Agent Identity & Trust-Chain

A2A agent-card + delegated-authority trust-chain validation > KYA-OS identity attestation > spend-policy simulation.

The delegated-authority model this workflow checks follows established precedent: KERI delegated identifiers and their witness model, ratified by the Trust over IP Foundation in January 2026, and the vLEI organizational-identity framework (ISO 17442-3), with Urbit ID as earlier prior art for sponsored, hierarchical namespaces. The named upgrade path for portable, key-rotation-tolerant identifiers is did:webvh.

OpenChainGraph · 3 Steps payment policy Hash-Anchored §4 chain_depth:3 Client-Side · Zero PII

Chain Stages · 3 Steps

1 ROOT · D0 node

A2A Agent-Card Trust-Chain Validator art-32-a2a-agent-card-trust-chain-validator

a2a_card + trust-chain verdict and execution_hash feed Stage 2 KYA attestation

MCP Call · validate_a2a_trust_chain

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "validate_a2a_trust_chain",
    "arguments": {}
  },
  "id": 1
}

↓

2 D2 node

Agent Identity & Authorization Attestation Checker art-04-agent-identity-attestation-checker

attestation verdict and execution_hash feed Stage 3 spend-policy simulation

MCP Call · check_agent_attestation

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "check_agent_attestation",
    "arguments": {}
  },
  "id": 1
}

↓

3 TERMINAL · D3 node

Agent Spend-Policy Simulator art-02-agent-spend-policy-simulator

Exports the agent-identity-trust policy artifact -- final stage

MCP Call · simulate_spend_policy

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "simulate_spend_policy",
    "arguments": {}
  },
  "id": 1
}