Crypto-bound identity-verified capability tokens for coordinating distributed AI agents: A proposal
The paper proposes a capability-based authorization framework for distributed autonomous AI agents, using OAuth-style agent authorization plus DIDs/Verifiable Credentials to issue cryptographically bound, scope-limited tokens that services can validate across delegation chains. Its useful insight is to move enforceable authority outside the LLM context into a secure token/identity layer that limits prompt-injection fallout via scope attenuation, though it’s mainly an architectural proposal and depends on practical secure-module design, ecosystem adoption of DID/VC-style identity, and careful handling of delegation complexity.
Abstract
The prospect of fully autonomous transactional agents did not appear on the horizon until the advent of high capability language models. With such models, the operational benefits of adaptive task orchestration and independent (but constrained) decision making are tantalizing for enterprises and individuals alike. However, each such agent carries with it a serious attack surface in the form of prompt injection which can compromise any soft "guard rails" that may have been placed in context. The consequences of these attacks include credential ex-filtration which, if left unmitigated, renders the whole category of such agents unusable due to breach of trust. Furthermore, expecting a growth of autonomous agents, a security framework for them would require a form of decentralization to scale. Drawing on the proposed OAuth Agent Authorization Profile and the W3C DID and VC standards, we propose a framework based on the principles of capability based security with decentralized agent identity whereby agents access services based on tokens that are cryptographically bound to the agent's and issuer's identities and specify their scope. Services can validate that the delegation chain only involves scope attenuation before acting on any given token. We show that such a layer that lives outside the language model's context window in a secure module can enable agents to act within enforceable security boundaries.