From Specification to Deployment: Empirical Evidence from a W3C VC + DID Trust Infrastructure for Autonomous Agents

Source: arXiv:2605.06738 · Published 2026-05-07 · By Lars Kersten Kroehl

TL;DR

This paper addresses the critical problem of establishing a shared, open, cryptographically verifiable trust infrastructure for autonomous AI agents operating at production scale across organizational and jurisdictional boundaries. Existing regulatory frameworks (Singapore IMDA, NIST CAISI, EU AI Act) and industry leaders (Anthropic, Google) independently identify the need for agent identity, authorization, behavioral accountability, and human oversight, yet no vendor or platform alone can deliver this infrastructure cross-domain. The author presents MolTrust, a production-deployed system built on W3C Verifiable Credentials 2.0 and Decentralized Identifiers v1.0, anchored on a public blockchain (Base Layer 2). MolTrust defines four core primitives—identity, authorization, behavioral record, and portability—organized via a five-party accountability chain and enforced through a novel three-layer Agent Authorization Envelope (cryptographic signatures, API credential lifecycle management, kernel-level syscall monitoring).

Key findings

• MolTrust supports 69,000 autonomous agents executing 165 million transactions cumulatively valued at $50 million USDC on a single marketplace (Agent.market) since March 2026.
• Kernel-layer Agent Authorization Envelope (AAE) enforcement operates below the agent process boundary using Falco eBPF integration, preventing runtime bypass.
• Cross-protocol interoperability is verified through five reproducible test vectors (TV-001 to TV-005) confirmed against independent implementations such as qntm Authority Constraints and APS Provider Attestation.
• Layered Sybil resistance combines dual-signature interaction proofs, cross-vertical endorsement diversity exploiting Jaccard similarity for cluster detection, and principal-DID linked Violation Records persisting across agent re-registrations.
• The protocol issues credentials in eight verticals including Core Identity, Commerce, Travel, and Skill Verification, with conformance specifications (CONFORMANCE.md v1.0) and nine CWEmapped security audits.
• Coverage mapping shows MolTrust addresses 8 of the 12 cross-layer attack vectors identified in Mao et al.'s systematization of AI agent security.
• Published conformance tests, open API endpoint (api.moltrust.ch), and cryptographic anchors on Base Layer 2 blockchain enable independent verifiability and cross-organizational trust without a centralized authority.
• Interaction Proof Records cryptographically bind bilateral agent interactions preventing fabrication by single adversaries.

Threat model

The adversary includes malicious autonomous AI agents and their controlling operators capable of cloning agents, redeploying them across platforms, attempting to forge identity or authorization, and colluding to fabricate interaction histories. They cannot bypass kernel-level syscall enforcement implemented below the agent process boundary, break cryptographic signature schemes (Ed25519 with RFC 8785 canonical JSON), or alter on-chain anchored public records. The model assumes the absence of physical device compromise or root-level attacker control of the host environment. Threats such as prompt injection or model poisoning are out of scope.

Methodology — deep read

The MolTrust Protocol is designed under a threat model where adversaries consist of malicious autonomous agents and operator-controlled entities capable of cloning, redeployment, or multi-platform migration. The adversary may attempt identity spoofing, unauthorized action execution, or Sybil attacks but cannot bypass kernel or cryptographic controls or alter the on-chain anchoring.

Data provenance derives from production deployment metrics on Agent.market, tracking 69,000 bots over 165 million transactions across eight credential verticals since March 2026. Agent DIDs, Verifiable Credentials (VCs), Interaction Proof Records (IPRs), endorsements, and violation reports form the key data artifacts, with cryptographic signatures ensuring authenticity and tamper-evidence. The public Base Layer 2 blockchain anchors Merkle roots of credential states and violation records to enable immutable audit.

The architecture comprises four trust primitives: identity (DIDs), authorization (W3C VCs describing agent permissions), behavioral record (IPRs with dual signatures recording bilateral interactions), and portability (DID lifetime across platforms). These interact through a five-party accountability chain involving developer, owner, agent, counterparty, and registry. The Agent Authorization Envelope (AAE) is central: it encodes MANDATE, CONSTRAINTS, and VALIDITY blocks as machine-evaluable authorization semantics.

Critically, enforcement occurs at three layers: cryptographic verification of signatures (Ed25519 over RFC 8785 canonical JSON), API-level credential lifecycle and trust score management exposing scoped permissioning, and kernel-level system call monitoring implemented via Falco eBPF integration to prevent runtime circumvention.

The system was trained/deployed on standard production infrastructure since March 2026; exact training epochs or hyperparameters are not applicable as MolTrust is an operating protocol rather than learned model.

Evaluation relies on published conformance tests (five test vectors verified independently) targeting cross-protocol interoperability, layered Sybil resistance validated via endorsement graph clustering (Jaccard similarity heuristics), and security audit checks mapped to CWE standards. Behavioral consistency and violation persistence mechanisms are exercised at scale on live data. Statistical tests or adversarial evaluation are pending. Reproducibility is supported through open conformance specs, test vectors, and a live API endpoint. Some underlying agent transaction data and blockchain anchors are publicly verifiable but proprietary data details are restricted.

