Anatomía de un pipeline de verificación de 12 etapas para credenciales de agentes IA

Verifying the authenticity of credentials issued by AI agents involves a 12-step pipeline. Initially, the Universal Trust Adapter (UTA) thought verification would be as simple as checking a cryptographic signature, but it is far more complex. A credential may have a valid cryptographic signature yet still be expired, revoked, have incorrect scope, unknown issuer, lack proof-of-possession, or be missing provenance.

The 12-step pipeline separates the verification process as follows:

1. Parser - Converts raw bytes into an internal format. Failure occurs if the bytes cannot be parsed.

2. Detect - Identifies the credential format: JWT, W3C VC, ATC v3, or MCP Card. UTA supports 8 formats.

3. Schema - Validates mandatory fields of the detected format. A JWT without an algorithm fails at this stage.

4. Crypto - Verifies the cryptographic signature. If it doesn't match the issuer's public key, verification fails.

5. Issuer - Resolves the issuer's identity. Is it a known CA, part of a trusted list, or unknown?

6. Key Binding - Confirms that the signing key is linked to the declared issuer, preventing impersonation.

7. Proof of Possession - Ensures the presenter of the credential actually possesses the corresponding private key, preventing credential theft.

8. Provenance - Traces the credential's origin: direct from issuer, cached, or from a third party. This affects trust levels.

9. Lifecycle - Checks validity. This includes not_before, expires_at, and revocation_status. An expired credential fails here.

10. Evidence - Collects cryptographic evidence (logs, timestamps, receipts) to justify the decision. Useful for auditing.

11. Policy - Applies system-specific policies, such as only allowing certain issuers or scopes that begin with read:.

12. Decision - Combines the results of the previous 11 stages and issues a verdict: PERMIT, DENY, or UNDETERMINED.

Separating the verification steps allows for debugging, caching partial results, customizing policies without altering cryptography, and auditing stage decisions. The pipeline is implemented in TypeScript and published as @marketnow/trust-core. To use it:

```typescript

import { verify, getStageResult } from '@marketnow/trust-core';

const result = await verify(card);

console.log(result.decision); // PERMIT | DENY | UNDETERMINED

console.log(result.failed_stage); // LIFECYCLE if it failed there

console.log(getStageResult(CRYPTO)); // detailed cryptographic verification result

```

Each stage returns its individual result, allowing for detailed inspection. The pipeline can process up to 6,744 verifications per second on a single core, with crypto verification being the slowest (~0.08ms average for Ed25519) and parsing the fastest (~0.01ms). Verifying credentials as a single step leads to false positives or negatives.

UTA implements the 12 steps, allowing users to choose which stages to activate. The source code is available at alicelabs-llc/universal-trust-adapter, and the API is documented at marketnow.site/api/trust.