{
  "id": 4890163,
  "title": "Anatomía de un pipeline de verificación de 12 etapas para credenciales de agentes IA",
  "url": "https://urgent.news/2026/09/01/anatomia-de-un-pipeline-de-verificacion-de-12-etapas-para",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-01T16:06:14.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/edison_flores_6d2cd381b13/anatomia-de-un-pipeline-de-verificacion-de-12-etapas-para-credenciales-de-agentes-ia-2dcp"
  },
  "original_language": "es",
  "account": "Verifying the authenticity of credentials issued by AI agents involves a 12-step pipeline. Initially, the Universal Trust Adapter (UTA) thought verification would be as simple as checking a cryptographic signature, but it is far more complex. A credential may have a valid cryptographic signature yet still be expired, revoked, have incorrect scope, unknown issuer, lack proof-of-possession, or be missing provenance.\n\nThe 12-step pipeline separates the verification process as follows:\n1. Parser - Converts raw bytes into an internal format. Failure occurs if the bytes cannot be parsed.\n2. Detect - Identifies the credential format: JWT, W3C VC, ATC v3, or MCP Card. UTA supports 8 formats.\n3. Schema - Validates mandatory fields of the detected format. A JWT without an algorithm fails at this stage.\n4. Crypto - Verifies the cryptographic signature. If it doesn't match the issuer's public key, verification fails.\n5. Issuer - Resolves the issuer's identity. Is it a known CA, part of a trusted list, or unknown?\n6. Key Binding - Confirms that the signing key is linked to the declared issuer, preventing impersonation.\n7. Proof of Possession - Ensures the presenter of the credential actually possesses the corresponding private key, preventing credential theft.\n8. Provenance - Traces the credential's origin: direct from issuer, cached, or from a third party. This affects trust levels.\n9. Lifecycle - Checks validity. This includes not_before, expires_at, and revocation_status. An expired credential fails here.\n10. Evidence - Collects cryptographic evidence (logs, timestamps, receipts) to justify the decision. Useful for auditing.\n11. Policy - Applies system-specific policies, such as only allowing certain issuers or scopes that begin with read:.\n12. Decision - Combines the results of the previous 11 stages and issues a verdict: PERMIT, DENY, or UNDETERMINED.\n\nSeparating the verification steps allows for debugging, caching partial results, customizing policies without altering cryptography, and auditing stage decisions. The pipeline is implemented in TypeScript and published as @marketnow/trust-core. To use it:\n\n```typescript\nimport { verify, getStageResult } from '@marketnow/trust-core';\n\nconst result = await verify(card);\nconsole.log(result.decision); // PERMIT | DENY | UNDETERMINED\nconsole.log(result.failed_stage); // LIFECYCLE if it failed there\nconsole.log(getStageResult(CRYPTO)); // detailed cryptographic verification result\n```\n\nEach stage returns its individual result, allowing for detailed inspection. The pipeline can process up to 6,744 verifications per second on a single core, with crypto verification being the slowest (~0.08ms average for Ed25519) and parsing the fastest (~0.01ms). Verifying credentials as a single step leads to false positives or negatives. UTA implements the 12 steps, allowing users to choose which stages to activate. The source code is available at alicelabs-llc/universal-trust-adapter, and the API is documented at marketnow.site/api/trust.",
  "summary": "Por qué 12 etapas Cuando empecé a diseñar el Universal Trust Adapter (UTA) , pensé: \"verificar una credencial es verificar la firma criptográfica y punto.\" Error. Una credencial puede tener la firma criptográfica correcta y aún así ser: Expirada (firmada correctamente, pero hace 3 años) Revocada (firmada correctamente, pero el issuer la revocó) Mal scope (firmada correctamente, pero pide permisos…",
  "key_points": [
    "12-step pipeline separates verification process",
    "Parser converts raw bytes into internal format",
    "Detailed inspection possible through stage results"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}