Inter-Agent Trust Models: A Comparative Study of Brief, Claim, Proof, Stake, Reputation and Constraint in Agentic Web Protocol Design-A2A, AP2, ERC-8004, and Beyond

AI summary

Overview

Research area: Human-Computer Interaction, with a strong overlay of multi-agent systems security, computational trust theory, distributed systems, and blockchain protocol design. The paper sits at the intersection of AI safety (LLM failure modes) and internet protocol governance.

Technical level: Intermediate. No mathematics or code is required to follow the argument, but readers benefit from familiarity with concepts such as verifiable credentials, zero-knowledge proofs, trusted execution environments (TEEs), staking and slashing, and multi-agent reputation systems.

Scope (one sentence): The paper defines six trust models used (implicitly or explicitly) in inter-agent protocol design, compares their strengths, weaknesses, attack surfaces and LLM-specific mitigations, and maps them onto the 2025 protocols A2A, AP2, ERC-8004 and related efforts.

Authors and venue: Botao 'Amber' Hu (University of Oxford) and Helena Rong (New York University Shanghai); arXiv:2511.03434v1 [cs.HC], published 5 November 2025; licensed CC BY-NC-ND 4.0.

What This Paper Is About

As an "agentic web" of potentially billions of autonomous, often LLM-powered agents begins transacting and collaborating, trust can no longer be supplied by direct human supervision or by static, ownership-based mechanisms such as DNS names and TLS certificates. Individual protocols have appeared that encode their own assumptions about how agents should trust one another, but those assumptions have not been systematically compared against each other or against known LLM failure modes. The paper's goal is to name those assumptions, analyze their vulnerabilities, and recommend a hybrid architecture for safer agent economies.

Key Contributions

1. A unifying framework of six trust models. The authors delineate Brief (third-party or self-issued verifiable credentials), Claim (self-proclaimed identity and capability, such as an AgentCard), Proof (cryptographic verification including zero-knowledge proofs and TEE attestations), Stake (bonded collateral with slashing and insurance), Reputation (crowd feedback and graph-based trust signals), and Constraint (sandboxing and capability bounding), and compare them by basis of trust, strengths, weaknesses, LLM-related mitigations, and representative uses.

2. A protocol-by-protocol analysis. The paper reviews state-of-the-art agent interaction protocols — A2A, AP2, ERC-8004, NANDA and others — and identifies which trust models each one actually relies on in practice.

3. A critical examination of LLM-specific failure modes. Each trust model is assessed against prompt injection, sycophancy/nudge-susceptibility, hallucination, deception, emergence of power-seeking behavior, and objective misalignment, arguing that certain fragilities fundamentally limit purely reputational or claim-only approaches.

4. A forward-looking research agenda and design blueprint. The paper distills design implications, including trust tiering (a T0–T3 blueprint), composition of multiple trust signals, human oversight and auditability, and open questions around governance, standardization, and ethics.

Main Findings

• No single mechanism suffices. The paper's central conclusion is that simple reputation systems or unsigned agent claims leave too many attack surfaces (Sybil attacks, collusion, lying agents), while purely cryptographic approaches can be costly or impractical for real-time agent orchestration.

• The recommended architecture is hybrid and trustless-by-default. The authors argue for trustless-by-default architectures anchored in Proof and Stake to gate high-impact actions, augmented by Brief for identity and discovery and Reputation overlays for flexibility and social signals.

• Brief (credentials) bootstraps but depends on authorities. Briefs enable rapid, portable trust for discovery and initial contact and prevent a prompt from conjuring a valid third-party credential, but they suffer from issuer compromise or capture, slow or fragile revocation, weak identity binding enabling impersonation, coarse granularity, and centralization choke points.

• Claim (self-description) is necessary but brittle. AgentCards and profiles impose the lowest infrastructural burden and support discovery, but claims are unverified, prone to overclaiming, vulnerable to prompt tampering, and provide negligible direct mitigation of LLM fragilities. The paper recommends treating Claim as input to stronger mechanisms rather than as sufficient for critical decisions.

• Proof guarantees integrity, not alignment. Cryptographic and attestation-based evidence removes the need to know an agent's history, counters hallucination and deception, and supports audit trails — but an agent can correctly prove it executed a harmful policy if the policy itself is flawed. Costs include circuit design, proof generation time, TEE hardware requirements, side-channel and supply-chain risks, denial-of-service via expensive verification, and partial logging where only favorable actions are proved.

