NostrAgent: A Decentralized Identity and Delegation Architecture for Sovereign Agentic Systems

Oliver Aleksander Larsen; Mahyar Tourchi Moghaddam

cs.SESep 19, 2026

NostrAgent: A Decentralized Identity and Delegation Architecture for Sovereign Agentic Systems

Authors: Oliver Aleksander Larsen, Mahyar Tourchi Moghaddam

Organizations: University of Southern Denmark, Odense, Denmark

Abstract

Autonomous AI agents increasingly act across organizational boundaries on behalf of human operators: they invoke third-party services, delegate subtasks to other agents, and pay for metered resources. Deploying such agents safely requires five capabilities that today live in separate systems: persistent identity, scoped delegation, peer trust, discovery, and payment. Existing approaches root these in centralized authorities or cover only subsets, so authority, trust, and payment fracture exactly where autonomy needs continuity: when a key rotates or a delegation must be revoked. We present NostrAgent, a decentralized architecture that unifies all five over Nostr relays using three custom event kinds: Kind 38100 identity declarations authenticated by BIP340 Schnorr signatures with pre-rotation commitments, Kind 38101 scoped delegation chains whose every hop verifiably narrows granted capabilities, and Kind 38102 peer attestations forming a Sybil-deterrent trust graph, with Lightning HTTP 402 (L402) binding payment to agent identity. Identity remains operator-sovereign without any registration authority; relays are substitutable transport rather than a trust root; and every authorization decision is replayable offline from signed events. We evaluate a Python prototype with a mixed-method design: ATAM quality analysis with a two-round mini-Delphi panel, STRIDE threat modeling across three trust boundaries, eleven benchmarks with non-parametric statistics, and 19 failure modes. Results show sub-millisecond offline verification, linear delegation-chain scaling, and Lightning-settled L402 at 157 ms median on regtest. 17 of 19 failure modes pass empirically, one is bounded analytically, and one is disclosed as an architectural limitation. NostrAgent demonstrates an auditable prototype substrate for trustworthy agentic systems without centralized trust roots.

Figures & tables

Term	Meaning
d -tag	Operator-chosen stable identifier keying a replaceable event
Preimage	Secret whose SHA256 hash locks a payment; proof of settlement
Satoshi (sat)	Smallest Bitcoin unit; Lightning payments are denominated in sats
Regtest	Local, deterministic Bitcoin/Lightning test network
Pre-rotation	Commitment to the hash of the next key before that key is ever used
Noisy-OR	Combination rule treating each trust path as independent evidence

Table 1: Recurring terms used before or beyond their defining subsection.

System	A1	A2	A3	A4	A5	A6	A7
NostrAgent	✓ ${}^{M\!,P}$	✓ ${}^{M\!,P}$	✓ ${}^{M\!,P}$	✓ ${}^{M\!,P}$	✓ ${}^{M\!,P}$	✓ ${}^{A\!,P}$	$\circ^{M\!,P}$
AIP ( key: )	✓ ${}^{P\!,L}$	✓ L	$\times$ P	$\times$ P	$\times$ P	✓ P	$\circ^{L}$
AIP ( web: )	$\times$ P	✓ L	$\circ^{P}$	$\times$ P	$\times$ P	$\times$ P	$\circ^{L}$
KERI/ACDC	✓ ${}^{P\!,L}$	✓ ${}^{P\!,L}$	✓ ${}^{P\!,L}$	$\times$ P	$\times$ P	$\circ^{P\!,L}$	$\circ^{A}$
W3C DID ( did:web )	$\circ^{P\!,L}$	$\circ^{P}$	$\circ^{P}$	$\circ^{P}$	$\times$ P	$\circ^{P}$	$\times$ A
ERC-8004	$\circ^{P\!,L}$	$\times$ P	$\circ^{P}$	$\circ^{P\!,L}$	$\circ^{P}$	$\times$ P	$\times$ A

Table 2: Comparison of agent identity approaches. ✓ = Full,

\circ

= Partial,

\times

= None. Evidence: M measured, L literature, P protocol analysis, A architectural argument.

Panel of Figure 1 — Figure 1: NostrAgent component-and-connector view with trust boundaries TB1 to TB3. Solid arrows: delegation (Kind 38101); dashed: attestation (Kind 38102); double: L402 payment. Relay borders: solid = operator-controlled, dashed = public.

Panel of Figure 2 — Figure 2: Delegation chain with scope attenuation (top) and cascade revocation (bottom).

Panel of Figure 3 — Figure 3: L402 unified identity-payment flow. The 65-byte macaroon identifier binds the credential to the agent’s BIP340 public key, making it non-transferable.

