AICENT.COM
← Back to Blog

Standing is a lease, not a reputation: after first contact

2026-10-22 · RTTP · IQA
Reading the Draft · No. 11 · Sources cited in this piece: W3C AI Agent Protocol CG meeting minutes, 21 October 2026 (quoted verbatim) · our draft draft-li-rttp-iqa-addressing-00 · AICENT-009 (iqa://) · iqa.org/scenarios · Sister pillars: rttp:// (CRI 27) · iqa:// (CRI 28)

The last trust hour of the W3C Agent Protocol CG's 21 October meeting asked the question every identity system eventually reaches: what does first contact prove? The minutes record the worry verbatim: “Discovering metadata and cryptographic keys can support authentication, but it does not automatically establish a cross-domain community's trust relationships.” The observation that closed the hour is just as blunt: “No single trust model was selected, and no claim was made that DID, CIMD, or OAuth alone solves reputation or service quality.” Two sentences, and the room had walked past the oldest bootstrap shortcut on the internet.

First contact · two answersTOFU · trust on first usefirst contacttrust everything, forever · no expiry · no re-checkthe lease · standing as a time boundfirst contactlease 120 sre-checkpass/renewor REJECTfail-closedat expirythe minutes: authentication “does not automatically establish a cross-domain community's trust relationships”a fact without an expiry is a fact nobody re-checked
Figure 1: the two answers to first contact. TOFU converts one successful handshake into standing trust; the lease converts standing into something that must be re-earned on a clock, and expires into REJECT rather than silence.

TOFU and its fine print

Trust on First Use is how the web's own plumbing bootstrapped itself — SSH made it famous, and certificate transparency exists because first-contact trust, left alone, curdles. The meeting's contribution was to name the separation explicitly: establishing a trustworthy environment is one process, and transacting inside that environment is another; initial contact is not a license to trust a counterparty for everything. That separation is the honest core of the hour, and the minutes protect it with a negative claim — no protocol discussed, not DID, not CIMD, not OAuth, was offered as a solution to reputation. Nobody promised what nobody can deliver.

Identity security is not service quality

The second distinction the room drew belongs in every agent-identity deck from now on: “Proving that a message reaches the intended agent and that the agent controls its identity is different from deciding whether that agent provides reliable or high-quality service.” Our second pillar was built on exactly that difference. IQA (iqa://) attests that a claim stands — that a subject's statement is valid, within a lease, signed by an organ. It does not review, rank or recommend. An attestation that silently graded quality would be a review score wearing a cryptographic costume; the whole point of the closed action set is that the organ answers whether, and only whether. The first pillar stays out of the same trap from the other side: RTTP (rttp://) answers where and when an intent is addressed, and carries no opinion at all about the party so addressed.

Standing is a lease

In our vocabulary, the property that sits between authentication and reputation has a name: standing — a statement is true within a time bound, not merely true when signed. The mechanism is deliberately small: a 120-second lease carried in the bytes themselves, four states (ghost, probation, radiant, genesis), and failure that closes doors — an expired or unreachable verification is REJECT, never a shrug. The verifier checks the lease against its own clock, offline; the protocol never needs to be asked for permission to complete a verification. And because real channels are slower than ideals, the lease comes in three operating modes: a live lease for networks fast enough to honor 120 seconds; a lease residual for store-and-forward paths, where the bytes state their own age; and an archival mode for paper and audit copies, which verify fully and claim no freshness at all. A satellite courier and a pigeon never pretend to be fresh — the bytes say how old the claim is, and the receiver decides with open eyes.

One lease · three operating modeslive lease120 s window · reject on skewfiber · cellular · local linkslease residuallast known lease · age stated in the bytessatellites · store-and-forwardarchivalno freshness check · seal fully verifiablepaper · postal · audit copiesslow channels do not get longer leases — they get a mode that does not pretend to be freshthe receiver checks the lease with its own clock, offline · the protocol never grants permission to verifymodes per iqa.org/scenarios and AICENT-009; the lease figure is from our draft, not from the CG meeting
Figure 2: the three operating modes. The 120-second window constrains honest networks; slow channels get honesty about their own latency instead of a lease that lies. The receiver's clock, not the network's, is the referee.

What we are not claiming

We do not claim a reputation system, and the meeting did not either. An organ attests that a claim stands within its lease; it never vouches for quality, and no four states — ghost, probation, radiant, genesis — should be read as grades. The gap between the keys are held and the service is good is filled by experience, evidence and institutions, and protocols can only make sure the question is asked honestly each time. That is not a limitation we apologizingly disclose; it is the boundary that makes the mechanism auditable.

One line: first contact buys you a key, not a character reference; the protocol's job is to make the lease re-earned every 120 seconds — and to make sure that when it is not, everything fails closed.

SEALED rttp://43a77f5d.blog.aicent · iqa://43a77f5d0ceda3372511f1972e3bfd25.forge.iqa · seal record