ARIA

ARIA is a six-layer composable protocol. Each layer builds on proven standards. No new cryptographic primitives. No new trust infrastructure. DNS is the root.

ARIA gives every agent a passport. The Agent Trust Protocol (ATP, §05) is customs — the handshake that happens when the agent arrives. The Trust Ledger (§09) is the permanent record of every credential lifecycle event — issuance, renewal, suspension, revocation, expiry, tombstone.

Four levels. From free self-service to HSM-bound enterprise compliance. Each level cryptographically distinct.

Canonical method: did:aria. Compatibility bridge: did:web. Self-generated. Zero cost. No permission required to create.

DID operations: CREATE (generate keypair + AID; L1+ also creates DNS TXT record at _aria.<domain>), RESOLVE (DNS TXT lookup + HTTPS fetch + hash verify + signature verify), UPDATE (new AID at same endpoint, DNS hash updated), DEACTIVATE (DNS record removed OR StatusList bit flipped).

The Agent Identity Document (AID) is ARIA's core data structure — the passport. A W3C Verifiable Credential containing everything a counterparty needs to verify an agent's identity, authorization, and intent.

ARIA defines three identity roles — analogous to DNS registrant vs. admin contact:

The Agent Trust Protocol defines what happens when an AI agent presents its credentials to a receiving system. A three-phase handshake — Declare, Evaluate, Admit — that binds the agent's identity and stated intent to the receiving system's published admission policy.

ATP is to AI agent admission what DMARC (RFC 7489) is to email authentication: a DNS-published policy record that enables receiving systems to evaluate and enforce trust requirements.

Phase 1: Declare. The agent arrives carrying two payloads. Payload A is the AID — the passport. Payload B is the Intent Declaration — the customs form. A structured, machine-readable statement of WHY the agent is here. The intent declaration is cryptographically signed — making declared intent non-repudiable.

Phase 2: Evaluate. The receiving system evaluates the Declare payload against its published Agent Trust Policy (a DNS TXT record at _aria-policy.domain.com). Evaluation is deterministic. All checks local — zero added network round-trips.

Phase 3: Admit. The result is communicated via an ATP response code, queued for the Agent Interaction Log (future — see §09), and optionally reported to an aggregate endpoint.

Agent Trust Policy — the DNS record.

Enforcement modes — graduated adoption:

Format: namespace:resource:action. 8 immutable standardized actions combined dynamically with admin-defined categories and resources.

Authority flows from a human. Always. A person authorizes an agent. That agent may delegate to a sub-agent. At every hop, the chain is cryptographically signed, the scope can only narrow (never broaden), and the original human principal remains traceable. Maximum depth: 4 hops.

Graduated consent — three tiers: Pre-authorized (routine, low-risk), Categorical (approve once per category), Explicit (a human must approve this specific action). Human approval triggers are declared in the delegation chain and enforced at resolution time.

A person authorizes an agent on Tuesday. On Wednesday, that person resigns. On Thursday, the agent is still acting — with nobody behind it. ARIA's answer: no agent operates without a live human chain. Every AID must designate a successor principal. On principal change, the agent is suspended pending re-authorization.

Every ARIA credential exists in exactly one of six states:

Mandatory credential expiry: 366 days (L0/L1), 200 days (L2, per CA/B Forum SC-081v3), 180 days (L3).

If an agent is compromised, ARIA can kill its credentials globally in under 60 seconds. The mechanism: W3C StatusList2021 — flip one bit, the credential is revoked worldwide.

The Trust Ledger is the permanent, append-only, SHA-256 hash-chained record of every credential lifecycle event: issuance, renewal, suspension, revocation, expiry, and tombstone. 7-year minimum retention. Modeled on Certificate Transparency (RFC 9162).

A Trust Record is a single entry in the Trust Ledger. One lifecycle event, one Trust Record.

ARIA treats PQC as foundational. Built in from day one, not retrofitted. The Harvest-Now-Decrypt-Later (HNDL) threat makes retroactive protection critical.

MCP handles connectivity. ARIA handles identity. ATP handles admission. Three protocols composing without competing.

SCIM lifecycle bridge for agent provisioning/deprovisioning. OIDC bridge for existing IAM. AuthZEN PEP/PDP compatibility. GNAP (RFC 9635) delegation compatibility. SP 800-207 Zero Trust alignment.

ARIA Resolver API: RESTful HTTPS at api.aria.bar. SDK: TypeScript (live — @aria-registry/verify). Python, Go [PLANNED — Q2 2026].

ARIA is the agent identity layer that commerce protocols reference but do not define.

Google's A2A protocol lets agents discover and communicate with each other. But A2A's own roadmap lists "formalize authorization in AgentCard" as an open TODO. ARIA fills this gap.

How ARIA maps to every regulatory framework, identity standard, and commercial ecosystem.

EU AI Act — 5-obligation mapping:

Agent spoofing prevention: cryptographic identity replaces self-reported user-agent strings. Cross-cloud identity fabric: ARIA DIDs resolve identically across AWS/GCP/Azure.

ARIA's contribution is not prompt injection prevention (model layer) but damage containment through identity infrastructure:

Every credential lifecycle event produces a Trust Record in the Trust Ledger. Non-repudiation binding: every entry includes the delegation chain snapshot at time of action.

ARIA agent identity metadata is organizational, not personal. Agent DIDs identify software entities, not individual humans. The principal identity is held by TLF under data controller obligations.

GDPR tension: the right to erasure (Article 17) conflicts with the Trust Ledger's append-only immutability. Proposed resolution: Trust Ledger entries can be "redacted" — the event record remains but personally identifiable fields are replaced with a redaction marker.

ARIA credentials are self-contained, cryptographically complete, verifiable without network connectivity. A verifier with a cached public key and StatusList can validate any AID entirely offline. QR presentation enables physical-world agent verification.

Semantic versioning (major.minor). Minor changes (1.x) backward-compatible. Major changes (vN.0) introduce breaking changes. TLF supports all credentials under supported major versions for minimum 36 months. API: v1 endpoints guaranteed stable 5 years minimum.

Multi-principal agents: separate AIDs per principal context. Model provenance: modelAttestation for EU AI Act. Robotic identity: same framework, L3 HSM binds to specific hardware. SPIFFE bridge: ARIA L2+ wraps SPIFFE SVID with cross-org verification.

TrustLayer Foundation A.C. is the independent nonprofit that stewards the ARIA protocol, issues credentials, maintains the Trust Ledger, and governs the open standard.

Licensing: Apache 2.0 (code) + CC-BY-4.0 (documentation). Independent Technical Steering Committee: 7 members — 3 civil society/academia, 2 industry, 1 government liaison, 1 developing-nation representative. Decisions by rough consensus (IETF model). All deliberations public.

Trust Seals are optional attestations embedded in the AID's attestations field. They are referenced by ATP qualify= rules. L2+ required (Education: L1+). [NOT YET IMPLEMENTED — qualify= evaluation deferred beyond v1.0]

Trust Seals are NOT trust levels. They are supplementary qualifications that enable sector-specific policy enforcement via ATP qualify= rules. Example: qualify=sector:healthcare>iso27001