For example, an agent registers a DID, receives a W3C VC from an authorized issuer defining capabilities, and executes transactions recorded in Interaction Proof Records cryptographically signed by both parties. The AAE is enforced by kernel-level syscall monitoring preventing unauthorized system calls beyond granted constraints, while the Registry anchors all digital evidence immutably on-chain, enabling any counterparty to independently verify agent identity, authorization, and historical behavior across organizational boundaries.

Technical innovations

• Kernel-layer enforcement of Agent Authorization Envelope via Falco eBPF below agent runtime process boundary, ensuring authorization boundaries are not bypassable from within the agent execution environment.
• Cross-protocol interoperability validated by reproducible conformance test vectors verified independently, enabling trust verification across diverse W3C DID/VC implementations.
• Layered Sybil resistance combining dual-signature Interaction Proof Records preventing unilateral forgery, endorsement diversity gating with Jaccard similarity sybil cluster detection, and principal-DID linked Violation Records persisting across agent re-registrations.
• Use of a five-party trust accountability chain integrating developer, owner, agent, counterparty, and registry roles to decentralize trust responsibility and enable cross-organizational agent commerce.

Datasets

• Agent.market transaction logs — 69,000 agents, 165 million transactions, $50 million USDC volume — production database (proprietary)
• On-chain anchoring data — cryptographic Merkle roots of credential states and violation records — Base Layer 2 blockchain public ledger

Baselines vs proposed

• OAuth 2.0 / SAML-based identity: lacks cross-platform portability and agent re-deployment resilience; MolTrust DID + VC primitives provide stable, portable identity verification across platforms.
• Centralized Provider model (SAGA, NDSS 2026): centralized policy enforcement with single trusted Provider versus MolTrust decentralized verification with portable DIDs and no central registry.
• Anthropic Trustworthy Agents model: calls for shared open infrastructure; MolTrust implements an open-standards, live production system realizing equivalent trust properties.
• No quantitative performance latency or TPS baselines reported; evaluation focuses on security properties and interoperability test vector pass rates.

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2605.06738.

Fig 4: Trust Score build-up and Sybil Cluster detection.

Limitations

• Empirical adversarial validation at scale is stated as pending and not yet demonstrated.
• Sybil resistance relies on heuristic Jaccard similarity cluster detection, which is lightweight and not formally proven robust against advanced collusion.
• Input manipulation (prompt injection, adversarial inputs) and model compromise (backdoors, poisoning) lie outside MolTrust’s trust infrastructure scope and remain organizational responsibilities.
• Behavioral consistency enforcement depends on the completeness and correctness of Interaction Proof Records, which may be incomplete or manipulated by non-compliant participants.
• Reproducibility partially limited as underlying marketplace transaction data and full sets of Interaction Proof Records are proprietary and not fully public.
• Kernel-level enforcement requires deployment on compatible environments supporting Falco eBPF, limiting applicability on certain platforms or in highly heterogeneous runtime conditions.

Open questions / follow-ons

• How robust is the layered Sybil resistance against adaptive, large-scale collusion adversaries beyond heuristic Jaccard similarity detection?
• What is the performance overhead and scalability impact of kernel-layer AAE enforcement under realistic agent workloads across diverse operating environments?
• How can behavioral accountability be further strengthened through integration of additional trusted execution environments or zero-knowledge proofs?
• What are effective mechanisms to extend this trust infrastructure to cover emerging AI agent attack vectors such as supply chain poisoning and multi-agent asymmetric threat models?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, MolTrust provides a concrete architectural blueprint and production evidence for assigning decentralized, cryptographically verifiable identities and authorizations to autonomous agents operating at scale. The kernel-level syscall monitoring layer is especially relevant for preventing unauthorized actions regardless of the AI model’s internal state or evasion attempts, complementing traditional bot detection signal layers. The cross-protocol interoperability and formally published conformance tests encourage ecosystem-wide adoption, reducing the fragmented silos that attackers often exploit. However, defenders should note the reliance on heuristic Sybil cluster detection and the absence of adversarial validation as current gaps. Incorporating MolTrust-like infrastructure could substantially raise the cost and visibility of large-scale automated fraud by ensuring each bot’s identity, authorization, and interaction history is independently verifiable and anchored immutably on-chain.

Cite

@article{arxiv2605_06738,
  title={ From Specification to Deployment: Empirical Evidence from a W3C VC + DID Trust Infrastructure for Autonomous Agents },
  author={ Lars Kersten Kroehl },
  journal={arXiv preprint arXiv:2605.06738},
  year={ 2026 },
  url={https://arxiv.org/abs/2605.06738}
}

Read the full paper

• arXiv:2605.06738 (abstract)
• arXiv:2605.06738 (PDF)