Data Facts: A Metadata Schema for Structured Data Exchange in the NANDini Multi-Agent Ecosystem

Source: arXiv:2606.26211 · Published 2026-06-24 · By Jin Gao, Maria Gorskikh, Pradyumna Chari, Brittany Box, Mukul Kemla, Pratik Behera et al.

TL;DR

This paper addresses a fundamental gap in multi-agent ecosystems where autonomous intelligent agents must share, verify, and access datasets to enable reliable data-driven decisions. Existing protocols focus on agent discovery and communication but lack a standardized, machine-readable mechanism for structured dataset exchange that supports freshness, integrity, and access control in real time without human governance. The authors introduce Data Facts, a lightweight JSON metadata schema that extends the NANDA AgentFacts registry by adding a pointer (data_facts_url) to external dataset metadata including identity, endpoint, access tier, freshness (time-to-live), and integrity (SHA-256 checksum). They complement this with a three-layer security pipeline using JWT authentication, capability-scoped gateway authorization, and an agent-to-agent credential delegation protocol to protect semi-private and private data.

Through empirical evaluation across 840 decision-making runs and extensive security tests, Data Facts-enabled agents achieve 100% accuracy on queries dependent on live data compared to 35.2% accuracy for agents relying solely on training priors. TTL freshness enforcement reduces stale data consumption errors from 37.6% to 8.8%, and the checksum verification detects 100% of data corruption at various injection rates. The security pipeline blocks all 46 forgery attempts without any data leakage. The architecture supports flexible topologies, enables low-latency data access, and preserves existing registry infrastructure while enabling scalable, secure data exchange suitable for planetary-scale autonomous agent networks.

Key findings

• Data-informed agents achieve 100% accuracy (420/420) on counter-intuitive queries, versus 35.2% (148/420) accuracy without data access (p < 0.001).
• TTL freshness enforcement reduces stale-data errors from 37.6% to 8.8%, reaching 76.6% detection of stale data across TTL windows of 60, 300, and 600 seconds.
• SHA-256 checksum verification detects 100% of corrupted payloads at all corruption rates spanning from 1% to 50%, with zero false negatives.
• Data Facts discovery imposes a fixed overhead of approximately 260-270 ms due to two additional HTTP round-trips, stable up to 200 simultaneous queries.
• All 46 adversarial forgery attempts—including token manipulation and impersonation—are blocked with zero unauthorized reads or data leakage across 206 private-access trials.
• Gateway JWT verification latency averages 48.6 ms per request and enforces per-dataset capability scoping more efficiently than OAuth2 (259.2 ms) and SPIFFE mTLS (110.5 ms).
• Data-informed query pipelines have lower tail latency (p95) than self-decide LLM queries, especially in 3-agent topologies (29.8 s vs. 75.4 s), due to reduced LLM deliberation on counter-intuitive cases.
• Data-informed accuracy is independent of infrastructure topology (1-agent, 2-agent, 3-agent), confirming the credential delegation chain preserves access and correctness.

Threat model

The adversary aims to gain unauthorized access to non-public datasets by forging credentials, replaying or manipulating JWTs, impersonating trusted agents, or tampering with data payloads. The system relies on cryptographic verification of signatures (JWT, SHA-256), scoped capability enforcement via a gateway, and audit logging. The adversary cannot break cryptographic assumptions but attempts practical forgery, injection, and replay attacks. The model excludes token revocation or caller identity binding in v1, accepting that tokens may be reused within their TTL window by intercepted parties.

Methodology — deep read

1. Threat Model & Assumptions: The adversary attempts to access private or semi-private datasets without valid authorization, tries to replay or forge credentials, manipulate JWT claims, or tamper with dataset payloads. The system assumes adversaries cannot break cryptographic primitives (SHA-256, JWT signatures), but tests against practical forgery, impersonation, and replay attacks. The security pipeline does not yet bind tokens to caller identity or provide revocation within token TTL windows.

2. Data: The evaluation uses a static PostgreSQL dataset with a fixed distribution (Gold:5, Silver:6, Bronze:9). Seven binary decision scenarios of varying difficulty are generated. Data corruption is synthetically injected at rates from 1% to 50% for checksum verification tests. Security tests use 46 distinct forgery types covering six categories. Evaluation includes 840 decision-making queries with factorial design varying query scenario, data access mode, and agent topology.

3. Architecture / Algorithm: Data Facts extends the existing NANDA AgentFacts JSON with a single new optional field, "data_facts_url", that points to an external JSON document describing the dataset. This external document encodes dataset_id, description, access_type (public/semi_private/private), endpoint URL, freshness TTL, and SHA-256 checksum. For non-public data, a three-layer security pipeline protects access: JWT issuance scoped to dataset capabilities, gateway enforcement of JWT claims and ACLs with injected replay and input validation, and a multi-hop agent-to-agent A2A protocol for credential negotiation and delegation. The gateway acts as a trust boundary and adapter layer to heterogeneous backends.

4. Training Regime: Not applicable as this is an architecture and system design paper with empirical evaluation. The LLM used in decision-making experiments is gpt-5-nano, called repeatedly during 840 total trials.

5. Evaluation Protocol: Five main experiments test discovery overhead, freshness enforcement, integrity verification, security (adversarial) pipeline performance, and downstream decision quality. Discovery overhead measures time-to-first-data comparing baseline direct GET with Data Facts 3-step retrieval at scales N=50 and 200. Freshness enforcement compares decision error rates with and without TTL-based stale data rejection. Integrity verification injects payload corruption and measures detection rates. Security pipeline is challenged with 46 forgery scenarios and 206 total credential validation trials over semi-private data. Decision quality tests agent accuracy on seven binary scenarios, comparing self-decide (LLM priors) versus data-informed (pipeline access), across 1-, 2-, and 3-agent topologies. Metrics include accuracy, error rates, detection rates, latency, and authentication failures.

