Supply Chain Integrity, Transparency, and Trust R. Raskar Internet-Draft MIT Media Lab Intended status: Informational 2 November 2026 Expires: 6 May 2027 SCITT Profile for Portable AI Agent Package Provenance draft-raskar-scitt-agent-provenance-00 Abstract Portable AI agent packages can contain executable or interpretable behavior, prompts, workflow graphs, tool schemas, dependencies, and declarations of execution requirements. Such packages may be authored, transformed, repackaged, scanned, approved, published, superseded, and withdrawn by different parties before they are executed by an independent runtime. This document describes a SCITT application profile for transparent provenance of portable AI agent packages. It maps the package lifecycle to the SCITT architecture, identifies an immutable package digest as the artifact binding point, and defines classes of supply- chain statements that can be made about a package without defining a new statement payload format. Examples include authorship, build and transformation, execution-profile conformance, security assessment, publication, approval, supersession, and withdrawal statements. This document does not define a portable-agent package format, agent execution protocol, runtime authorization model, or per-action execution receipt. It complements SCITT profiles that record agent actions or sessions by focusing on the provenance of the agent package before and across deployment. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." Raskar Expires 6 May 2027 [Page 1] Internet-Draft SCITT Agent Package Provenance November 2026 This Internet-Draft will expire on 6 May 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 1.1. Scope . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.2. Goals . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.3. Non-Goals . . . . . . . . . . . . . . . . . . . . . . . . 4 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 3. Portable Agent Package Supply Chain . . . . . . . . . . . . . 5 4. Mapping Portable Agent Packages to SCITT . . . . . . . . . . 5 4.1. Artifact . . . . . . . . . . . . . . . . . . . . . . . . 5 4.2. Issuers . . . . . . . . . . . . . . . . . . . . . . . . . 6 4.3. Transparency Service and Receipts . . . . . . . . . . . . 6 4.4. Relying Parties . . . . . . . . . . . . . . . . . . . . . 6 5. Artifact Identity and Digest Binding . . . . . . . . . . . . 6 6. Statement Classes . . . . . . . . . . . . . . . . . . . . . . 7 6.1. Authorship and Source Statement . . . . . . . . . . . . . 7 6.2. Build or Transformation Statement . . . . . . . . . . . . 7 6.3. Execution-Profile Conformance Statement . . . . . . . . . 7 6.4. Security Assessment Statement . . . . . . . . . . . . . . 7 6.5. Publication and Release Statement . . . . . . . . . . . . 7 6.6. Approval Statement . . . . . . . . . . . . . . . . . . . 8 6.7. Supersession, Withdrawal, and Revocation Statement . . . 8 7. Transformation and Provenance Chains . . . . . . . . . . . . 8 8. Example Lifecycle . . . . . . . . . . . . . . . . . . . . . . 9 9. Relying Party Processing . . . . . . . . . . . . . . . . . . 9 10. Relationship to Agent Execution Transparency . . . . . . . . 10 11. Relationship to Portable Agent Architecture . . . . . . . . . 11 12. Security Considerations . . . . . . . . . . . . . . . . . . . 11 13. Privacy Considerations . . . . . . . . . . . . . . . . . . . 12 14. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12 15. Normative References . . . . . . . . . . . . . . . . . . . . 12 16. Informative References . . . . . . . . . . . . . . . . . . . 12 Raskar Expires 6 May 2027 [Page 2] Internet-Draft SCITT Agent Package Provenance November 2026 Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 13 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 13 1. Introduction AI agents are increasingly distributed as artifacts that can be retrieved and interpreted by execution environments other than the system in which they were authored. A portable agent package can contain prompts, role instructions, workflow definitions, compiled components, tool schemas, policy references, model-interface requirements, and dependencies. The package can therefore influence consequential behavior even when the model, tools, and runtime are supplied separately by the receiving environment. The software-supply-chain questions around such an artifact are not limited to whether its bytes are signed. A relying party can need to determine who authored a package, which build or transformation produced a particular digest, whether an independent party assessed it, whether a specific organization approved it, whether the package has been superseded or withdrawn, and whether the statements presented by a distributor correspond to an auditable history. SCITT [RFC9943] provides an architecture for signed statements about artifacts, registration of those statements with a Transparency Service, and receipts that can be independently verified. This document applies that architecture to portable AI agent packages. 1.1. Scope This document defines a domain-specific mapping between portable AI agent package lifecycle events and SCITT concepts. It specifies the artifact binding requirements and statement classes needed for interoperable provenance reasoning, but it does not define a new payload schema. Statement payloads may use existing supply-chain formats or future formats suitable for the claim being made. 1.2. Goals * Bind claims to an immutable version of a portable agent package. * Allow multiple independent issuers to make accountable statements about the same package artifact. * Represent derivation and transformation relationships between package versions or repackaged artifacts. Raskar Expires 6 May 2027 [Page 3] Internet-Draft SCITT Agent Package Provenance November 2026 * Allow a runtime, enterprise administrator, auditor, or other relying party to verify the provenance history relevant to local policy before execution. * Reuse the SCITT architecture and COSE receipts rather than defining a separate transparency mechanism for agent packages. 