Start with the decomposition, because it is the contribution.
The NANDA architecture separates a single agent record into three tiers: a lean index returning a signed, cacheable AgentAddr (≤120 bytes — agent ID, TTL, and pointers, Ed25519-signed by the resolver); an AgentFacts document (JSON-LD, signed as a W3C Verifiable Credential, holding capabilities, endpoints, telemetry config, and credentialed evaluations); and a dynamic resolution tier for live endpoint routing.[1] The index holds only stable identity and pointers; the facts hold volatile, signed metadata that updates without touching the index; the resolution tier handles endpoints that may rotate every thirty to sixty seconds. This is the plane-separation the parent series calls for, expressed more explicitly than any other format in the arc: identity, capability, endpoint, and freshness each live on their own clock, each independently signed, each independently revocable.
What the Decomposition Buys
Two properties of that design deserve unqualified credit. First, the planes are genuinely independent. An AgentFacts document is signed as a W3C VC v2 and can be updated — new capabilities, new endpoints, new audit results — without an index write, because the index only stores a pointer to the facts URL.[1] Endpoint churn, capability revision, and identity resolution stop sharing a single record and a single clock. Second, and rarer, revocation is a first-class, sub-second design goal. The draft specifies short-lived verifiable credentials (under five minutes) and VC-Status-List revocation, targeting sub-second credential invalidation and key rotation.[1] No other format in this arc treats fast revocation as a named architectural guarantee. A2A re-signs and re-fetches on the card’s own clock; AGNTCY delists or supersedes a record; Entra revokes at the directory. AgentFacts is the one that set out to make a credential go stale in under a second by construction.
That is the strongest permissioning intent in the arc — and here is where the maturity flag earns its place. Sub-second revocation is a specified design goal in a V0.3 draft with prototyped resolvers, not a property of a deployed system carrying production agents.[1] The mechanism is real and well-chosen; its status is proposal-grade. An architect reading this has to hold both facts at once: the design is ahead of the field on revocation, and the design is a draft.
| Plane | AgentFacts mechanism | Assurance status |
|---|---|---|
| Identity | Lean index → signed AgentAddr (Ed25519, ≤120B) | Resolved and signed — who the agent is |
| Capability | Credentialed assertion in signed AgentFacts (W3C VC) | Notarized — issuer asserted it, not verified true |
| Endpoint | TTL-scoped lists (static 1-6h / rotating 5-15m / adaptive 30-60s) | Fresh by design — proposal-grade |
| Revocation | Short-lived VCs (<5 min) + VC-Status-List | Sub-second intent — first-class, draft-stage |
| Behavior | — | Out of scope; named as future work |
The Wall, Stated in Its Own Design
Now the wall, which AgentFacts states more plainly than any format before it. The draft’s own framing is “from self-advertising to audited metadata”: AgentFacts are treated as verifiable claims requiring W3C Verifiable Credential attestation, with issuers — enterprises, consortiums, federated certification authorities — operating in trust zones that can cross-sign, each claim anchored to an issuer ID with revocation status.[1] Read that precisely. The guarantee is that a named, authorized issuer asserted a capability, and that the assertion is cryptographically bound and revocable. That is a real and valuable guarantee. It is also, exactly, notarization: the signature proves the issuer made the claim. It does not prove the claim is true. A capability assertion signed by an authorized issuer — “this agent translates 25 languages at 300ms latency,” carrying a performance score and an audit trail — is only as true as the issuer’s audit was, and the architecture’s job ends at verifying that the issuer signed, not at verifying that the agent, at runtime, does what the signed facts say. The draft is honest about this: behavioral trust-score computation and integration with behavioral monitoring systems are named as future work, not delivered guarantees.[1] AgentFacts formalized the planes and named the ceiling in the same document.
