token-based authentication

Autonomous LLM agents frequently invoke APIs in unsupervised settings, risking silent OAuth 2.0 privilege escalation due to stochastic reasoning, prompt injection, or multi-agent coordination. Method: We propose the first zero-trust delegation protocol for AI agents, centered on Bidirectional Intent Tokens (BITs)—cryptographically binding agent identity hashes, chained delegation assertions, and proof-of-possession—to enable runtime self-verification and cross-agent invocation tracing. Our design integrates unidirectional verification hashes (derived from prompts, tools, and configurations), step-level workflow binding, a lightweight client shim, and runtime key derivation—ensuring backward compatibility with existing OAuth ecosystems. Contribution/Results: Implemented on commodity hardware, our prototype incurs sub-millisecond overhead per delegation and effectively mitigates privilege escalation, replay, spoofing, and prompt injection attacks. The solution demonstrates production-ready deployability with minimal integration effort.

To address the challenge of simultaneously ensuring security, accountability, and cross-modal access control in AI assistant permission management, this paper proposes a trustworthy authorization and auditable delegation framework for AI agents. Methodologically, it introduces the first agent-centric identity authentication architecture that integrates natural-language permission translation with extended OAuth 2.0 and OpenID Connect protocols, establishing agent-specific credential issuance and a semantic parsing model to enable end-to-end traceable mapping from human intent to machine-executable policies. It further incorporates an auditable access control engine supporting fine-grained, compliance-aware permission enforcement. The key contribution is the first automated translation of natural-language policies into standardized, enforceable access control rules—significantly enhancing AI agent controllability, interpretability, and accountability. The framework has been validated across multiple Web service prototypes, demonstrating plug-and-play secure integration.

This work proposes a unified verifiable delegation framework to address the challenge of enabling human users to securely delegate identity privileges to AI agents across centralized, federated, and self-sovereign identity (SSI) systems without exposing master credentials or private keys. The framework treats delegation grants (DGs) as first-class entities and integrates normative verification contexts (CVCs), a layered trust gateway architecture, and policy evaluation mechanisms, with optional blockchain anchoring to enhance integrity. It supports minimal-privilege, auditable, and context-aware authorization across heterogeneous identity systems, significantly improving interoperability. By providing a robust foundation for integrating AI agents into trusted digital identity infrastructures, this approach advances both standardization efforts and practical deployment in real-world scenarios.

In multi-agent systems, non-human identities (NHIs) exhibit untrustworthy provenance, poor traceability, and weak auditability under agent-to-agent (A2A) interactions. Method: This paper proposes a context-aware provenance assurance framework for NHIs. It designs a provenance-verifiable NHI model; constructs a Merkle-tree- and Certificate Transparency–based logging system enabling cryptographic inclusion proofs and consistency verification; introduces a federated proof server generating compact signature-based attestations; and extends the A2A Agent Card protocol to support standardized identity authentication and multi-hop provenance tracing. Contribution/Results: The framework achieves, for the first time, end-to-end verifiable provenance tracing across the full NHI invocation lifecycle. It enables lightweight external auditing—requiring no access to complete execution traces—and demonstrates strong regulatory adaptability, validated in compliance-critical environments such as FedRAMP.

This work addresses the security risks in existing Model Context Protocol (MCP) and Agent-to-Agent (A2A) frameworks stemming from the absence of verifiable AI agent identities, which undermines secure authorization and delegation. To resolve this, we propose a cross-protocol verifiable delegation mechanism spanning MCP, A2A, and HTTP, built upon a novel construct called Invocation-Bound Capability Tokens (IBCTs). IBCTs unify public key binding, holder-of-key attenuation, chained Datalog policies, multi-protocol transport binding, and execution provenance into a single framework. The design supports both compact JWT serialization and Biscuit-style policy encoding, with interoperable implementations in Python and Rust. Experimental evaluation demonstrates that our approach incurs only 0.049 ms overhead in Rust, increases end-to-end latency by just 0.086%, and achieves a 100% interception rate across 600 adversarial attacks—including two attack classes undetectable by conventional methods.