1.3. Non-Goals This document does not define how an AI agent is authored, how an agent package is encoded, how an execution profile works, how a runtime grants access to models or tools, or how individual agent actions are recorded. It does not define a universal registry for agent packages and does not establish that a signed or transparent statement is true. It also does not define payload formats such as an agent SBOM, capability manifest, security-assessment report, or policy document. 2. Terminology The terminology of [RFC9943] applies. In particular, this document uses the terms Artifact, Issuer, Signed Statement, Transparency Service, Receipt, Transparent Statement, Auditor, and Relying Party as defined there. Portable Agent Package: A distributable artifact containing or referencing an AI agent definition together with metadata, resources, dependencies, or execution requirements needed by an independent runtime. Logical Package Identifier: A stable identifier that can refer to a package across versions. It is not sufficient, by itself, to identify immutable package content. Package Digest: A cryptographic digest over the immutable package representation or over a canonical manifest that commits to the package content. The digest is the primary Artifact binding used by this profile. Package Producer: An entity or toolchain that transforms an agent definition and related resources into a distributable Portable Agent Package. Package Transformation: An operation that produces a new package artifact from one or more prior artifacts, for example compilation, policy hardening, dependency vendoring, repackaging, or enterprise customization. Raskar Expires 6 May 2027 [Page 4] Internet-Draft SCITT Agent Package Provenance November 2026 Package Provenance Statement: A Signed Statement about a Portable Agent Package, its creation, transformation, assessment, publication, lifecycle state, or relationship to another artifact. 3. Portable Agent Package Supply Chain A Portable Agent Package can pass through several administrative domains before execution. The following is illustrative: Agent author | v Agent definition | v Package producer ---------> Package A (digest A) | | | +--> security assessment | +--> profile-conformance claim v Enterprise transformer ---> Package B (digest B) | +--> enterprise approval +--> publication statement | v Runtime The author, package producer, transformer, security assessor, publisher, enterprise approver, and runtime operator can all be different entities. A single signature on Package B cannot, by itself, express the full history or distinguish which entity is accountable for which claim. This profile treats Package A and Package B as distinct Artifacts because their digests differ. Statements can relate the artifacts by identifying the input digest and output digest of a transformation. 4. Mapping Portable Agent Packages to SCITT 4.1. Artifact The SCITT Artifact is a specific immutable Portable Agent Package, identified by a Package Digest. A statement about a mutable package name or distribution URL alone is insufficient for artifact-specific provenance because the content reachable at that name or URL can change. Raskar Expires 6 May 2027 [Page 5] Internet-Draft SCITT Agent Package Provenance November 2026 4.2. Issuers Different supply-chain actors can be Issuers for different statements. Examples include the agent author, package producer, source repository operator, security scanner, execution-profile test service, publisher, enterprise administrator, and package owner. A Relying Party decides which Issuers are authoritative for a particular statement class. 4.3. Transparency Service and Receipts A Signed Statement can be registered with a SCITT Transparency Service according to [RFC9943]. A Receipt as defined by [RFC9942] provides verifiable evidence that the statement was registered in the Transparency Service's Verifiable Data Structure. 4.4. Relying Parties Typical Relying Parties include a runtime deciding whether to admit a package, an enterprise policy engine, a package marketplace, a security auditor, or an operator investigating a deployed package. The Relying Party determines which Issuers, Transparency Services, statement classes, and freshness requirements satisfy local policy. 5. Artifact Identity and Digest Binding A Package Provenance Statement in this profile needs to identify the exact package content to which the statement applies. The statement therefore needs an artifact identifier that includes or unambiguously resolves to a cryptographic Package Digest. A Logical Package Identifier can additionally identify a product line or package family, but a statement that affects execution policy should not rely on a mutable name without also binding the immutable package content. This distinction permits a package to have multiple releases while keeping claims about each release independently verifiable. Where a package is represented by a manifest plus referenced members, the package format or an adjacent specification needs to define what the Package Digest commits to. This profile does not define package canonicalization or archive hashing rules. Raskar Expires 6 May 2027 [Page 6] Internet-Draft SCITT Agent Package Provenance November 2026 6. Statement Classes This section defines semantic classes of statements useful for agent package provenance. It does not define a payload encoding for them. Each statement needs to bind the relevant package digest and identify the Issuer according to SCITT requirements. 