Potential Topics — AIW #3
The agenda will be co-created the day of the event by attendees using Open Space Technology. The topics below come from two places: ideas folks have submitted as they register, and open questions drawn from industry research moving the field forward. Both are shared to give perspective on what participants are thinking about discussing.
🌐 Open Space Technology
We use Open Space Technology to co-create the agenda live the morning of the event. Below is the list of what attendees shared with us as they registered about topics they hope to learn about, want to present about and topics to discuss with others at the event, alongside open questions drawn from current research in the field. It is important to note this list is not used to "create the agenda" that is done by everyone gathered in person November 6, 2026 beginning at 9am.
We use Open Space Technology to co-create the agenda live the morning of the event. Below is the list of what attendees shared with us as they registered about topics they hope to learn about, want to present about and topics to discuss with others at the event, alongside open questions drawn from current research in the field. It is important to note this list is not used to "create the agenda" that is done by everyone gathered in person November 6, 2026 beginning at 9am.
📄 Research Shaping These Questions
Several of the structural and governance questions below are drawn from Designing Agent IDs, a policy memo published in March 2026 by the Singapore AI Safety Hub with the Singapore and Korea AI Safety Institutes. Rather than proposing a protocol, it poses ten questions about what an agent ID is actually for. Worth reading before the workshop.
Several of the structural and governance questions below are drawn from Designing Agent IDs, a policy memo published in March 2026 by the Singapore AI Safety Hub with the Singapore and Korea AI Safety Institutes. Rather than proposing a protocol, it poses ten questions about what an agent ID is actually for. Worth reading before the workshop.
Agent Identity & Credentials
- Agent identity using verifiable credentials and DIDs
- Non-human agent provenance and accountability
- What does the "relying party" look like when it’s an agent, not a human?
- Extending OpenID4VP and wallet architectures to agent-to-agent flows
- Proof of control and verified credentials for personal agents
- What should an agent disclose about the model behind it?
- If a service could ask one thing about the model powering an agent, what should it be?
- Should agent credentials be ephemeral or persistent?
- Who signs the ID — the provider, the deployer, or both?
- Agent identity is not enough: the authority, memory, and intent layer above it
- Sovereign identity for organizations: what agent authority looks like when AI joins the org chart
- Are identifiers even the right way to think about agentic identification?
- How agentic identity maps to a human identity
- How teams are handling agentic identity in practice
- Autonomous agent identity and agent security
- Licensing AI agents like cars - we solved this problem 100 years ago
Delegation & Authorization
- Agent-to-agent delegation without impersonation
- GNAP vs. OAuth patterns for agent authorization
- Cryptographic proof of delegation for AI agents
- Enforcing least-privilege at the tool-call layer
- How intent and obligations travel alongside A2A / MCP calls
- Capability-based vs. policy-based approaches for delegation
- Does the ID carry authorization, or point at it?
- Can identity and authorization stay distinct and still interoperate?
- Secure mandates for agent chains: carrying revocable, auditable authority across MCP and A2A hops
- Human authority at machine speed: execution-time consent and revocation
- Keeping mandates sovereignty-preserving, not surveillance
- Progress on A2A, AAuth, OAuth support for agentic-driven flows
- OAuth-related metadata standards evolution
- Implications to JWTs and claims for supporting agentic workflows
- Workload-based access grants and flows
- Where agent-to-agent and agent-to-tool authorization is actually heading: GNAP and OAuth extensions for agents, AuthZEN for fine-grained authorization, capability narrowing and revocation across delegation hops, KERI/ACDC and SEDI for cryptographic authority
- How the community keeps a human, a company, or a nation the source of authority at execution time as agents chain calls across tools and organizations
- Mission-based authorization and governance for agents
- Mission-based agent-team governance
- Separating human intent, governance decisions, delegated authority, and execution evidence in agentic systems
- Human ownership provenance and authorized delegation
- MCP auth
- The latest OAuth-based and credential-based agent identity protocols
Trust Frameworks & Verification
- How a receiving agent verifies a presenting agent is authorized to act on behalf of a person or organization
- Cryptographic trust decisions without human-in-the-loop consent
- Trust boundaries and threat modeling for multi-agent systems
- Trust registries and registries of registries
- Thin ID with a registry lookup, or fat ID that carries everything?
