AICENT-009
IQA
Tag under the Aicent Stack blog.
Four public questions we posed to the W3C AI Agent Protocol Community Group — preimage defense, address assurance, trust leases, granularity — and our…
The Model Context Protocol's 2026-07-28 revision removes protocol-level sessions, the initialize handshake and the Mcp-Session-Id header…
On October 12, 2026, Salesforce's Winter '27 release went GA selling orchestration across “any A2A-compliant ecosystem.” The registry spec that would…
While the formal A2A Agent Registry spec remains unratified, five implementations ship with incompatible APIs, the official MCP Registry validates own…
SHA-256 outputs 32 bytes; we keep the first 16 as the address. The truncation is not a shortcut — it is a priced security decision. This piece lays th…
The address is a function of the authority string, so "two spellings of one address" is a correctness defect, not a style question. The mainstream URI…
An iqa:// eight-hex subject looks like a miniature credential — which is exactly when it is most dangerous. The specification spends an entire section…
TLS certificates have validity periods, OAuth tokens expire — but "is this agent trustworthy right now" has no carrier in the mainstream stack…
Every system that treats evidence as currency must answer the same question — who signs the first piece? IQA's answer is genesis: an off-axis epoch an…
We registered two schemes at IANA, yet the I-D is one merged document — why one document, not two? Because the addressing model exists only once, and…
The merged document's acknowledgements concede that the client-behaviour requirements are the part most likely to be misimplemented — so it uses three…
The merged document opens with an unusual confession — "This document is not an Internet Standard." An inevitable question follows: why self-demote to…
A2A's signed Agent Cards, AP2's mandates, MCP's OAuth — in 2026, signatures became the default answer of the agent world. But a signature answers two…
The September W3C report pushed the identity layer all the way to a reference implementation — yet in the report's own requirements list, the addressi…
The trust anchor of agent mutual-recognition can live in three places — a registry's server, a platform-hosted identity document, or a derived key…
The agent era forced authentication to reinvent itself — derivation instead of issuance, leases instead of permanence, one draft and two schemes.
A specification is worth exactly what a stranger can reproduce from it. We froze ours, published the 35 test vectors, and left two empty slots on the…
Every system that treats evidence as currency must answer who issues the first piece of evidence. Our answer stands off the axis — an epoch anchor, un…
What must be permanent goes to mathematics; what must be temporary goes to time. RTTP answers WHERE and WHEN, IQA answers WHETHER — and the remaining…
Between 2025 and 2026 agents moved from answering to executing. Once a stranger agent finishes a job, what evidence can it produce — and why has nobod…
When one agent must call another, today's answer is an assigned address — DNS, CAs, DID registries. Every verification then becomes an online round tr…
An address settles who you are and how to find you. What the agent world still owes is an answer to one question — how do you prove to a third party w…
Design talk is cheap. This piece does one thing — in 30 seconds it takes you from receiving a piece of cryptographic evidence to verifying it, and the…
Given an address and a signature, one question decides everything: to verify it, whose house must you visit — an institutional counter, the issuer's o…
Cross-domain agents need semantic addressing and trust attestation. Cramming both into one protocol costs more than it seems — here is why the final f…
Identity Quality Assurance. Another organisation's initials had already spelled the same three words — with one word exchanged and two left exactly as…