6.1. Authorship and Source Statement An Issuer can state that a particular package or package input was authored from a particular source revision, source repository state, or agent definition. This can help connect a distributed package to its claimed origin. 6.2. Build or Transformation Statement A package producer or transformer can state that an output package digest was produced from one or more input digests using a named build or transformation process. Examples include compilation, conversion from a framework-specific graph to a portable execution profile, dependency vendoring, policy hardening, or enterprise repackaging. 6.3. Execution-Profile Conformance Statement A conformance service can state that a specific package digest was tested against a named execution profile and report the result. The claim establishes what the Issuer tested and asserted; it does not guarantee identical behavior across different models or runtimes. 6.4. Security Assessment Statement A scanner, evaluator, or red-team service can state that a package digest was evaluated using an identified procedure and can reference the resulting report. SCITT provides transparency and accountability for the statement; it does not establish that the assessment is complete or correct. 6.5. Publication and Release Statement A publisher or package owner can state that a specific package digest is an official release, is available from one or more distribution endpoints, or is the current release associated with a Logical Package Identifier. Raskar Expires 6 May 2027 [Page 7] Internet-Draft SCITT Agent Package Provenance November 2026 6.6. Approval Statement An enterprise, marketplace, administrator, or other policy authority can state that a package digest is approved for a defined scope. The approval can reference policy, environment, validity interval, or deployment class without granting runtime capabilities by itself. 6.7. Supersession, Withdrawal, and Revocation Statement An authorized Issuer can state that a package digest has been superseded by another digest, withdrawn from distribution, or is no longer approved for a stated purpose. A Relying Party needs local policy for deciding how these lifecycle statements affect previously issued approvals and cached artifacts. 7. Transformation and Provenance Chains Portable agent packages are frequently transformed. A framework can compile an agent definition into a portable profile; an enterprise can replace a dependency or restrict capabilities; a distributor can repackage the result for another platform. Each transformation can create a new artifact digest. A useful provenance graph therefore consists of statements that bind input artifact digests to output artifact digests. The graph can be traversed by a Relying Party to answer questions such as: * Which source or prior package produced this artifact? * Which entity performed each transformation? * Which assessments apply to the exact artifact being executed? * Was an approved artifact later modified or repackaged? * Has a later statement superseded or withdrawn an earlier release? SCITT transparency makes the statements auditable; it does not define the semantics of every transformation or prove that an Issuer described a transformation truthfully. Raskar Expires 6 May 2027 [Page 8] Internet-Draft SCITT Agent Package Provenance November 2026 8. Example Lifecycle Consider an agent definition created by an authoring framework. A package producer creates Package A and publishes a build statement that relates the source revision to digest A. An independent evaluator issues a security-assessment statement for digest A. An enterprise then applies a policy transformation that removes one dependency and constrains the tool set, producing Package B with digest B. The enterprise issues a transformation statement relating digest A to digest B and an approval statement for digest B. Before execution, a runtime computing digest B can verify the enterprise approval, inspect its SCITT Receipt, verify the transformation statement, and optionally trace the history back to digest A and the author statement. If the package bytes are changed after approval, the digest changes and the prior approval no longer binds the new artifact. Source revision | | authorship/build statement v Package A, digest A ---- security assessment | | transformation statement v Package B, digest B ---- enterprise approval | | SCITT receipts for relevant statements v Relying runtime verifies policy before admission 9. Relying Party Processing A Relying Party applying this profile can perform the following conceptual steps. Exact APIs for discovering and retrieving statements are outside this document. 1. Compute or otherwise securely obtain the Package Digest for the candidate artifact. 2. Obtain the Package Provenance Statements relevant to local policy. 3. Verify each Signed Statement according to [RFC9943] and the applicable Issuer identity policy. Raskar Expires 6 May 2027 [Page 9] Internet-Draft SCITT Agent Package Provenance November 2026 4. Where transparency is required, verify the associated Receipt according to [RFC9942]. 5. Check that each statement binds the exact Package Digest or an explicitly related artifact in a verified transformation chain. 6. Evaluate freshness, supersession, withdrawal, and Issuer authority according to local policy. 7. Use the resulting provenance information as one input to the local admission or audit decision. Successful verification does not itself authorize execution or grant access to models, tools, credentials, data, storage, or network resources. 