OEURO is a EUR-denominated clearing token designed for direct account-to-account settlement.It is implemented as a restricted ERC-20 token with 6 decimals and a deliberately narrow functional scope.Its primary purpose is clearing and settlement, rather than market trading or speculative use.Ordinary transfers are designed for direct EOA-to-EOA circulation.The reference implementation disables approve() and transferFrom().Ordinary transfers to smart-contract recipients are rejected. Minting and burning are explicit operations controlled by the manager.Authorized oracles may submit MINT or BURN requests but cannot directly alter token supply.Oracle requests remain valid for 24 hours and must be executed or rejected by the manager.External clearing references are protected against replay through single-use proof handling.The architecture therefore separates attestation authority from final settlement authority.OEURO uses a restricted recipient model for sensitive infrastructure addresses.The reference contract uses OpenZeppelin ERC-20 and Ownable2Step components.Ethereum Sepolia is used as the current public reference testnet environment.This Zenodo archive contains the Solidity source code, ABI, flattened contract and the OEURO technical white paper and audit reference.
PRE-GHR XXXIX v5.0 (2026-08-28) — release version closing all six objections of an adversarial pre-submission review. PRE-GHR XXXVIII gave the series its first formal definition of the irreducible governance residue δ0μ(P) := inf over admissible P' of ||residue(P')|| and proved a bit-level lower bound. This paper builds the property theory. The mathematics is a domain-order theory: every inequality follows from how the admissible domain D(P) behaves under enlargement or composition of protocols. We prove monotonicity of δ0μ in the erasure surface, an exact composition law δ0μ(P1 ∘ P2) = δ0μ(P1) + δ0μ(P2) − |T(P1) ∩ T(P2)| under explicit hypotheses (segment autonomy, joint attainability, cross-segment cleanliness), and positivity δ0μ(P) > 0 whenever T(P) is non-empty as a purely normative fact, with Landauer's principle confined to the physical interpretation. We then ask what a running system's audit ledgers can measure. The answer is stratified: the ordering structure is measurable in principle — conditional on a fixed normalization and full retention — while the absolute value is stated relative to a fixed code-point measure, and the aggregate-to-single-protocol bridge remains open. No interception statistic is claimed to equal δ0μ; where the wall cannot be built, the gap is marked, not papered over. Changes in v5.0 (six revision tickets, R01–R06, each closing one reviewer objection): R01 — Theorem 4 unilateralized: the safe direction (T(P) non-empty ⇒ δ0μ > 0) remains a theorem; the converse is demoted to Observation 4.1 under an explicit complete-erasure assumption. A witness-reading remark records that δ0μ is a minimum witness cardinality in the sense of why-provenance, inherited and not claimed as new. R02 — ledger counts restricted to lower witnesses only: the ordering claim is measurable solely under a fixed normalization and full retention, stated as an explicit condition rather than an implicit assumption. R03 — the uniform-sampling remark now carries an explicit finite-sample bound (Hoeffding's inequality in its standard form), two-sided: “holds in expectation” is no longer used as if it held for a sample. R04 — four empirical mappings corrected: schema-field disjointness is separated from retained-trace intersection; the approximate join reports both false-negative and false-positive error (the earlier “directionally safe, never over-counting” claim is withdrawn); the overlap-error direction is declared two-sided and governed by an error budget rather than assumed away; and the retention ratio is restated as an interception-event ratio in matched units. R05 — measure-relative notation throughout: bits and code points are two measures on one trace universe, so every ordering claim is stated at a fixed μ and changing μ defines a new quantity rather than restating the old one. R06 — subject classification reassessed and Related Work rebuilt. The paper contains no multiagent model and no coordinated-interaction result; the earlier cs.MA classification is withdrawn as unsupported by the technical content, and the classification adopted here is cs.CR primary with cs.DB cross-list. Related Work now separates the lineage the paper inherits from — linked timestamping and distributed witnesses (Haber & Stornetta 1991; Bayer, Haber & Stornetta 1993), split-view detection and the undefined gossip layer (Certificate Transparency, RFC 6962 / RFC 9162), existence-not-authenticity timestamping (OpenTimestamps), provenance and lineage (W3C PROV; Buneman, Khanna & Tan 2001; Cui, Widom & Wiener 2000), record linkage (Fellegi & Sunter 1969), trace semantics (Hoare 1978; Brookes, Hoare & Roscoe 1984), and measure and order (Halmos; Davey & Priestley) — from adjacent recent lines cited for comparison only. Where a construction of this paper rediscovers an existing one, priority is assigned to the source and no originality is claimed. Honesty notes. Citations to Hoeffding, Fellegi & Sunter, Halmos, Davey & Priestley and the CSP literature are made at the level of the standard statement of each framework only, pending full-text verification. Two candidate references were deliberately excluded because their primary sources could not be verified. Two gaps are inherited rather than closed: the hash-chain anchor has no consistency-proof comparison mechanism, and the anchor-propagation (gossip) layer is undefined in the source standard as well. Open questions Q5.1, Q5.3 and Q5.4 remain declared open.
Distributed consensus algorithms are fundamental to many modern systems, including blockchain networks, sensor networks, and cloud computing platforms. However, ensuring the correctness of these algorithms in the face of network failures, message delays, and other unpredictable events is a significant challenge. This paper proposes a novel approach to formally verify distributed consensus algorithms using temporal logic and model checking. We define the desired properties of the algorithm using temporal logic formulas, which express requirements such as safety (agreement) and liveness (eventual agreement). Subsequently, we employ model checking techniques to systematically explore the state space of the algorithm and determine whether it satisfies these temporal logic properties under various network conditions. The core idea is to provide a rigorous method for guaranteeing algorithm correctness and robustness, moving beyond traditional testing methods that often rely on exhaustive testing or probabilistic guarantees. The approach offers a quantifiable assurance level, crucial for deploying these algorithms in critical applications.
