An individual Internet-Draft published 14 October 2026, `draft-watts-agentic-authority-graph-validation-00`, proposes a machine-readable way to answer a question that KYA practitioners currently answer by assertion: when you revoke an agent’s authority, does that actually close every path it could use?
What happened
The draft — “Agentic Authority Graph Validation: A Non-Vacuous Interchange Profile for Revocation-Cut Analysis”, by Deonté O’dell Watts (GoodShyt Group Inc.), intended status Experimental, expiring 17 April 2027 — defines Agentic Authority Graph Validation (AAGV).
The premise: authorization and revocation increasingly “operate across delegated agents, exchanged credentials, queues, retries, services, and resource-side enforcement points”. A graph models these relationships, but a universal claim such as “every path crosses K” is misleading if the graph omits its endpoints or has no declared normal path. So AAGV adds explicit anti-vacuity rules on top of ordinary reachability checks.
The model has a small, precise vocabulary:
- Authority root — a declared origin of authority whose reachability is being analysed.
- Consequential sink — a resource or commitment boundary where a successful operation has an externally relevant effect.
- Normal path — an explicitly declared root-to-sink path known to be valid in ordinary operation, which stops a cut from succeeding merely because no path was modelled.
- Revocation cut set — a declared set of revocable edges whose removal is intended to disconnect every root from every sink.
- Relevant unknown edge — an edge with unknown state that an attacker or a bug could still use.
It then gives a deterministic validation algorithm and four outcomes: INVALID (malformed, vacuous, non-dominating cut), INDETERMINATE (structure and cut valid, but relevant edge state is unknown), VALID_OPEN (a live root-to-sink path remains), and VALID_CLOSED (no enabled root-to-sink path in the declared snapshot). Two design choices stand out: unknown state is never treated as closed (it returns INDETERMINATE), and the draft states plainly that a cut edge must be declared revocable or the object fails — you cannot “close” a door the model says cannot be locked.
The author is careful about scope. AAGV “does not define an authorization token, discover hidden paths, or prove physical containment”, and it explicitly warns that an operator can omit a bypass and still produce a structurally valid snapshot — so graph coverage remains a separate assurance question. It draws on OAuth token revocation (RFC 7009) and Token Exchange (RFC 8693) but does not replace them, and sits alongside other individual drafts on revocation closure and actor chains.
Why it matters for KYA
Revocation is a first-class KYA pillar, and it is the one most often asserted rather than tested. Teams routinely say “we can cut off an agent at any time” without being able to demonstrate that the cut reaches every path the agent could take — through a queue, a retry, a cached credential, or a downstream service.
AAGV’s contribution is narrow but real: it turns “we revoked it” from a claim into a checkable claim about a declared snapshot — and it insists on the right kind of check by refusing to let a vacuous graph (no sinks, no normal paths) produce a positive security result. For anyone building agent audit trails or delegated-authority controls, the two constants worth borrowing regardless of whether this drafts survives are:
- Model the whole path, not the token. Delegation lineage is necessary but not sufficient; queues, enforcement edges and commitment boundaries can carry a bypass.
- Fail closed on unknown state. Returning INDETERMINATE — not “closed” — when an edge’s state is unknown is the difference between an audit and a comfort blanket.
The caveats are large and should be stated plainly. This is an individual Internet-Draft at revision -00, authored by one person, intended Experimental, and not adopted by any IETF working group. By the IETF’s own boilerplate it is “inappropriate to use … as reference material”; there are no implementations and no conformance run yet beyond the author’s stated test-vector plan. It defines an interchange format for one declared snapshot, not a system that finds hidden paths. Read it as a well-formed idea entering the standards conversation — most relevant to people writing agent-authorization tooling — not as plumbing you can adopt today.
Sources
- IETF Datatracker, draft-watts-agentic-authority-graph-validation-00, “Agentic Authority Graph Validation: A Non-Vacuous Interchange Profile for Revocation-Cut Analysis”, 14 October 2026 (expires 17 April 2027) — datatracker.ietf.org.
- IETF, RFC 7009, “OAuth 2.0 Token Revocation” (August 2013) — cited as related work — rfc-editor.org.
- IETF, RFC 8693, “OAuth 2.0 Token Exchange” (January 2020) — cited as related work — rfc-editor.org.
Note: this is an individual Internet-Draft, not a working-group document or a standard. It may be updated, replaced or obsoleted at any time and should not be relied on as settled practice.
Know Your Agent (KYA) explains agent identity, verification and accountability. This is an explainer, not legal or compliance advice — see our Sources & methodology. New to KYA? Start with What is Know Your Agent? and the glossary.