ID	What it measures	Env.
B1	Kind 38100 verification: serialization, event-id recomputation, BIP340 verify, content parse	Offline
B2	Isolated BIP340 signature verification, per event kind	Offline
B3	Delegation-chain verification at depths 1 through 4	Offline
B4	Relay discovery of a Kind 38100 identity across 1 to 3 relays	Docker
B5	Kind 38102 attestation validation: schema, event id, signature	Offline
B6	Trust-graph query (noisy-OR depth-first search), 5 to 500 nodes	Offline

Table 3: Benchmark definitions. Offline = in-process cryptographic microbenchmark; Docker = live Compose testbed. Run counts and warm-up protocol in Section 5.1 ; results in Table 4 .

ID	Variant	Median (ms)	IQR	P95	P99	N
B1	kind_38100 auth	0.0165	0.0005	0.0169	0.0204	900
B2	BIP340 verify (all kinds)	0.0154	0.0001	0.0157	0.0169	900
B3	depth 1	0.0155	0.0001	0.0159	0.0196	900
B3	depth 2	0.0308	0.0005	0.0320	0.0365	900
B3	depth 3	0.0460	0.0001	0.0487	0.0520	900
B3	depth 4 ( $\approx$ 15 us/hop)	0.0619	0.0002	0.0658	0.0698	900

Table 4: NostrAgent benchmark results: representative medians per benchmark B1 to B11, with the full B3 depth and B6b

D_{\max}

sweeps. B6 holds

D_{\max}{=}4

(default); B6b sweeps

D_{\max}

at fixed

n{=}50

. Environments per benchmark in Table 3 .

Branch	Leaf	Concern	(Imp, Diff)
Sovereignty	S1	Offline verifiability	H,H
	S2	Censorship resistance (relay migration)	H,M
	S3	Key portability (rotation enforcement)	H,H
	S4	Infrastructure independence	M,L
Operability	O1	Verification latency	H,M
	O2	Framework interoperability d	M,M

Table 5: ATAM utility tree with final Round 2 (importance, difficulty) ratings from the mini-Delphi panel; the bold H,H leaves are the differentiators anchoring RQ1.

Gap	Mechanism	Evidence
G1 key continuity	Pre-rotation and prev_key chain (Sect. 4.5 )	B7: rotation 236 ms; FM-6: competing rotations rejected; FM-7: continuity; attestations survive rotation (T2)
G2 attenuated delegation	Kind 38101, INV-1 through INV-7 (Sect. 4.3 )	B3: linear verification at roughly 15 µs per hop; B10: 4.2 µs per caveat; B8: revocation on all relays in 337 ms; FM-9 and FM-17: escalation rejected
G3 peer trust	Kind 38102 attestations, noisy-OR aggregation, L402 cost floor (Sect. 4.4 )	FM-8: decay caps Sybil trust at 0.714 vs. 1.0; FM-13: 10,000 to 20,000 sats per unit of fabricated trust; B6: query scaling
G4 registry-free discovery	Kind 38100, NIP-01 filters, multi-relay publishing (Sect. 4.2 )	B4: resolution 1.4 to 2.3 ms (SP-1); FM-1: graceful degradation; FM-2: omission defeated
G5 identity-bound payment	65-byte macaroon identifier, preimage, BIP340 request signature (Sect. 4.6 )	B9: settlement 157 ms; B11: five checks in 0.055 ms; FM-4: LND-outage recovery

Table 6: Gap fulfillment: the five deficits of Section 1 , the mechanism closing each, and the measured evidence.

ID	Status	Detail
FM-1	PASS	Relay partition: resolution succeeds with 1/2/3 relays (3.9/3.3/11.1 ms)
FM-2	PASS	Relay malice: union queries defeat censorship-by-omission; BIP340 signatures preclude tampering
FM-4	PASS	L402 fails cleanly on LND outage; recovers without channel corruption
FM-5	PASS	Revocation verification: 33.4 µs
FM-6	PASS	Key compromise: attacker rejected, legitimate rotation accepted
FM-7	PASS	Key loss: identity chain valid after pre-rotation recovery

Table 7: Failure mode results (FM-1 to FM-19). FM-3, FM-15 are analytical; the other 17 are empirical and pass. Related modes share a row.

Category	TB1	TB2	TB3
Spoofing	2	2	2
Tampering	2	1	2
Repudiation	3	2	2
Information Disclosure	4	4	3
Denial of Service	3	2	3
Elevation of Privilege	2	2	2

Table 8: STRIDE residual-risk across TB1 (Agent-Relay), TB2 (Agent-Agent), TB3 (Agent-Service); 1 (negligible) to 5 (critical) post-mitigation.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 510 papers

Aug 13, 2026

InterSAGE: The Secure and Verifiable Interoperability Protocol for An Internet of Agents