Decentralized networks, such as blockchain and peer-to-peer systems, rely on trust propagation mechanisms to maintain integrity and security. However, these mechanisms are often complex and prone to errors. This paper presents a novel approach to formally verify the correctness of trust propagation in these networks using temporal reachability analysis. We model the trust propagation process as a temporal system and employ model checking techniques to rigorously assess the system's behavior. The key contribution lies in providing a mathematical framework for guaranteeing that trust is propagated accurately and efficiently, addressing a critical gap in the current landscape of decentralized network security. This approach enables developers to confidently implement trust propagation algorithms, reducing the risk of vulnerabilities and enhancing network resilience. The paper details the methodology, provides a formal specification of the trust propagation process, and illustrates its application with a concrete example.
This paper proposes a novel decentralized blockchain verification system utilizing distributed Bayesian Networks (BNs). Traditional blockchain verification relies heavily on cryptographic proofs, which can be computationally intensive and susceptible to specialized attacks. Our approach offers a probabilistic and decentralized alternative. Each node maintains a Bayesian Network representing the blockchain's transaction graph, continuously updated with observed transactions. Consensus is achieved through iterative Bayesian inference and probabilistic agreement on the validity of new transactions. This system mitigates single points of failure, enhances security through probabilistic reasoning, and provides a more scalable verification process compared to traditional methods. The core claim is that a decentralized blockchain verification system can be built by leveraging distributed Bayesian Networks to model and verify transaction dependencies. The core mechanism involves continuous BN updates and consensus through iterative inference. This paper outlines the system architecture, the probabilistic inference process, and discusses potential applications and future research directions.
Trust is a fundamental element underpinning the successful operation of blockchain networks, yet it is frequently treated as an inherent characteristic rather than a subject of explicit investigation. This paper presents a novel formal model of trust within blockchain networks, leveraging game theory and network topology to provide a rigorous analytical framework. The model, denoted as (N, E, V, T), describes a network of nodes (N) connected by edges (E), each node possessing a valuation (V) and a trust threshold (T). Trust is modeled as a dynamic process influenced by node interactions, reputation, and network structure. The core contribution lies in defining the trust propagation mechanism, which can be expressed as: *Trust(i, j) = Trust(i, j) + α * (r(i, j) - T(i))* where: * *Trust(i, j)* represents the trust level between node *i* and node *j*. * *Trust(i, j)* represents the current trust level between node *i* and node *j*. * *α* is a trust propagation coefficient (0 ≤ *α* ≤ 1). * *r(i, j)* is the reputation score of node *j* as perceived by node *i*. * *T(i)* is the trust threshold of node *i*. This equation illustrates that trust between two nodes is influenced by the difference between the node's perceived reputation of the other node and its own trust threshold. The model allows for the simulation of various blockchain scenarios, including Byzantine fault tolerance, Sybil attacks, and collusion, providing valuable insights for designing robust and trustworthy blockchain systems. Furthermore, the model facilitates the exploration of trust-enhancing mechanisms, such as reputation systems, staking mechanisms, and consensus algorithms, by quantifying their impact on trust dynamics. The research contributes to a deeper understanding of the complexities of trust in distributed ledger technologies and offers a practical tool for improving their security and efficiency. ---
Short Summary - Current Internet protocols move, encrypt, authenticate, delegate, and record data—but they never answer one question: was this specific machine-generated act authorised to become real? This article proposes an execution-finality layer between computation and consequence for AI, cloud, telecom, payments, and critical infrastructure. The internet solved transport, secrecy, identity, delegation, and record-keeping. TCP/IP moves the data. TLS and HTTPS protect the channel and authenticate the endpoint. OAuth delegates access. EMV validates the payment credential. Distributed ledgers order and record the event. Every one of these remains essential. None of them answers the question that now matters most: Was the specific act represented by this data authorised to become externally effective? A packet can be delivered perfectly. A channel can be encrypted flawlessly. An endpoint can be genuine. A token can be valid. A cryptogram can verify. A transaction can be recorded. And still — none of that proves that an AI-generated command, a data export, a telecom transmission, a payment, an infrastructure change, a satellite instruction, a database write, or a physical actuation was ever authorised to cross from computation into consequence. WE BUILT OUR SAFEGUARDS FOR HUMAN TIME. MACHINES NO LONGER RUN ON IT. Earlier digital systems lived inside human reaction time. A suspicious payment could be reviewed. A wrongful disclosure could be investigated. Access could be revoked. A harmful output could be pulled down. AI-native infrastructure does not grant that luxury. A modern AI system can call tools, invoke APIs, export files, initiate payments, rewrite databases, reconfigure networks, drive machines, issue telecom commands, and trigger downstream workflows in milliseconds. By the time a log is read, the data has left the jurisdiction. The payment has settled. The command has executed. The infrastructure state has already changed. So the real problem is no longer detection. The real problem is this: Can the system stop the act from becoming effective before validation is complete? Post-event logging is evidence. Evidence is not prevention. THE LAYER THAT WAS NEVER BUILT The disclosed architecture introduces an execution-finality layer between computation and consequence. It replaces nothing. TCP/IP, TLS, HTTPS, OAuth, EMV, identity systems, policy engines, and ledgers all continue to do exactly what they do today. It adds the one technical condition none of them supply: A computational result does not become externally effective merely because a machine generated, signed, routed, or prepared it. An AI model, telecom function, cloud workload, payment system, satellite controller, application, or autonomous device may generate a proposed operation. The architecture treats that operation as a Candidate Act, held in a non-effective state. A Candidate Act may be an AI output, packet, tensor, API call, payment instruction, file export, storage write, model-memory update, telecom transmission, rendering event, actuator command, or any other consequential operation. Before that act can become real, a protected hardware or cryptographically isolated domain validates the required conditions — which may include authority, purpose, consent, jurisdiction, destination, revocation status, policy epoch, runtime integrity, freshness, quota, protected state, and the identity of the intended effectuation boundary. Only on success is protected evidence committed and a narrowly