Attestation
A Trust Protocol That Skips the Central Authority Entirely
Most agent-accountability proposals still lean on someone to vouch for someone else — a registry, a certificate authority, a platform operator. A paper titled "Trust Without Trusting: A Recomputable Trust Protocol for Autonomous Agents" takes a different approach: instead of a central party attesting that an agent is trustworthy, the protocol makes trust something any party can recompute and verify independently.
The paper's framing of the gap is blunt. It cites NIST's own concept paper on the problem: agents are commonly treated as generic service accounts without dedicated identity, authorization, or accountability controls. That's the same gap Singapore's IMDA framework and the EU AI Act's Article 14 try to close from the regulatory side — Singapore requires each agent to carry a verifiable digital identity and an audit trail of which agent acted under whose authorisation, while the EU rule puts the oversight duty on the relying party rather than on the protocol itself.
The paper positions itself against existing industry efforts rather than replacing them. It notes that Anthropic's position papers call for shared infrastructure no single vendor can provide, favoring open standards over proprietary ones, and that Google's SAIF 2.0 risk map and Microsoft's Entra Agent ID each address pieces of the puzzle — rogue-action risk, over-permissioning, single-enterprise identity. The recomputable trust protocol's distinct claim is to hold the exercise of authority over a network-wide boundary to account, across organizational boundaries, by recomputation rather than a central authority.
That distinction matters because every other scheme in this space — KYC-style agent registries, platform-issued credentials, enterprise identity providers — ultimately depends on trusting the issuer. A recomputable scheme asks instead: can a third party, with no relationship to either side of a transaction, independently verify that an agent acted within its granted authority, without appealing to anyone's say-so? If the math checks out on inspection, the paper's bet is that this closes the accountability gap NIST and the EU keep describing but haven't yet solved: multi-agent chains where an action happened, nobody can say with certainty which agent did it or under whose authorization, and no neutral party can check later without trusting whoever kept the log.
It's an early-stage academic proposal, not a shipped protocol, and it will have to survive contact with the same registries and enterprise identity systems it's positioned against. But it's a cleaner articulation of what "accountability infrastructure" should mean than most of the vendor announcements crowding this space: not another authority to trust, but a way to need one less.