The emerging Internet of Agents enables LLM-powered agents to discover peers, invoke tools, and delegate tasks across organizational boundaries. Existing protocols increasingly define how agents exchange messages, but not how an agent proves its identity, authorization, advertised capabilities, or accountability after delegation. We present InterSAGE, a trust-native protocol suite that supplies this missing security substrate alongside, rather than in place of, communication protocols. InterSAGE comprises four layers: Persistent Identity, Discovery, Trust Negotiation, and Accountability. Its four core primitives are: (1) Agent Identity Cards that bind developer, code package, operator, and deployment context; (2) capability-aware discovery using DID-bound Verifiable Credential manifests; (3) trust negotiation combining monotonic capability attenuation with two-tier access control; and (4) kernel-mediated cryptographic audit trails that bind usage, delegation, and execution traces to agent identity without a consensus ledger. InterSAGE is designed to complement MCP, A2A, ANP, and AG-UI, allowing communication protocols to evolve independently while keeping trust semantics explicit, portable, and verifiable. We compare InterSAGE with more than 50 efforts spanning agent protocols, decentralized identity, OAuth/OIDC extensions, zero-trust governance, delegation, and audit architectures. We show that no prior architecture jointly enforces persistent identity, capability-aware discovery, trust negotiation, and accountability as a unified four-layer trust substrate for secure agent interoperability.

Zhenhua Zou, Sheng Guo, Qiuyang Zhan +3

A Paper from the DeepKernel Lab

AI Accountability AI Agent Security Capability-Based Security

Ask PDF

Apr 3, 2026

SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems

When Agent A delegates to Agent B, which invokes Tool C on behalf of User X, no existing framework can answer: whose authorization chain led to this action, and where did it violate policy? This paper introduces SentinelAgent, a formal framework for verifiable delegation chains in federal multi-agent AI systems. The Delegation Chain Calculus (DCC) defines seven properties - six deterministic (authority narrowing, policy preservation, forensic reconstructibility, cascade containment, scope-action conformance, output schema conformance) and one probabilistic (intent preservation) - with four meta-theorems and one proposition establishing the practical infeasibility of deterministic intent verification. The Intent-Preserving Delegation Protocol (IPDP) enforces all seven properties at runtime through a non-LLM Delegation Authority Service. A three-point verification lifecycle achieves 100% combined TPR at 0% FPR on DelegationBench v4 (516 scenarios, 10 attack categories, 13 federal domains). Under black-box adversarial conditions, the DAS blocks 30/30 attacks with 0 false positives. Deterministic properties are unbreakable under adversarial stress testing; intent verification degrades to 13% against sophisticated paraphrasing. Fine-tuning the NLI model on 190 government delegation examples improves P2 from 1.7% to 88.3% TPR (5-fold cross-validated, F1=82.1%). Properties P1, P3-P7 are mechanically verified via TLA+ model checking across 2.7 million states with zero violations. Even when intent verification is evaded, the remaining six properties constrain the adversary to permitted API calls, conformant outputs, traceable actions, bounded cascades, and compliant behavior.

KrishnaSaiReddy Patil

AI Agent Governance Multi-Agent System Security Runtime Enforcement for AI Agents Tool Access Control for LLM Agents Formal Verification

Ask PDF

Oct 12, 2026

Who is the 'I' in AI? Establishing Decentralized Identity and Accountability for Autonomous Agents

The rapid proliferation of autonomous AI agents in decentralized ecosystems challenges existing identity paradigms. While human identity is traditionally anchored in biological and/or self-asserted attributes and government credentials, AI agents lack a standardized definition of selfhood, creating critical gaps in trust and accountability. This paper introduces a novel framework for establishing Decentralized AI Identity rooted in Self-sovereign identity (SSI) principles. We propose a formal model that clearly distinguishes human users and AI agents, enabling distinct verification logic for each class while maintaining a unified identity calculus. The central to our contribution is the ABCD Framework, a multi-layered approach to agent identification and verification: (A) Algorithmic Fingerprint, which binds the identity to static model architectures and provenance; (B) Behavioural Fingerprint, which verifies dynamic performance metrics over time; (C) Cryptographic Identity, which anchors the agent via Decentralized Identifiers (DIDs) and (D) Delegation, which cryptographically binds agent actions to respective human accountability. By orthogonalizing these dimensions, we model how systems can enforce granular trust policies ranging from simple authentication to complex liability assignment, thereby solving the black box identity problem in the autonomous economic activities of AI agents.

Ahammod Munim Ramil, Khalid Al Kafi, M. A. Abdullahis Sany +4

Department of Computer Science and Engineering, BRAC University, Dhaka, Bangladesh · School of Computing, Mathematics and Engineering, Charles Sturt University, Bathurst, New South Wales, Australia

AI Accountability AI Agent Governance

Ask PDF

Abstract

AI Agent Security

Explore similar work

InterSAGE: The Secure and Verifiable Interoperability Protocol for An Internet of Agents

SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems

Who is the 'I' in AI? Establishing Decentralized Identity and Accountability for Autonomous Agents