6. Reproducibility: The paper does not mention public availability of code or datasets. The schema and protocols are described in detail enabling independent implementation from the specification. Evaluation datasets are synthetic or standard PostgreSQL tables. Certain prior components like NANDA registries and MCP/A2A protocols are referenced but not provided.

Concrete Example End-to-End: An agent seeking data first queries the NANDA registry, retrieving AgentFacts that include the data_facts_url. It fetches the Data Facts JSON document from this URL, verifying the last_updated timestamp against the ttl_seconds freshness window. It then requests the dataset endpoint URL, which for private data is a gateway enforcing JWT-based capability-scoped authorization. The agent obtains the necessary JWT credential through the A2A delegation protocol, presents it to the gateway, which performs token signature and claim validation, replay protection, and input constraints before querying the backend database and returning results. Post-fetch, the agent verifies the payload checksum against the SHA-256 hash in Data Facts. Finally, the agent uses the fresh, integrity-verified data to answer decision queries with 100% accuracy.

Technical innovations

• Introduction of Data Facts, a minimal JSON metadata schema linked by a pointer from AgentFacts enabling machine-readable dataset discovery with freshness and integrity guarantees.
• A three-layer security pipeline combining JWT authentication, capability-scoped gateway authorization, and agent-to-agent delegated credential negotiation specific to multi-agent ecosystems.
• Integration of freshness enforcement via TTL fields and integrity validation through SHA-256 checksums at query time, operable without registry modification or heavy infrastructure.
• Capability-based access control implemented through a gateway proxy layer abstracting heterogeneous backend databases, preserving security and auditability.

Datasets

• Synthetic decision scenarios derived from a PostgreSQL table with Gold:5, Silver:6, Bronze:9 distribution - internal evaluation dataset

Baselines vs proposed

• Baseline direct dataset access (single-step GET) discovery overhead: mean time-to-data = ~0.12–0.13 s vs Data Facts three-step retrieval: 0.38–0.40 s
• Self-decide LLM decision accuracy (no data): 35.2% vs data-informed agent accuracy (Data Facts pipeline): 100%
• JWT gateway verification latency: 48.6 ms vs OAuth2: 259.2 ms and SPIFFE mTLS: 110.5 ms
• Stale-data error rate without TTL freshness enforcement: 37.6% vs with Data Facts TTL enforcement: 8.8%
• Checksum verification corrupted payload detection: 0% baseline vs 100% Data Facts treatment
• Security pipeline blocks 100% of 46 adversarial forgery attempts vs no unauthorized access in baseline

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2606.26211.

Fig 1: shows the NANDini Data Facts architecture

Fig 2: Decision quality on data-driven questions

Limitations

• Decision-making evaluation uses a single LLM model (gpt-5-nano) and binary classification queries; results may not generalize to open-ended or other model families.
• Static evaluation dataset with fixed update cadence; high-frequency dynamic environments may erode freshness enforcement beyond the measured 8.8% residual error.
• Security pipeline v1 does not bind tokens to caller identity, allowing reuse of intercepted tokens within TTL window.
• Token revocation and audience binding are not yet implemented, limiting fine-grained credential lifecycle management.
• The schema supports only single-dataset metadata documents; multi-dataset catalogs are planned but not implemented, potentially increasing round-trip overhead in data-rich deployments.
• The evaluation does not test adversaries beyond forgery and token attacks—such as insider threats, denial-of-service, or backend compromise.

Open questions / follow-ons

• How to incorporate token revocation, audience binding, and short-lived credentials to mitigate token reuse and improve identity binding in real-time agent ecosystems?
• What are effective methods to support multi-dataset catalogs in the metadata schema to reduce round-trip overhead in large-scale data deployments?
• How can Data Facts integrate with knowledge distillation pipelines to advertise not only raw datasets but also distilled, quality-assured knowledge artifacts with provenance?
• How to extend evaluation to dynamic, high-update-rate environments and open-ended query formats beyond binary decisions to assess robustness and generality?

Why it matters for bot defense

For bot-defense engineers and CAPTCHA practitioners, Data Facts highlights the necessity of structured, machine-readable dataset metadata for autonomous agents that dynamically exchange data to drive decisions. Captcha systems or bot detection models relying on live data feeds could adopt similar freshness (TTL) and integrity (checksum) verification to ensure data quality when interacting with real-time agent ecosystems. The proposed security pipeline shows how delegated capabilities and JWTs can be leveraged to strictly control access to semi-private or private data sources, a pattern applicable to protecting sensitive bot-defense infrastructure. Additionally, the demonstrated reduction in decision latency and error rate with Data Facts-powered data access underscores the value of verifiable, fresh data in automated decision flows—a relevant principle for ensuring CAPTCHA challenges adapt robustly to evolving bot techniques.

Cite

@article{arxiv2606_26211,
  title={ Data Facts: A Metadata Schema for Structured Data Exchange in the NANDini Multi-Agent Ecosystem },
  author={ Jin Gao and Maria Gorskikh and Pradyumna Chari and Brittany Box and Mukul Kemla and Pratik Behera and Abhishek Mehta and Ramesh Raskar },
  journal={arXiv preprint arXiv:2606.26211},
  year={ 2026 },
  url={https://arxiv.org/abs/2606.26211}
}

Read the full paper

• arXiv:2606.26211 (abstract)
• arXiv:2606.26211 (PDF)