Read against the five Substrate Fitness Criteria — scoring the specified architecture, maturity labeled:
Discoverability — strong. A two-step resolution (lean index → FactsURL) over a quilt-like index designed to federate NANDA-native, enterprise, and Web3 registries, with rapid global resolution as a stated target.[1][2] The discovery model is among the most complete in the arc — explicitly built for cross-registry, cross-jurisdiction federation. What it discovers is real agents, and the design accommodates third-party agents through the index quilt. Discovery is where the architecture is most fully specified.
Context integrity — partial. This is where the honest score sits, and where AgentFacts separates from AGNTCY. Freshness is addressed directly: TTL-scoped endpoint lists, signed AgentFacts, short-lived credentials.[1] But integrity here is asserted-and-signed, not structural. AGNTCY’s content addressing makes tampering detectable by construction — the record’s identity is its content. AgentFacts relies on issuer signatures over mutable JSON-LD documents; a signature proves the document was issued and unaltered since signing, not that its live claims match live behavior. Strong freshness mechanisms over signed-but-mutable records: Partial.
Action authority — partial. Capabilities are credentialed assertions with declared performance, scopes, and required auth methods (OAuth2/JWT), and can carry third-party audit references.[1] Richer capability description than most of the arc. But the record describes asserted, issuer-attested capability; it does not bind verified runtime authority to identity. What the agent is permitted to do at execution still resolves through the consuming system and the issuer’s attestation, not through a proof that the running agent holds and exercises exactly that authority.
Permissioning — partial, and the strongest partial in the arc. Sub-second VC-Status revocation and short-lived credentials are a genuine, named advance — the closest any format comes to governance-clock revocation.[1] Two things hold it at Partial. First, maturity: it is a specified design goal, not a deployed guarantee. Second, scope: it revokes the credential’s validity, invalidating an issuer’s assertion, which is necessary but not identical to revoking a live agent’s exercised authority mid-task under enterprise governance. The mechanism points directly at the missing plane. It does not yet close it.
Provenance — partial. Every claim is issuer-attested through W3C VCs, anchored to issuer IDs, with federated trust zones and cross-signing.[1] This is provenance of who asserted the claim — strong within the trust-zone model, and explicitly notarization by design. It is not provenance of behavior: the signature attests the issuer, not the agent’s runtime conduct. Like every format in the arc, the provenance is of the assertion, bounded here by the issuer’s authority and audit rather than verified against the running agent.
| Criterion | Rating | Basis |
|---|---|---|
| Discoverability | Strong | Two-step lean-index → FactsURL resolution; quilt-like cross-registry federation |
| Context integrity | Partial | TTL-scoped freshness over signed-but-mutable JSON-LD; asserted, not structural like content-addressing |
| Action authority | Partial | Credentialed capability assertions with audit refs; no binding of verified runtime authority to identity |
| Permissioning | Partial · strongest | Sub-second VC-Status revocation — strongest intent in arc; proposal-grade, and revokes credential not live authority |
| Provenance | Partial | Issuer-attested W3C VCs in federated trust zones — provenance of the assertion, by design, not of behavior |
The Honest Accounting
The accounting credits AgentFacts for two things no other format in this arc delivers as cleanly: it decomposed the agent record into independently signed, independently revocable planes, and it made sub-second revocation a first-class design goal. That decomposition is the architecture the parent series argues an enterprise substrate needs — identity, capability, endpoint, and authority each on their own governed clock. And in the same draft that formalizes the planes, NANDA names the wall: a capability is a credentialed assertion, a signature proves the issuer made the claim, and verifying behavior against the claim is future work. AgentFacts is the format that got closest to the shape of the answer and was most explicit that the shape is not yet the proof. It is credentialed. It is not, in the sense enterprise assurance requires, verified — and it says so.
A capability in AgentFacts is a credentialed assertion: signed by an authorized issuer, cryptographically bound, revocable. The guarantee is that a named issuer asserted the capability — not that the agent has it.
AgentFacts formalized the planes and named the ceiling in the same document. Behavioral verification against the claim is explicitly future work — the draft says so.