scoped, non-bearer capability released — bound to that particular act, scope, protected state, evidence, destination, and applicable Finality Sink. THE FINALITY SINK: WHERE COMPUTATION BECOMES CONSEQUENCE The Finality Sink is the precise point at which an act would first become externally effective — a model-output emitter, API dispatcher, telecom gateway, radio chain, SmartNIC, DPU, payment terminal, ledger bridge, memory controller, storage writer, renderer, satellite-command interface, or physical actuator. The Finality Sink verifies the capability before permitting release. Verification fails → the act remains non-effective. Verification succeeds → the capability is consumed before or atomically with effectuation, reducing replay, substitution, duplicate execution, and cross-sink misuse. WHY THIS IS NOT "BETTER SECURITY" Conventional systems place checks around an execution path. The application, model server, network function, or payment system typically retains the technical ability to complete the act anyway. This architecture removes that ability. The ordinary compute environment may calculate or prepare the act — but it does not independently hold the final authority to make the act effective. Authority is separated from computation, and verified again at the consequence boundary. Stated in one line each: Layer Question it answers TCP/IP How is information transported? TLS / HTTPS Is the channel protected? OAuth Who may delegate access? EMV Is the payment credential valid? Ledgers What happened, and in what order? Execution Finality May this specific act become real? The contribution is not another policy engine, authentication scheme, audit system, or cryptographic token. It is a structural dependency: protected validation becomes a technical precondition of effectuation. ONE GAP. EVERY INDUSTRY. The computation-to-consequence gap is not an AI problem. It is an infrastructure problem that appears wherever machines act faster than institutions can respond. Artificial intelligence — model outputs, tool calls, agent actions, code execution, data exports, memory writes, retrieval operations, autonomous workflows. Telecommunications and 5G/6G — packet forwarding, network slicing, roaming, radio emission, gateway egress, satellite communications, non-terrestrial networks, machine-to-machine commands. Cloud and data-centre infrastructure — CPUs, GPUs, AI accelerators, memory controllers, DMA engines, SmartNICs, DPUs, storage controllers, accelerator-interconnect boundaries. Financial systems — payment finality, account transfers, settlement, digital assets, CBDCs, ledger commitments, trading instructions. And beyond — data sovereignty, cross-border data use, industrial control, robotics, vehicles, healthcare infrastructure, energy systems, digital twins, content publication, cybersecurity response, critical infrastructure. Critically, the architecture supports jurisdictional and enterprise control without blanket data localisation and without duplicating national infrastructure. Computation may remain distributed and interoperable; only the authority to produce an external consequence stays protected. 8,598 PAGES. YOU ONLY NEED THREE STEPS. Readers are not expected to work through the specification sequentially. 1. Start with the short invention summary.It covers the Candidate Act, non-effective state, Protected Enforcement Domain, validation evidence, scoped capability, Finality Sink, the difference from conventional systems, the novelty position, and industrial applicability. 2. Download the navigation file.It explains the common inventive concept and routes you to the industry-specific embodiments relevant to AI, telecom, satellites, payments, cloud infrastructure, or cybersecurity. The industry mapping sits at approximately pages 57–61 of the main disclosure. 3. Download the main specification — and go straight to your embodiment.The length reflects the number of implementation environments, effectuation boundaries, hardware arrangements, failure states, and anti-bypass variants. It is not one example repeated 8,598 times. THE ONE SENTENCE THAT HOLDS THROUGHOUT A machine may compute, prepare, or propose an act — but computation alone does not create the authority to make that act externally effective
Decentralized Autonomous Organizations (DAO) are an emerging blockchain-based paradigm for decentralized governance. Despite growing interest, their conceptualization remains fragmented. This paper introduces DAO-Ontology, a domain ontology formalizing DAO concepts-including perspectives, characteristics , solutions, evaluation methods, application domains, and challenges. Developed via the OntoView methodology from a systematic mapping of 47 studies, it is implemented in OWL and validated with a Java application using the OWL API. The ontology provides a standardized vocabulary, supports semantic integration, and enhances understanding of DAO as sociotechnical systems.
Secure financial transactions require more than just an immutable record — they also demand privacy-preserving identity assurance (which enables secure, trusted and transparent communication), adaptive fraud intelligence (to detect fraudulent transactions), policy-aware execution (so organizations can set their own rules for data use), resilient consensus (enables multiple parties to agree on data use), and auditable records within a single low-latency pipeline. Current permissioned-blockchain solutions often have independent optimizations for authentication, access control, fraud detection, consensus and auditing; as such, these separate areas lead to fragmented security decision making, unnecessary disclosure, static endorsement policies and throughput–latency tradeoffs. The research presented here describes FinTrust-X, a cross-layer risk-adaptive permissioned blockchain architecture where the security state created by each layer is used to create the next. A Zero-Knowledge Context Adaptive Role and Trust Authentication System (ZK-CARTA) provides zero knowledge context adaptive role and trust authentication to enable verifiable credentials to be selectively disclosed based on user device/session context and dynamically authorize users to minimize identity exposure and privilege abuse. Users are provided authenticated evidence to feed a Temporal Graph Transformer (TRiG-FraudFormer) that models joint transactional, account, device, merchant, beneficiary and trust relationships to produce a calibrated fraud-risk assessment along with counter-factual explanations. Risk is converted into adaptive smart contract paths, confidence levels and endorsement requirements to minimize unnecessary verification overheads. Safety constrained reinforcement learning is applied in RA-BFTune to adaptively optimize batching, ordering and Byzantine fault tolerant consensus based on transaction risk and network-states. Continuous cryptographic audit evidence is produced in PQ-AuditTwin utilizing immutable provenance, Merkle verification and ML-DSA-based post-quantum signature generations. Feedback regarding changes/drift in previous layer inputs is returned to those layers. Targeted validation results show ROC-AUC values of .96-.98 and F1 values of .92-.95 were achieved in addition to achieving authentication times less than 30ms., 1500-2000 TPS, P95 response time < 700ms, and greater than a 90% reduction in unnecessary disclosure of sensitive data from users indicating significant improvements in confidentiality, fraud-resilience, authorization-efficiency, scalability and auditability when compared against multi-organization Fabric workloads that included injected fraud and Byzantine faults.