• Stake aligns incentives but is ex post and can centralize. Collateral with slashing imposes a cost on misbehavior and creates an economic learning signal for LLM agents, but it cannot prevent a single catastrophic action if detection is later, performs poorly against adversaries willing to burn stake, is exposed to Sybil splitting, collusion in adjudication, and last-mile betrayal, and skews participation toward resource-rich actors. The paper favors progressive staking calibrated to privilege and potential externality.

• Reputation is adaptive but a lagging indicator. It can proxy for robustness (agents that repeatedly succumb to prompt injection or hallucinate accumulate negative feedback), but it is vulnerable to Sybil attacks, ballot stuffing, collusion, defamation, whitewashing and cold-start inequities, and invites "reputation milking" where an actor behaves well to amass trust and defects when stakes are highest. The paper insists reputation be scoped, tempered with decay and confidence intervals, and never used as a single gate.

• Constraint is the last line of defense. Sandboxing, least privilege, mediated tool access and rate limiting bound harm regardless of agent intent and block many LLM attack vectors, but they risk sandbox escapes, confused-deputy abuse, covert channels, policy drift, and complacency, and they throttle capability.

• A2A natively privileges Claim and Constraint, with Brief at the transport layer. AgentCards (typically JSON at a well-known endpoint) advertise identity and capabilities over secured JSON-RPC layered on HTTPS with mutual authentication; TLS certificates and OAuth tokens supply Brief-style trust. A2A does not prescribe ecosystem-wide Reputation, Stake, or cryptographic Proof of correct computation, which makes it easy to adopt inside organizations with known participants but limits it in open adversarial settings.

• AP2 integrates Brief, Proof and Constraint around the Mandate abstraction. Mandates are verifiable credentials capturing explicit authorization and context (for example an intent cap, a cart summary, and whether a human was present), co-signed and presented with each transaction. Role separation and tokenization keep agents away from sensitive payment credentials. AP2 does not standardize Reputation or Stake on the wire but anticipates them off-path through risk engines, liability models, insurance or performance bonds. Its mandate proofs attest authorization, not correctness of upstream agent reasoning.

• ERC-8004 composes Claim/Brief, Reputation, Proof and Stake across three registries. An on-chain Identity Registry assigns a persistent handle (typically an NFT) linking to off-chain metadata such as an AgentCard; a Reputation Registry aggregates structured feedback; a Validation Registry coordinates third-party checks — re-execution, TEE attestation, or zero-knowledge proofs — often collateralized by stake. Agents advertise "supportedTrust" capabilities. Weaknesses include on-chain cost and latency, privacy concerns absent selective disclosure, validators and feedback channels as targets for Sybil and collusive manipulation, and the fact that benefits are optional unless counterparties require validation or minimum reputation thresholds.

• The paper proposes a four-tier blueprint. T0 covers low-stakes discovery and read-only use with Claims and available Briefs plus soft constraints and best-effort logging; T1 covers moderate stakes with accountability via signed intents, narrowly scoped reversible permissions, durable receipts, small refundable bonds and minimal reputation thresholds; T2 covers high stakes with strong assurance under a "verify relentlessly" posture. Details of the T3 tier are not reported in the available content, which is truncated mid-sentence.

• Trust should not accumulate monotonically. Because an agent that was aligned yesterday may shift objectives tomorrow, the paper calls for append-only logs and signed receipts, random audits, re-baselining when model weights, ownership or security conditions change, credential decay, periodic restaking, and probationary periods after major updates.

Methodology in Plain English

This is a conceptual and comparative study rather than an empirical one; the authors report no experiments, no benchmarks and no measured numbers. The approach proceeds in layers. First, they define trust as a directional, context-specific relationship carrying vulnerability, drawing on philosophical work (O'Neill; Freiman) and on computational trust research stretching back to Marsh (1994) and including ReGreT, the Beta reputation system, TRAVOS and EigenTrust. Second, they review known LLM failure modes from the AI safety literature. Third, they construct a six-model taxonomy and produce a comparison table covering basis of trust, strengths, weaknesses, LLM-related mitigations, and representative uses. Fourth, they read each protocol specification — A2A, AP2, ERC-8004, NANDA — and identify which of the six models it embodies, then assess each against metrics spanning security, privacy, latency/cost, and social robustness such as Sybil, collusion and whitewashing resistance. Finally, they synthesize design implications and a tiered blueprint (T0–T3).