- How do you stop an agent ID from being replayed by a malicious service?
- How do two different agent ID schemes recognize each other?
- Behavioral coherence as a runtime trust signal (trust asymmetry and the completion drive)
- How trust and behavioral signals can travel with an agent without becoming surveillance
- AI and human trust
- TSP (Trust Spanning Protocol) and trust-enabled AI agents
Structural & Governance Questions
- Which entities belong in an agent ID — agent, instance, provider, deployer, model?
- Should a low-risk agent carry less ID than a high-risk one?
- Whose privacy wins — the deployer’s, or the service’s need to know who it is dealing with?
- Who should have access to the information inside an agent ID?
- Should agent trust scores and traffic statistics be public?
- Voluntary adoption or mandated compliance — which one actually gets agent IDs deployed?
- Where will the market fail to build agent IDs, and who fills that gap?
- What can governments coordinate that industry cannot?
- When an agent causes harm, who is responsible?
Policy, Permissions & Governance
- Where policy enforcement should live in multi-agent systems
- Agent permissions and scoped capabilities (allow/ask/deny/escalate)
- Policy portability across frameworks
- Governance of agentic AI — embedding alignment in protocols
Safety, Security & Human Control
- Human approval UX and interruption/rollback mechanisms
- Securing MCP servers and A2A protocols
- Standardized audit logs and telemetry for agent actions
- Safe defaults and sandbox design for local-first workflows
- Practical patterns for trustworthy agent systems
- When an agent goes wrong at 2am, who do you call?
- What does an ID have to carry for anyone to stop a running agent?
- What should a service log when an agent calls it?
- Systems that block anything not authenticated
- Flipping the narrative from human-in-the-loop to agent-in-the-loop
- Authentication and compliance for agents
Personal Agents & Data
- User-controlled agents and personal data sovereignty
- Personal data, memory, and secure authorization
- Consent-aware edge and embodied agents
- Personal portable memory
- Personal AI "lock-boxes"
- A path toward human-empowering AIs
Infrastructure & Discovery
- AgenticDNS and agent registries
- Agent discovery and interoperability across protocol stacks
- Browser roles in the agentic ecosystem
- Can MCP carry identity, or does it need extension?
- Does DNS hold as the anchor for agent identity?
- Which agent ID efforts actually exist, and what does each one cover?
- How MCP and A2A are converging on identity and mandate
- MCP
- Agent Network Protocol (ANP)
- Agentic Profiles (A2A + DIDs)
- AGNTCY and its 3 layers: Agent Discovery, Agent Identity, and SLIM
- A2A Agent Cards
- Which protocol is best suited to carry an "obfuscated broadcast, local-only computation" pattern: A2A Artifact model, AGNTCY SLIM messaging, or ANP DID-based discovery?
- Newest state of AI agents
Agent Payments & Commerce
- Agent Payments
- Agentic Commerce
- KYAPay
- Payment layers for agent-to-agent transactions
- Privacy-preserving agent-to-agent matching for regulated personal data: feasibility of minimal-disclosure marketplaces on A2A/AGNTCY
- Agent identity and commerce
Standards Landscape
- Are standards relevant in the age of AI?
- Where are standards being developed today for Agentic AI? What is good/bad/ugly about these different orgs?
- How should agent identity/discovery protocols defend against a coordinator that sends inconsistent versions to isolate one participant's data?
- Progress on agentic AI standards over the last six months
Interop Day (November 5): What People Want to Test
- Trust Spanning Protocol (TSP) implementations
- MCP auth
- Agent identity with SPIFFE, WIMSE, OAuth, CIMD and EMA
- Agent identity, delegated authorization, credential exchange, trust discovery and revocation in MCP-based agent interactions
- Business wallets and Digital Product Passports (DPP)
💡 Have a Topic to Add?
These topics will be discussed during the agenda creation in the opening circle. If you have additional topics you'd like to explore, bring them to the workshop and propose them during the agenda-setting session.
These topics will be discussed during the agenda creation in the opening circle. If you have additional topics you'd like to explore, bring them to the workshop and propose them during the agenda-setting session.