhere else, for as long as anybody wants to. That is the part we are good at, and it is the part that produces a record other people can check. The first exchange ran exactly that way: a counterexample in, an answer out, both on the wall, both checkable without us.

We do not need to attend live technical calls, and that is not a limitation — it is the design. Everything behind these four questions is published so that it can be checked without us: run the conformance vectors, replay the derivation, verify the envelope offline. A meeting where we speak adds a voice; the vectors add a result. We prefer results.

What we can hand over instead is the material: our reading of the report, our own first-pass answers to all four, the specification behind them, the published conformance vectors, and a verification path that runs without a network. If the Community Group wants the four questions in front of a meeting, somebody else can present them from that material, and we will answer whatever comes back in writing.

The questions stopped being ours the day the letter went up; they now belong to whoever can answer them. The first answer came from a delegation layer, and it took the row our Q3 asked about seriously enough to attack it — which is the outcome the method predicted. If a lifecycle-and-presence contribution ends up carrying the lease row better than our lease does, that is a better outcome than winning the row, because the row is the thing that was missing — not our name on it.