C. O. Enuma, Matthias D., V.I.E. Anireh, Bennett E.O.
Abstract Cloud computing has become the preferred platform for deploying blockchain-enabled smart contracts because of its scalability and flexibility. However, existing access control mechanisms such as Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and conventional blockchain authentication expose sensitive user information during authentication, rely on static authorization policies, and lack intelligent mechanisms for detecting evolving cyber threats. This study proposes an Intelligent Privacy-Preserving Access Control Framework for Cloud-Based Smart Contracts that integrates Modified Groth16 Zero-Knowledge Proofs (ZKP), Secure Multi-Party Computation (SMPC), Trusted Execution Environments (TEE), Federated Learning, Differential Privacy, GraphSAGE Graph Neural Networks, Autoencoder-based anomaly detection, Proximal Policy Optimization (PPO), and Blockchain Smart Contracts. The framework enables credential-free authentication, confidential collaborative computation, adaptive authorization, intelligent threat detection, and immutable blockchain auditing without compromising user privacy. The proposed framework was implemented and evaluated using the CICIDS2017 cybersecurity dataset. Experimental results achieved 96.4% privacy preservation, 94.1% security strength, 99.0% execution integrity, 98.7% auditability, 90.3% scalability, 88.6% computational performance, 86.9% cost efficiency, 98.91% validation accuracy, 99.62% ROC-AUC, 94.90% Macro F1-Score, and an overall system fitness of 94.23%. Comparative evaluation against Hawk, Zether, Ekiden, and a Federated Learning-only IDS demonstrated superior performance across all evaluation metrics. The proposed framework therefore provides an intelligent, scalable, and privacy-preserving access control solution suitable for next-generation cloud-based smart contract systems. Keywords: Privacy-Preserving Access Control; Smart Contracts; Cloud Computing; Zero-Knowledge Proof; Secure Multi-Party Computation; Trusted Execution Environment; Federated Learning; Blockchain.
PhiGraph Core 4.1.0-rc.6 is a model-agnostic governance system for software-agent and AI operations. This v2 draft extends the Zenodo v1 paper with a scoped transactional ledger (declared write locks, fail-closed verify_scoped_chain on JSON/SQLite), GRDI 0.4.0 shadow decision chain (envelope through replay audit, no external execution), and updated evaluation (319 automated tests at main@a5a7187). It retains the typed protocol, policy-gated runtime, HAV v0.2 fail-closed verification, and the bounded CIC-IDS2017 experiment with explicit limitations. Paper source is licensed CC BY 4.0. PhiGraph software is distributed separately under the repository software license. Git pin for this draft: a5a7187.
IoT sensor deployments increasingly export measurement streams to edge gateways and content-addressed storage such as IPFS, but access control decisions must be enforced without disclosing sensor owner policies, requester attributes, or stale data versions. Existing blockchain, CP-ABE, and zero-knowledge approaches reduce parts of this leakage, yet they can still expose public policy structure, accept stale Merkle proofs after sensor stream updates, overload provers when policies grow, or leave IPFS gateways vulnerable to bandwidth abuse. This paper proposes zk-Guard-R, a policy-hidden and replay-safe zk-SNARK access control framework for privacy-preserving IoT sensor data sharing. zk-Guard-R replaces public sparse policy matrices with MiMC-Merkle policy commitments verified inside the proof, separates long-lived logical sensor policy roots from frequently updated physical IPFS data roots, binds every proof to an on-chain nonce, and decouples attribute possession from policy interpretation through a bounded stack-based policy interpreter. Numeric sensor-access predicates are represented through committed values and range check gadgets, while an off-chain verification gateway couples accepted proofs with payment channel vouchers before releasing encrypted IPFS chunks. The design contribution is separated from the measured prototype: the full protocol specifies a bounded policy interpreter, whereas the present gnark prototype evaluates the core committed policy, committed attribute, range check, data root, nonce, Solidity verifier, and gateway-metering mechanisms. We implement a gnark BN254/Groth16 research prototype and benchmark it against a matrix-public zk-Guard prototype, a blockchain ABAC baseline, an IoT token/HMAC baseline, and a CP-ABE-style cryptographic-work proxy. For 128 attributes, the zk-Guard-R prototype with MiMC-Merkle commitments uses 425,574 R1CS constraints, generates proofs in 3.12 s, verifies in 0.73 ms, and uses 641 MB peak Go heap allocation. A three-run repeat of the 128-attribute configuration gives a proof-generation mean of 2.80 s with a 0.54 s standard deviation on the same local host, illustrating the runtime variability of prover measurements. We also deploy the generated Solidity verifier on a local Anvil EVM and measure 241,942 gas for a successful verification transaction, and we evaluate a local Kubo/IPFS gateway under valid, replayed, and voucher-limited flood requests. The results show that zk-Guard-R shifts substantial but measurable work to the prover while improving policy confidentiality, freshness, and gateway metering for IPFS-backed IoT sensor data sharing.