This work addresses the absence of a shared, verifiable, and vendor-neutral trust infrastructure in the current AI agent ecosystem, which hinders secure transactions and compliant operations. We propose MolTrust—a trust infrastructure grounded in W3C Verifiable Credentials 2.0 and Decentralized Identifiers v1.0—that establishes end-to-end trust through four core primitives (identity, authorization, behavioral logging, and portability) and a five-party accountability chain. Key innovations include the first kernel-enforced Agent Authorization Envelope (AAE), reproducible test vectors enabling cross-protocol interoperability, and a layered Sybil-resistance framework integrating multiple defense mechanisms. Since March 2026, the system has operated stably across eight credentialing verticals, offering the first deployable, empirically validated architecture for agent trust aligned with regulatory and industry requirements.

This work addresses novel security threats faced by large language models operating as autonomous agents in open web environments, where traditional defenses fall short against risks arising from tool invocation, persistent memory, and interaction with untrusted content. The paper introduces the first threat taxonomy tailored to agent-based web systems, systematically delineating attack vectors including prompt abuse, environment injection, memory manipulation, toolchain exploitation, model tampering, and agent network attacks. It further reveals how these threats propagate and amplify through cross-domain interactions, delegation chains, and protocol-driven ecosystems. To counter these challenges, the study proposes a comprehensive defense framework encompassing threat modeling, secure decoding, permission control, runtime monitoring, and protocol-layer protections, while advancing new directions such as interoperable identity authentication, provenance tracing, and ecosystem-wide response mechanisms to establish a trustworthy foundation for large-scale autonomous agent ecosystems.

This work addresses the lack of trustworthy identity authentication and real-time state verification for AI agents operating in decentralized, dynamic environments. To this end, the authors propose AgentDID, a framework grounded in W3C-standard Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs), which empowers AI agents with autonomous identity management capabilities. Notably, AgentDID integrates a challenge-response mechanism into runtime verification for the first time, enabling immediate and verifiable confirmation of agents’ dynamic states—such as contextual awareness and functional capabilities. Experimental results demonstrate that AgentDID achieves strong scalability under high concurrency, offering a decentralized, self-managed trust infrastructure for multi-agent systems.

This work addresses the interoperability challenges in digital credential ecosystems, which stem from heterogeneous standards and independent evolution, and which traditional approaches fail to fully explain—particularly regarding incompatibilities that persist even under shared data models and the precise trust requirements of verifiers. To resolve this, the paper proposes a verifier-centric conceptual model that decomposes credential verification into three layers: signature validation (L1), semantic interpretation (L2), and validity assessment (L3). It further introduces two orthogonal planes—institutional and logistical—to construct a five-function framework within a three-dimensional deployment space. Building on this foundation, the authors design the Shinken framework, which integrates trust declarations, verification material exchange, and deployment strategies to enable cross-stack analysis. Evaluations across four learner credential stacks and an accreditation federation demonstrate that the model effectively elucidates and mitigates key issues including interoperability barriers, verification overhead, privacy risks, and terminological ambiguity.

This work addresses the vulnerability of large language model (LLM) agents to indirect prompt injection attacks in high-stakes scenarios, where adversaries manipulate external data sources to induce unauthorized actions. To mitigate this threat, the authors propose AuthGraph, a novel framework that achieves structured alignment between authorization intent and execution provenance at the parameter-source level. AuthGraph constructs dual graphs—an information provenance graph and an authorization intent graph—and employs dual-graph modeling, isolated inference, and graph alignment verification to enable fine-grained detection of anomalous tool invocations and parameter origins, thereby preserving both security and task flexibility. Experimental results on AgentDojo and AgentDyn demonstrate that AuthGraph reduces attack success rates to 1% and 2%, respectively, while maintaining task completion rates of 76% and 51%, significantly outperforming existing approaches such as CaMeL, DRIFT, and Progent.