RFC-ATF-1: Agent Trust Fabric — A Post-Quantum Cryptographic Protocol for Autonomous AI Agent Authority Governance

RFC-ATF-1 defines the Agent Trust Fabric (ATF) — a formally specified, post-quantum cryptographic protocol for authority governance of autonomous AI agents before execution. ATF provides the first formally specified and independently verifiable protocol that answers four questions for every AI agent execution: (1) Who authorized this agent? — via ML-DSA-65 signed Delegation Receipt (DR) traceable to a human principal(2) What authority did it hold? — via Monotonic Authority Reduction (MAR) invariant, formally verified in TLA+ across 5 properties(3) Was the authority valid at the exact moment of execution? — via Temporal Admissibility Record (TAR) captured before the governance pipeline runs, nanosecond-resolution timestamp using time.time_ns(), cryptographically committed via PQC signature(4) Is the full chain independently verifiable? — via offline CLI verifier, no platform access required (ATF-INV-006) The result is a three-artifact audit chain: DR + TAR + GovernanceReceipt, each signed with ML-DSA-65 (NIST FIPS 204 / CRYSTALS-Dilithium). NOVEL CONTRIBUTIONS: 1. Monotonic Authority Reduction (MAR) — ATF-INV-001: A formally specified invariant ensuring DR.authority_budget_granted ≤ DR.authority_budget_delegator, transitively across any chain. Formally proven in TLA+. No prior AI agent framework formally specifies this as a system invariant. 2. Temporal Admissibility Record (TAR) — ADR-157: A cryptographically signed record establishing that a specific Delegation Receipt was ACTIVE at the nanosecond of execution. Format: ATFTAR-{16HEX}. No prior published system produces a signed, independently verifiable record binding a delegation receipt to its status at an execution timestamp. 3. Cross-Domain Trust Portability with Authority Discount — ADR-158: A protocol for translating agent authority across governance domains with mandatory authority reduction (Domain Translation Receipt, ATFDTR-{16HEX}). Domain-pair-specific discount policies ensure authority always decreases at domain crossings. 4. ATF Chain Completeness Score (CCS): A [0-100] metric measuring the cryptographic completeness of an agent's delegation chain — analogous to a credit rating for AI agent governance. No prior system defines a quantitative completeness score for AI agent delegation chains. 5. Three-Level Compliance Framework (LEVEL-1/2/3): Basic, Standard, and Sovereign deployment tiers, with Sovereign requiring formal verification (TLA+/Coq) and CLI verifier. DISTINCTION FROM PRIOR ART: No prior protocol — including W3C Verifiable Credentials, IETF JWT (RFC 7519), OAuth 2.0, OpenID Connect, or existing AI agent frameworks (LangChain, AutoGen, CrewAI, Microsoft Semantic Kernel, Google ADK) — provides all four properties (authorization chain, monotonic authority bound, pre-execution temporal admissibility record, independent offline verifiability) in a single formally specified, reference-implemented protocol using post-quantum signatures. Formal properties verified in TLA+: Monotonic Authority Reduction, MAR Chain Transitivity, Acyclicity, Chain Root Consistency, Immutability — same methodology as AWS DynamoDB. Regulatory alignment: EU AI Act Arts. 13/14, DORA Art. 9, MiCA, NIST AI RMF, SOC 2 Type II, ISO 27001. Reference implementation: Python. Public CLI verifier included (no platform access required).GitHub: https://github.com/Costenho19/rfc-atf-1SSRN Preprint: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6757339