Abstract—As Autonomous AI Agents transition from conversational prototypes to enterprise-grade execution agents, currentsecurity architectures face a fundamental breakdown. Enterprise deployment demands unequivocal answers to six core trust questions: Principal (who does the agent represent?), Authorization (what is it allowed to do?), Tool/Action Bound (which API calls are safe?), Policy Gate (how are high-risk actions controlled?), Audit Log (how are actions traced immutably?), and Expiry/Revocation (how is authorization revoked instantly?). Existing enterprise solutions address at best one or two boundaries: IAM frameworks resolve identity but fail at granular tool execution; prompt guardrails handle basic content filtering but lack real-time authorization or cryptographic auditability; SIEM platforms store logs post-hoc without real-time interception capabilities. This paper introduces DROS-6P, a unified, deterministic runtime governance kernel designed to enforce all six fundamental trust boundaries within a single C-ABI and eBPF in-band execution layer. To prevent the security control plane from becoming a throughput bottleneck or a single point of failure under high-frequency system calls (Syscalls) generated by enterprise, third-party, or malicious agents—thereby mitigating self-induced Denial-of-Service (DDoS) degradation—runtime governance requires microsecondlevel evaluation capability. Empirical benchmark evaluations demonstrate that the DROS-6P in-band kernel achieves an average decision latency of approximately 26.1 μs. Specifically, DROS-6P enforces: (1) Principal via 3-tier PKI-signed DROS Identity Tokens (DIT); (2) Authorization via Capability Bitmaps mapping roles to deterministic execution vectors; (3) Tool/Action Bound via in-band C-ABI interceptors at the FFI boundary; (4) Policy Gate via dynamic data redaction, Human-In-The-Loop (HITL) suspension, and ZKP-Lite zero-knowledge proofs; (5) Audit Log via tamper-evident SHA-256 Merkle Hash Chains and Ed25519 signatures; and (6) Expiry/Revocation via O(1) Read-Copy-Update (RCU) atomic pointer swaps providing instant HTTP 403 enforcement. We validate DROS-6P across six heterogeneous domain tracks (Carbon DPP, Fintech AML, HIPAA Healthcare, Government Proxy Services, Inclusive Migrant Finance, and RBA Supply Chain Compliance), providing a fully reproducible testbed with 100% automated test assertions passed (0.004s), demonstrating that unified physical-layer governance is necessary and sufficient for safe enterprise AI agent deployment.Abstract—隨著自主AI Agent(自主智能體)從對話式原型走向企業級執行場景,傳統資安架構正面臨根本性的崩潰。企業部署AI Agent 時,必須對六大核心信任問題給出明確答案:Principal(Agent 代表誰?)、Authorization(被授權做什麼?)、Tool/Action Bound(哪些API 呼叫安全?)、Policy Gate(高風險動作如何控制?)、Audit Log(行動如何不可篡改地追溯?)以及Expiry/Revocation(授權何時失效且如何即時停止?)。然而,現有的企業安全處方最多只能回應一至兩個邊界:IAM 系統解決了身份認證,卻對動態Tool 呼叫束手無策;Prompt 防火牆(Guardrails)僅能處理文字層提示,缺乏執行期動態授權與密碼學稽核能力;SIEM 平台僅提供事後日誌紀錄,缺乏帶內即時攔截與防衛能力。本論文提出DROS-6P ——旨在單一C-ABI與 eBPF 帶內執行層中,同時強制執行這六大信任邊界之確定性執行期治理微內核。為確保安全控制面本身不會在企業內部、外部或惡意Agent 產生高頻系統呼叫(Syscalls)時成為效能瓶頸或單點故障點,進而防範自我引發的服務阻斷(Self-induced DDoS)與系統衰退,執行期治理必須具備「微秒級(μs)」的評估能力。實證基準測試顯示,DROS-6P 帶內微內核在測試環境中達到約26.1 μs 的平均決策延遲。具體而言,DROS-6P 強制執行:(1) Principal:透過3 階PKI 簽章之DROS 身份標籤(DIT);(2) Authorization:透過將角色精確映射至執行向量的確定性Capability Bitmaps;(3) Tool/Action Bound:透過FFI 邊界處的帶內C-ABI 攔截器;(4) Policy Gate:透過動態資料遮蔽(Redaction)、人工懸停審查(HITL) 與ZKP-Lite 零知識證明;(5) Audit Log:透過不可篡改的SHA-256 Merkle 雜湊鏈與Ed25519 數位簽章;以及(6) Expiry/Revocation:透過Read-Copy-Update (RCU) 原子指針交換實現O(1) 常數時間動態撤銷與秒級HTTP 403 阻斷。我們提供完全可重現的本地測試環境(test_verification_suite.py),100% 通過自動化斷言測試(耗時0.004s),並在六個異質產業賽道中驗證了DROS-6P,證明統合物理層治理是企業安全部署AI Agent 的充要條件。
An increasing number of special Internet of Things (IoT) applications are being deployed within federated and zero-trust (ZT) environments. These ad-hoc networks consist of heterogeneous, resource-constrained devices from various administrative domains, all of which are susceptible to compromise. The dynamic nature of these environments necessitates near-real-time Situational Awareness (SA), where processed data varies with its sensitivity and reliability, without dependence on a central authority. Examples include NATO and non-NATO coalitions engaged in hybrid military operations or humanitarian aid scenarios. To address the challenges of security, reliability, and context-aware data dissemination, we propose FedM, a multi-level formal model designed for context-aware and policy-driven data dissemination in federated IoT environments. This model is built upon various access control models and Denning’s research on information flow control (IFC), prioritizing the protection and reliability of data flows. A crucial element of this model is the distributed ledger, which facilitates the dynamic modification of label expressiveness, enhances resilience against disruption attacks, and separates policy logic from application functionality to mitigate risks associated with the benevolent developer. Additionally, we delineate a deterministic and history- and precedence-aware policy enforcement procedure to resolve conflicting actions and introduce processing primitives for the ongoing Data Quality Assessment (DQA) process. Our model also aligns with the concepts of Ubiquitous and Continuum Computing. Furthermore, in our paper we illustrate a policy-based dissemination pipeline, incorporating a bounded trustworthiness dimension. Additionally, we present a refined multi-layered framework that proposes the deployment of Information Flow Control (IFC) components, such as the Open Policy Agent decision engine, to facilitate policy-driven contextual data dissemination. We provide preliminary benchmarks for resource-constrained platforms, along with a formal threat model that addresses implicit flows, the benevolent developer problem, and the behavior of a distributed ledger under degraded network conditions. Finally, we conduct a formal verification of our model using the P framework.