10. Relationship to Agent Execution Transparency This profile concerns the software-supply-chain history of an agent package. It is intentionally distinct from records of what an agent did after execution began. [I-D.scitt-agent-execution] describes a SCITT profile for tamper- evident records of material AI-agent actions. [I-D.scitt-agent-session] describes causal provenance receipts for agent-session lifecycle events. Those documents focus on post- admission execution evidence. This profile focuses on the package artifact that a runtime is considering before or across deployment. Package supply chain Runtime activity -------------------- ---------------- author session start build / transform tool dispatch scan / assess state transition approve / publish external action supersede / withdraw session termination | | +-- this profile +-- execution/session profiles A deployment can use both layers. For example, an execution receipt can identify the exact Package Digest whose pre-execution provenance was established using this profile. Raskar Expires 6 May 2027 [Page 10] Internet-Draft SCITT Agent Package Provenance November 2026 11. Relationship to Portable Agent Architecture A portable-agent architecture separates the package supplied by an author or package producer from the models, tools, storage, network access, and other capabilities supplied by a runtime. The package can declare requirements, but those declarations do not confer authority. This SCITT profile addresses a different question: what verifiable provenance statements are available about the package artifact before a runtime evaluates compatibility and authorization? The package format, execution profile, and runtime authorization model remain outside this document. The SCITT Artifact identifier is therefore based on immutable package content rather than on a specific authoring framework or runtime. 12. Security Considerations The security considerations of [RFC9943] and [RFC9942] apply. A valid Signed Statement proves that the statement was signed by a corresponding Issuer identity; it does not prove the statement is true. A malicious or compromised Issuer can make false claims. Relying Parties need policy for which Issuers are authoritative for each statement class. Artifact substitution is a central threat. Approval or assessment statements that bind only a package name, URL, or mutable tag can be replayed against different content. Security-relevant statements should bind the immutable Package Digest. Incomplete provenance is another risk. A distributor can omit an unfavorable assessment or withdrawal statement while presenting valid positive statements. Transparency Services improve auditability and can expose history, but Relying Parties still need a method or policy for determining which classes of statements are expected and whether the observed history is sufficiently complete for the decision being made. Key compromise can affect author, builder, assessor, publisher, or approval identities. Relying Parties need to evaluate key lifecycle and revocation information according to the identity mechanism used by each Issuer. A later withdrawal statement does not erase a previously valid transparent statement; policy determines its continuing effect. Raskar Expires 6 May 2027 [Page 11] Internet-Draft SCITT Agent Package Provenance November 2026 Provenance information can also reveal sensitive development relationships, internal toolchains, package names, or security findings. Deployments should minimize statement content and consider whether the relevant Transparency Service is public, permissioned, or otherwise access controlled. 13. Privacy Considerations Portable agent packages can contain prompts, policy references, internal service names, or other sensitive metadata. This profile does not require such package content to be included in a Signed Statement. Statements should normally identify artifacts by digest and disclose only the claim data required by the relying application. Registration and query activity can reveal interest in a package or relationships among authors, enterprises, and deployment environments. The privacy considerations for the chosen SCITT Transparency Service and adjacent statement-discovery mechanisms therefore apply. 14. IANA Considerations This document has no IANA actions. It does not define a new SCITT media type, COSE header parameter, statement payload format, or package media type. 15. Normative References [RFC9943] Birkholz, H., Delignat-Lavaud, A., Fournet, C., Deshpande, Y., and S. Lasker, "An Architecture for Trustworthy and Transparent Digital Supply Chains", RFC 9943, June 2026, . [RFC9942] Steele, O., Birkholz, H., Delignat-Lavaud, A., and C. Fournet, "CBOR Object Signing and Encryption (COSE) Receipts", RFC 9942, June 2026, . 16. Informative References [RFC9052] Schaad, J., "CBOR Object Signing and Encryption (COSE): Structures and Process", RFC 9052, August 2022, . Raskar Expires 6 May 2027 [Page 12] Internet-Draft SCITT Agent Package Provenance November 2026 [I-D.scitt-agent-execution] Emirdag, P. and D. Feichtinger, "AI Agent Execution Profile of SCITT", Work in Progress, Internet-Draft, draft-emirdag-scitt-ai-agent-execution-01, October 2026, . [I-D.scitt-agent-session] Bailey, L., "Causal Provenance Receipts for Agent Sessions: A SCITT Profile", Work in Progress, Internet- Draft, draft-bailey-scitt-agent-session-receipt-00, October 2026, . Acknowledgements This document builds on the SCITT architecture and on prior work on portable AI agent packaging, runtime independence, and software supply chain provenance. Feedback from the SCITT community is invited. Author's Address Ramesh Raskar MIT Media Lab Email: raskar@mit.edu Raskar Expires 6 May 2027 [Page 13]