Protocol

Actor model

TSAI defines five actors and assigns a separate responsibility to each. This separation allows evidence to move between organisations without giving the trust authority control over service provider decisions.

Actors and relationships

An agent is the software entity that acts, while its operator is the legal entity that runs it and is accountable for its behaviour. A service provider receives the agent's requests and decides whether and how to serve them. Without TSAI, the service provider has no common way to verify the operator, the agent's track record, or other evidence needed by its policy. A trust authority addresses this problem by evaluating the operator and agent and issuing a credential that the service provider can verify.

The relationships use different paths. The operator and trust authority establish a management relationship before issuance, while the service provider configures accepted issuers before requests arrive. The request path contains the agent presentation and the service provider decision.

User identity and delegation

The TSAI credential does not identify the user or establish delegated authority. TSAI leaves user identification to the application flow that requires it because including identity in every presentation would create cross-service surveillance and legal obligations even when the service provider has no need for that data. Account systems, OAuth, payment mandates, and application policy retain those responsibilities.

Credential and trust signals

The service provider needs a signed object that identifies the issuer and agent, carries the available evidence, and binds that evidence to an agent key. It also needs shared definitions for the signals, because a valid signature cannot resolve disagreement about meaning.

Credential structure

A TSAI credential is an SD-JWT VC. The issuer-signed JWT contains the persistent agent identity, selected binding key, lifetime, and trust signals. During presentation, the agent appends a key-binding JWT; selective disclosures, when used, appear between the two tokens.

Illustrative conforming credential payload

{
  "iss": "https://trust-authority.example",
  "vct": "https://tsaiprotocol.org/credential/tsai/1",
  "vct#integrity": "sha256-VWaSSviMOFcp1vsoU3ReObfIF8+sKBiEyfkL9npfZmA=",
  "iat": 1781863200,
  "exp": 1781865000,
  "sub": "https://acme.example/agents/shopper",
  "cnf": {
    "jwk": {
      "kty": "EC",
      "crv": "P-256",
      "x": "TCAER19Zvu3OHF4j4W4vfSVoHIP1ILilDls7vCeGemc",
      "y": "ZxjiWWbZMQGHVWKVQ4hbSIirsVfuecCE6t4jT9F2HZQ"
    }
  },
  "signals": [
    { "cat": "idn", "typ": "org", "val": "Acme Corporation GmbH" },
    { "cat": "idn", "typ": "jur", "val": "DE" },
    { "cat": "idn", "typ": "kyc", "val": "enhanced" },
    { "cat": "idn", "typ": "dct",
      "val": "acme.example", "asof": 1781860000 }
  ]
}

iss names the trust authority, while vct and vct#integrity select the exact credential definition. sub is the persistent agent identity, and cnf contains the holder-binding key. iat and exp define the credential lifetime. For time-sensitive signals, asof records when the trust authority established or last confirmed the fact.

Trust signals

Trust signals are structured statements about the agent and operator. Identity, reputation, compliance, and assurance address different risks, so service provider policy combines the evidence needed for the action.

Identity

Names the accountable operator and records its jurisdiction, verification depth, and controlled domain.

Reputation

Describes observed agent or operator behaviour together with the interaction count and observation period.

Compliance

Records third-party certifications held by the operator and attributes them to the certifier.

Assurance

Records economic backing or recourse, such as insurance or collateral.

A registered reputation score identifies its immutable methodology through mtd and mtd#integrity, because the score has meaning only within that methodology. Compliance and assurance signals name their provider through prv; this is attribution by the trust authority rather than a signature from the provider.

The absence of a signal carries no adverse meaning. Selective disclosure is off by default, and the agent identity, operator identity floor, and reputation remain non-disclosable.

Credential definitions

Each vct identifies an immutable definition comprising Type Metadata and an integrity-pinned JSON Schema. This ensures that issuers and verifiers interpret the same fields in the same way. Service providers obtain these documents before handling presentations and cache them by integrity value.

Domain-specific extensions use derived credential types that retain the canonical TSAI constraints. The detailed inheritance and schema rules are defined in the specification and machine-readable artefacts.

TSAI v1 uses ES256 signatures, P-256 keys, and SHA-256 protocol digests.