Financial settlement systems rely heavily on institutional trust: intermediaries maintain ledgers, certifycompliance, and prevent unauthorized creation or movement of value. Zero-knowledge (ZK) techniques make itpossible to replace part of that trust with verifiable properties. This paper presents a minimal ZK settlementlayer designed around a simple principle: prove what must be true, disclose only what must be seen, anddeclare remaining trust explicitly.We describe an architecture in which transfers preserve value, spending authority is proven without sharingspending keys with the operator, double-spending is prevented, and supervisors can verify balance bands orthresholds without receiving the full ledger. We also map the residual trust surface: the operator of a singlenode can still see balances, order transactions, and censor. The contribution is not a claim of full sovereignty ordecentralization. It is a precise shift from opaque institutional faith toward a smaller, named set of trustassumptions, with cryptographic checks covering the rest.We compare this model conceptually with core banking systems and permissioned blockchains, and argue thatthe main institutional value of ZK settlement is not “trustlessness,” but trust minimization with honestresidual boundaries.This revision subjects that claim to its own standard. An audit pass against the reference implementation foundresidual dependencies the first version of this paper had not named: a confidentiality leak toward thecounterparty rather than the operator, three quantified capacity bounds, and a privilege that is counted butnever expires. We report them in §4.4 and §4.5, because a paper whose contribution is naming residual trust isfalsified by the trust it failed to name.
Description This preprint presents the Bharat Secure Digital Identity (BSDI) framework, a conceptual policy model for privacy-preserving and citizen-centric digital identity governance. The paper explores how decentralized identity technologies—including Decentralized Identifiers (DIDs), Verifiable Credentials (VCs), and Zero-Knowledge Proofs (ZKPs)—may support secure digital verification while minimizing unnecessary disclosure of personal information. BSDI proposes a governance model in which citizens retain primary control over their digital identity through secure digital wallets, the government serves as a trusted root issuer, and digital service providers function as cryptographic verifiers without retaining sensitive identity data. The framework also discusses lawful and targeted access mechanisms for national security within transparent legal oversight. This work is intended as a conceptual research and policy proposal rather than an implemented technical system. It aims to contribute to ongoing discussions on digital identity, privacy, cybersecurity, digital governance, and citizen sovereignty, and to encourage future interdisciplinary research, policy development, and public debate.
Autonomous AI agents increasingly execute actions, invoke tools, and operate on protected resources with limited human oversight. Existing authentication and authorization mechanisms establish identity and delegate authority, but do not inherently provide cryptographic evidence that a concrete request issued by a specific agent satisfies the applicable policy in a specific execution context. This paper hypothesizes that agent authorization can be formalized as a cryptographically verifiable relation, denoted $R_{CVA}$, that jointly binds an agent principal, a concrete authorization request, an execution context, and the satisfaction of an applicable policy, while selectively preserving the confidentiality of private authorization attributes. We introduce a preliminary formal abstraction for Cryptographically Verifiable Agent Authorization (CVA), define a compact set of candidate security properties including authorization soundness, principal binding, request binding, policy binding, and replay resistance, and provide an executable zero-knowledge proof of concept that instantiates selected elements of the model over a Groth16 zk-SNARK construction. We further identify and formalize the structural separation among identity binding, authorization-request binding, and runtime execution binding as a central open problem in the design of secure agentic systems (a distinction {not explicitly addressed by} current agentic security frameworks) and present a falsifiable research agenda for its resolution.
# VeriSBOM: Secure and Verifiable SBOM Sharing Via Zero-Knowledge Proofs **VeriSBOM**, a trustless, selectively disclosed SBOM framework that provides cryptographic verifiability of SBOMs using zero-knowledge proofs. Within VeriSBOM, third parties can validate specific statements about a delivered software, mainly regarding the authenticity of the dependencies and policy compliance, without inspecting the content of an SBOM. Respectively, VeriSBOM allows independent third parties to verify if a software contains authentic dependencies distributed by official package managers and that the same dependencies satisfy rigorous policy constraints such as the absence of vulnerable dependencies or the adherence with specific licenses models. ## Key Features * **Selective Disclosure (Hiding):** Choose which proprietary components to hide from the public SBOM. The system generates a cryptographic proof that replaces the plaintext data, guaranteeing privacy. * **High-Performance Folding:** Powered by **Nova-Scotia**, utilizing recursive SNARKs to handle SBOMs. * **Interactive Dashboard:** A complete 4-step workflow (Package Manager, Auditor, Vendor, Client) built with **Streamlit**. ## Repository structure The repository contains three main folders: 1. **Empirical**: contains **Benchmarking** and **src**, for the analysis and source code, respectively. 2. **User study**: contains the code and results of the user study. 3. **README_Doc**: contains the images used for this documentation. ## VeriSBOM Architecture The system is divided into four main roles: 1. **Package Manager**: Maintains the package repository with the allowed packages. 2. **Auditor:** Represents the regulatory body marking the compliance status by checking the packages of the package manager. 3. **Software Vendor:** Represents the entity that provides software artefacts and wants to hide the related SBOMs for privacy reasons. He is responsible for the generation of the cryptographic proofs as verifiable substitutes of the hidden packages in SBOMs. 4. **Client:** The end-user who receives the cryptographic proofs along with the software artefact for verifying binding, inclusion and compliance status. ## Web Access (Recommended) **For direct access to the artefact, VeriSBOM can be accessed at this public link** https://verisbom-verisbom-software.hf.space ## Setup & Installation Follow the README within the artefact ## Operational Workflow The application follows a **linear workflow** composed of four steps. Each step depends on the output generated in the previous one. > **Performance Note** Due to the cryptographic operations involved, generating proofs may take some time depending on the number and complexity of the active policy constraints. In the current reference environment, proof generation takes approximately **~5 seconds**, while verification takes around **~3 seconds per proof**. ## Step 1 — Package Manager In this step, the **Package Manager initialises the package repository**. ### Instructions 1. Open the **Package Manager** tab. 2. Click **`Load repository`**. > For convenience, the system automatically loads a **default repository containing packages from the NPM ecosystem**. ### Expected Output After successful execution: - A **green confirmation message** is displayed. - The **package list** appears on the left panel. - The **dependencies of each package** can be inspected on the right panel using the search bar. - A **dependency graph** is displayed at the bottom of the interface. ## Step 2 — Auditor In this step, the **Auditor defines policy constraints** that will be applied to the packages in the repository. ### Instructions 1. Enter a **policy name** (e.g., `Vulnerabilities`, `MIT License`). 2. Click **`Add`** to create the policy constraint. 3. Use the **search bar** to locate target packages. 4. **Uncheck packages** to mark them as **non-compliant**. > By default, **all packages are marked as compliant**. 5. Click **`Save and Propagate`** to apply the policy. ### Optional - Repeat the previous steps to create additional policy constraints. - Remove policies that are no longer required. ### Expected Output - A **green confirmation message** appears. - A **dependency graph visualisation** shows how non-compliance propagates across dependencies for the selected policy (or combination of policies). ## Step 3 — Software Vendor In this step, the **Software Vendor generates cryptographic proofs for a given SBOM**. ### Instructions 1. Upload a **local SBOM file**. > For demonstration purposes, the system automatically loads an **example SBOM**. 2. In the **Selective Disclosure** section: - Select which SBOM packages should be used for proof generation. 3. Click **`Generate Proofs`**. 3. Click **`Download`**. - Download the SBOM with hidden components and plaintext components ### Expected Output - A **progress bar** indicates the proof generation process. - **Green confirmation messages** appear once proofs are generated successfully. > **Important:** Successful proof generation only means that the **cryptographic proof has been constructed correctly**. Compliance with policies is verified only in **Step 4**. ## Step 4 — Client In the final step, the **Client verifies the proofs generated by the vendor**. ### Instructions 1. Upload the **SBOM**. 2. Select a **policy** from the dropdown menu. 3. Click **`Verify`**. ### Expected Output - **Verified (green badge)** The SBOM satisfies the selected policy. - **Failed (red badge)** The verification failed, and the interface displays the reason for the failure.