Why This Matters

Impact on research. The paper gives the emerging agentic web a shared vocabulary for trust, connecting protocols that are usually discussed separately and tying them back to decades of computational trust work. It also reframes LLM failure modes — prompt injection, sycophancy, hallucination, deception, misalignment — as protocol design problems rather than only model-level ones, and ends with a research agenda.

Real-world applications.

• Agentic payments: AP2-style flows in which mandates bind an agent's actions to explicit user authorization, with reputation-based routing and optional stake-backed validation gating expensive payments.
• Enterprise and cross-organizational agent interoperability: A2A deployments where AgentCards, allow-lists, API gateways and hardened sandboxes govern traffic between known participants.
• Decentralized agent marketplaces: ERC-8004-style registries for discovery, feedback and staked validation, where identities and attestations are addressable and validations can be tailored per task.
• Regulated and high-harm domains: healthcare, finance and critical infrastructure, where the paper recommends domain-specific trust zones with clinical credentials, statutory human oversight and compliant logging.

Industry relevance. The protocols studied here come from Google, PayPal and the Ethereum ecosystem, all of which matter to platform builders, payments firms, identity and credential issuers, blockchain infrastructure teams, and standards bodies. The paper's guidance on modular "trust hooks", declarative per-action policy, and risk-scaled bonds speaks directly to engineering and compliance decisions.

Future Directions

• Resolving the governance gap for correctness versus desirability. Because proofs attest properties of computations rather than normative desirability, misaligned but formally correct behavior remains unsolved. Who defines what should be proved, and how are flawed policies caught?

• Standardizing staking, validation and reputation across protocols. The paper notes that AP2 does not standardize Reputation or Stake on the wire and that ERC-8004's benefits are optional unless counterparties require validation, raising open questions about standardization and interoperability.

• Building anti-gaming defenses into economic and social layers. Anti-Sybil measures such as binding identities to keys with history, entry deposits, credential prerequisites, reputation decay, transitive weighting of raters, and anomaly detection for correlated feedback all remain active design problems.

• Addressing privacy and fairness in persistent trust records. Globally visible, indelible histories raise privacy concerns, and the authors flag that high stake requirements and accumulated reputation can concentrate power and erect barriers to entry, pointing to selective disclosure and progressive staking as areas needing further work.

• Completing and testing the tiered blueprint. The T0–T3 framework is presented as a design proposal; whether the tiers reduce real incidents, and how transitions are enforced in practice, is not evaluated in the available content.

Target Audience

Protocol and platform architects designing agent interoperability, identity or payment systems; AI safety and trust researchers working on multi-agent systems; standards and governance practitioners in payments, credentials and blockchain; and product or policy leads at organizations preparing to let autonomous agents act on their behalf. The paper is also useful for graduate students in HCI, security or distributed systems who want a structured map of the trust design space before diving into any single protocol specification.

Authors’ abstract

As the "agentic web" takes shape-billions of AI agents (often LLM-powered) autonomously transacting and collaborating-trust shifts from human oversight to protocol design. In 2025, several inter-agent protocols crystallized this shift, including Google's Agent-to-Agent (A2A), Agent Payments Protocol (AP2), and Ethereum's ERC-8004 "Trustless Agents," yet their underlying trust assumptions remain under-examined. This paper presents a comparative study of trust models in inter-agent protocol design: Brief (self- or third-party verifiable claims), Claim (self-proclaimed capabilities and identity, e.g. AgentCard), Proof (cryptographic verification, including zero-knowledge proofs and trusted execution environment attestations), Stake (bonded collateral with slashing and insurance), Reputation (crowd feedback and graph-based trust signals), and Constraint (sandboxing and capability bounding). For each, we analyze assumptions, attack surfaces, and design trade-offs, with particular emphasis on LLM-specific fragilities-prompt injection, sycophancy/nudge-susceptibility, hallucination, deception, and misalignment-that render purely reputational or claim-only approaches brittle. Our findings indicate no single mechanism suffices. We argue for trustless-by-default architectures anchored in Proof and Stake to gate high-impact actions, augmented by Brief for identity and discovery and Reputation overlays for flexibility and social signals. We comparatively evaluate A2A, AP2, ERC-8004 and related historical variations in academic research under metrics spanning security, privacy, latency/cost, and social robustness (Sybil/collusion/whitewashing resistance). We conclude with hybrid trust model recommendations that mitigate reputation gaming and misinformed LLM behavior, and we distill actionable design guidelines for safer, interoperable, and scalable agent economies.