Honest About Trust Roots

Start with the engineering, because it is serious.

The AGNTCY Agent Directory Service (ADS) is a distributed directory that stores agent metadata as records described by the Open Agentic Schema Framework (OASF).[1][2] It reached v1.4.0 across more than forty releases and eight hundred commits, Apache-licensed, with Go, Python, and JavaScript SDKs, a gRPC and Protocol Buffers interface, and a specification under active development as an IETF Internet-Draft.[1][4] Records are addressed by cryptographic digest — a content identifier, or CID — so a record is immutable and globally unique by construction.[3][4] Discovery runs over a Kademlia distributed hash table that maps a skill-and-domain taxonomy to the records announcing those skills, and content is distributed over mature OCI registry infrastructure rather than a bespoke store.[2][3] This is not a proposal document. It is working, versioned, actively maintained distributed-systems infrastructure.

Where AGNTCY Separates From the Field

Its trust model is where AGNTCY separates from the field, and where the credit is earned. Three design choices matter. First, integrity is mandatory and identity-free: every record is addressed by its digest, so tampering is detectable without trusting any intermediary — the CID either matches the content or it does not.[3][4] Second, provenance is real and keyless: records can be signed through GitHub’s OIDC identity, so a verified signature resolves to a specific publishing workflow — the signer identity, the issuer, and the timestamp — without the publisher having to run key-management infrastructure.[1] Third, and most telling, AGNTCY explicitly declines a centralized trust anchor and explicitly declines the on-chain path: the specification names blockchain-oriented approaches such as ERC-8004 as a related direction it does not take, choosing off-chain content distribution for cost and performance while keeping cryptographic verification through signatures and digests.[3][4] Most formats in this space reach for a trust root and quietly make themselves its center. AGNTCY refuses the move and says so.

That honesty is exactly what makes its limit legible, and the limit is structural, not a flaw. Signing in ADS is a SHOULD, not a MUST — provenance is an optional layer over mandatory integrity.[3][4] So the floor AGNTCY guarantees is that a record has not been tampered with; the provenance ceiling — who published it, through which pipeline — is available but not required. An enterprise consuming a record has to check whether it was signed at all before it can reason about who stands behind it.

The Wall, Stated Precisely

And here is the wall, the same one every format in this arc meets. Even a fully signed ADS record, with keyless OIDC provenance resolving to a named GitHub workflow, proves something precise and bounded: this record was published by this pipeline, and its bytes are intact. It is the strongest provenance claim in the arc — genuine supply-chain provenance, the same class of guarantee that secures software artifacts. It is still provenance of the artifact, not verification of the agent. A signed OASF record can accurately attest its own origin and integrity while the agent it describes behaves nothing like the record claims at runtime. Supply-chain provenance answers “where did this record come from and has it been altered.” It does not answer “does the running agent do what this record says, and is it still authorized to.” That final step — behavioral verification bound to authority, revocable on a governance clock — is the alignment-grade step, and ADS by design operates one layer below it, at the artifact.

Read against the five Substrate Fitness Criteria:

Discoverability — strong. Taxonomy-driven, capability-based discovery over a DHT, with content-addressed records and semantic skill-and-domain matching.[2][3] Among the richest discovery models in the arc, and the only one designed for distributed, multi-registry federation from the start.

Context integrity — strong. This is AGNTCY’s standout criterion. Content addressing means a record’s identity is its content — any change produces a different CID, so integrity is structural rather than asserted, and requires no trusted intermediary to verify.[3][4] No other format in the arc makes tampering detectable by construction.

Action authority — partial. OASF describes an agent’s skills, domains, and modules richly, and a separate AGNTCY identity component extends to agents, MCP servers, and multi-agent systems.[1] But the directory describes declared capability; it does not bind runtime authority to verified behavior. What the agent is permitted to do still lives in the consuming system’s policy, not in the record.

Permissioning — partial. Signing infrastructure and content addressing give a real basis for trust decisions, and records support version histories and revocation-relevant relationships.[1][3] What is absent is an independent, governance-clock revocation of an agent’s live authority — delisting or superseding a record is not the same as revoking a credential mid-flight when trust breaks.

Provenance — strong, and honestly bounded. Keyless OIDC signing yields verifiable publisher provenance — signer, issuer, timestamp — over content-addressed, tamper-evident records.[1][3] It is the strongest provenance in the arc. It is bounded, by AGNTCY’s own design, to the artifact and its pipeline: provenance of publication, not verification of behavior.

The Honest Accounting

The accounting gives AGNTCY the most credit in this arc and still lands it on the same wall. This is the format that treated integrity as non-negotiable, made provenance real without imposing a key-management burden, and had the discipline to decline the centralized and on-chain trust roots that would have made it the arbiter of its own ecosystem. An enterprise gets more defensible assurance from a signed, content-addressed ADS record than from anything else surveyed here. What it still does not get — what no format in this arc delivers — is proof that the agent behaves as its record claims, bound to an authority it can revoke on a governance clock. AGNTCY climbed higher than the others by being honest about where the climb stops: it secures the artifact and the pipeline, completely and verifiably, and it does not pretend that securing the artifact verifies the agent.