Zhongjing Wei, Osaid Muhammad Ameer, Nikita Borisov, Yupeng Zhang
Modernizing the security of operational technology systems that control critical infrastructure has become a pressing challenge. Because edge devices have limited capabilities, modernization has relied on application gateways that interface with identity management systems and enforce access policies. These gateways are powerful enough to perform complex authorization decisions and support zero-trust architectures, but they create major deployment and management burdens: they must be collocated with remote, distributed edge devices, kept up to date with security patches, and managed with minimal downtime. We propose Provable Remote Execution of Zero-Trust Authorization (Prezta), an architecture that eliminates these gateways by evaluating policies within a zero-knowledge virtual machine (zkVM) running on the client. The zkVM produces a succinct proof of authorization that edge devices can verify efficiently, extending the zero-trust security envelope to the edge. Policies and identity management schemes can evolve without updating edge devices. To demonstrate the feasibility of Prezta, we implement a prototype built using the RISC Zero zkVM that supports XACML 3.0 policies and JWT identity claims. While zkVMs introduce substantial proof overhead, we mitigate this overhead by compiling policies to Rust code and precompiling regular expressions. Combined with optimized signature verification and JWT parsing, these measures reduce prover time by more than an order of magnitude. Our compiler correctly implements 83\% of the XACML 3.0 conformance suite, with proof generation completing in tens of seconds on a desktop. Verification, by contrast, takes only tens of milliseconds, which is fast enough for resource-constrained edge devices.
Distributed systems can verify whether a transaction or state transition is valid, yet they often cannot establish whether the underlying action was authorized under a meaningful, current, and context-specific expression of consent. This limitation becomes increasingly significant as autonomous software agents, artificial intelligence systems, decentralized applications, and connected devices act across organizational and technical boundaries. This article presents a nonproprietary framework for verifiable consent in distributed systems through AI-assisted identity governance and recursive zero-knowledge proofs. The framework represents consent as a structured, machine-verifiable authorization object containing the consenting subject, requesting actor, permitted action, contextual constraints, validity period, policy version, and revocation state. A bounded AI-governance layer evaluates requests against explicit policies and contextual evidence while remaining subordinate to deterministic rules, human-defined constraints, and auditable decision procedures. Approved authorization statements are transformed into privacy-preserving cryptographic proofs, allowing a verifier to confirm that relevant consent and policy conditions were satisfied without requiring disclosure of the underlying identity attributes, private data, or complete policy record. To support high-volume environments, individual proofs may be recursively composed into succinct aggregate proofs. This construction separates expensive proof generation from efficient downstream verification and provides a basis for scalable authorization auditing across distributed infrastructure. The article defines the system model, consent lifecycle, trust assumptions, proof relationships, revocation requirements, and principal security properties, including authorization soundness, privacy preservation, replay resistance, policy-version integrity, and revocation safety. It also analyzes the architectural tradeoffs associated with AI reasoning, cryptographic proving costs, governance design, key management, and interoperability. The proposed framework does not disclose implementation-specific circuits, source code, model configurations, deployment topology, or proprietary protocol parameters. Instead, it establishes a general research foundation for treating consent as a verifiable computational primitive. Potential applications include decentralized identity, autonomous agents, regulated data exchange, financial services, healthcare information systems, Internet of Things networks, and cross-platform digital authorization.
As digital ecosystems expand, secure and interoperable identity management across organizational boundaries has become increasingly important. This paper presents a blockchain-based platform for decentralized identity and trust management to support cross-domain authentication and authorization among autonomous organizations, such as government agencies and academic institutions. The proposed platform employs a consortium blockchain as a tamper-resistant credential and policy repository, enabling each organization to administer its own credentials while supporting verifiable identity sharing across domains. On-ledger trust relationships and authorization policies allow trusted interactions without relying on centralized identity authorities or pre-established bilateral agreements. A prototype was implemented using Hyperledger Fabric and evaluated in a multi-domain setting. The results demonstrate correct authentication behavior, sub-second authentication latency, measurable transaction throughput, and effective revocation propagation. Additional experiments under multi-domain and concurrent authentication workloads show that the platform preserves consistent authentication outcomes while maintaining latency within practical bounds. The proposed approach can be applied to multi-institutional environments, such as inter-university digital services, cross-agency e-government systems, and collaborative research infrastructures, where secure identity sharing and cross-domain access control are required.
