🤖 AI Summary
This work addresses the absence of a shared, verifiable, and vendor-neutral trust infrastructure in the current AI agent ecosystem, which hinders secure transactions and compliant operations. We propose MolTrust—a trust infrastructure grounded in W3C Verifiable Credentials 2.0 and Decentralized Identifiers v1.0—that establishes end-to-end trust through four core primitives (identity, authorization, behavioral logging, and portability) and a five-party accountability chain. Key innovations include the first kernel-enforced Agent Authorization Envelope (AAE), reproducible test vectors enabling cross-protocol interoperability, and a layered Sybil-resistance framework integrating multiple defense mechanisms. Since March 2026, the system has operated stably across eight credentialing verticals, offering the first deployable, empirically validated architecture for agent trust aligned with regulatory and industry requirements.
📝 Abstract
Autonomous AI agents now transact at production scale -- 69,000 bots executing 165 million transactions across 50 million USDC in cumulative volume on a single marketplace -- without any shared trust layer between participants. Regulatory frameworks (Singapore IMDA, NIST CAISI, EU AI Act) and major AI laboratories (Anthropic, Google) have independently converged on the same structural requirement: an open, portable, cryptographically verifiable trust infrastructure for autonomous agents that no single vendor can deliver alone. This paper presents MolTrust, a production-deployed implementation of such an infrastructure built on W3C Verifiable Credentials 2.0 and Decentralized Identifiers v1.0, with on-chain anchoring on Base Layer 2. The system architecture is organized around four primitives (identity, authorization, behavioral record, portability), a five-party accountability chain, and the Agent Authorization Envelope (AAE) -- a machine-evaluable authorization structure enforced at three layers: cryptographic signatures, API-level credential lifecycle management, and kernel-level syscall monitoring via Falco eBPF integration. The paper documents three distinguishing capabilities: kernel-layer AAE enforcement below the agent process boundary; cross-protocol interoperability through five reproducible test vectors verified against independent implementations; and layered Sybil resistance combining dual-signature interaction proofs, cross-vertical endorsement diversity gating, and principal-DID-linked violation persistence. The reference implementation has been operational since March 2026 across eight credential verticals. Empirical validation at adversarial scale is pending. The contribution is deployment-first evidence that the trust infrastructure regulators and industry have converged on is implementable today using W3C-standardized primitives.