We present ECO/CPO-DAG, a domain-specific accountability protocol for adversarial supply chains that formalizes contradiction detection as a supplemental validation layer rather than a consensus or truth-establishing mechanism. Participants publish signed Event Claim Objects (ECOs) into a causally ordered, append-only directed acyclic graph (DAG) whose edges encode happened-before relations. When two claims about the same subject violate a domain constraint, any observer can compile a Contradiction Proof Object (CPO), a self-verifying object binding the two signed claims and the violated rule, which, on public verification, triggers economic slashing of a determinately blamed party. We map constraints to GS1 EPCIS 2.0 event semantics (spatial uniqueness, temporal monotonicity, quantity conservation, quality monotonicity, regulatory validity), so detection targets inconsistencies that are meaningful in practice. Selective disclosure via commitment schemes and, optionally, zero-knowledge contradiction proofs lets parties withhold claim contents until a challenge forces the minimal opening. We give an analytical treatment: an independent-observer detection model $1-(1-p_{\min})^h$, a deterrence condition $S>g(1-p)/(kp)$ under $k$-party collusion, and a storage estimate of order 1 GB per participant per year under stated assumptions. The protocol's boundary is explicit: it detects provable contradictions, not consistent lies; a party that never contradicts itself is invisible to it, so the layer complements, and does not replace, source verification and oracle aggregation. A single-machine reference implementation corroborates the detection model, with the predicted coverage band overlapping the measured 95% confidence interval at every observer count, and records zero false accusations; the fully zero-knowledge CPO, multi-party propagation, and adaptive-adversary evasion remain analytical.
Cross-Agent Governance Alignment (CAGA): Verifiable Coordination Across Private AI Governance Domains formalizes the CAGA problem: establishing a declared compatibility relation between AI governance domains across organizational boundaries without disclosing the proprietary policy content on which each domain relies. Cross-organizational agent interaction creates two distinct governance questions: whether each local effect-bearing action is authorized within its own domain, and whether the participating domains can establish the declared relation. This paper formalizes the second problem. CAGA does not itself authorize execution. It produces a privacy-preserving compatibility result and associated evidence that each domain's runtime authorization boundary may materially consume before emitting its own action-bound verdict and authorization artifact. The formal model defines a governance domain as agents, a declared effect-bearing action vocabulary, versioned policy and authority state, governance-relevant state, a material evidence set, and a runtime authorization boundary over the triadic verdict space (ALLOW, DENY, ABSTAIN), where unresolved ABSTAIN remains ABSTAIN and authorized resolution produces a separate resulting action-bound verdict through the boundary. Every CAGA claim is scoped to a declared profile identifying the participating domains and authority roots, action vocabulary, compatibility relation and version, commitments, temporal boundary, leakage profile, scheme and verification parameters, declared replay mode, failure treatment, and expected local-boundary consumption. The Boolean compatibility relation is separated from protocol status: the protocol output comprises a result that may be positive, negative, or unresolved, together with the proof or verifier record and a CAGA evidence artifact. An unresolved result is not a verdict, and neither a negative nor an unresolved result may be treated as affirmative CAGA support for ALLOW. An illustrative prior-authorization compatibility relation between a hospital domain and an insurer domain, together with a worked local-boundary consumption sequence, shows the level at which a CAGA proposition may be stated without disclosing a protocol construction; no execution path originates from CAGA. The paper: Separates local pre-execution authorization from cross-domain compatibility evidence, and reserves the term authorization artifact for the action-bound record emitted by a runtime authorization boundary; a CAGA result may participate in composed authorization only where the Composition Test is satisfied; the CAGA evidence artifact does not thereby become an authorization artifact Formalizes the declared compatibility relation and protocol output under a declared CAGA profile, with cross-domain interactions whose local actions need not be identical, and supplies a terminology and instrument-ownership map locating each evidentiary term in its owning instrument States the threat model with honest-but-curious as the base analytic assumption rather than a prediction about regulated parties, classifies an expanded threat inventory as covered, partially covered, or excluded, and treats Byzantine deviation, arbitrary collusion, and malicious-verifier behavior as outside the base claim, requiring separately specified protocol defenses Identifies the required properties of a declared CAGA protocol: relation completeness and soundness, declared-leakage privacy, deterministic relation result with permitted cryptographic randomness, evidence and reconstruction sufficiency under the declared replay mode, commitment and domain binding, repeated-interaction privacy, optional post-compromise transcript confidentiality, non-authorizing failure, evidence traceability and presentation scope, declared-regime scope, and Input Integrity support, where provenance establishes origin, not truth Restructures the prior-art analysis as a component-and-gap assessment across communication protocols including the current Model Context Protocol specification (2026-07-28), policy composition and distributed authorization, secure multi-party computation and zero-knowledge systems, selective-disclosure credentials, multi-agent and agent-action governance architectures, and ledger approaches, identifying CAGA as the residual problem after those contributions are accounted for Zero-knowledge proof systems, secure multi-party computation, private set intersection, trusted execution, commitment schemes, and selective disclosure are candidate implementation substrates rather than authorization substitutes; no component establishes CAGA or authorization by label alone. The analysis is aligned with the Authorization Artifact Test v1.2, the Authorization Boundary Integrity Model v1.1, the Five Tests Standard v1.2.0, the ABIM Evidence Requirements v3.5, the Closed-World Bargain v1.1, and the Override Asymmetry v2.0. The paper does not assert that any jurisdiction requires CAGA, zero-knowledge proof, or pre-execution authorization, and it deliberately stops at problem formalization: it does not disclose protocol constructions, circuits, trusted-setup designs, or implementation mechanisms. The paper does not present an ideal functionality, security reduction, theorem establishing a protocol construction, or deployable implementation. By defining the problem space and evaluation criteria within a declared closed world, it provides a structured problem specification against which candidate cross-domain coordination protocols and their composition with local runtime authorization boundaries can be assessed. Version 2.0 (August 2026) separates cross-domain compatibility evidence from local pre-execution authorization; replaces the governance-domain enforcement function with a runtime authorization-boundary model; distinguishes the Boolean compatibility relation from unresolved protocol status; defines a declared CAGA profile; separates CAGA evidence artifacts from local authorization artifacts; conditions determinism on declared decision state while permitting cryptographic randomness; replaces default-denial protocol failure with non-authorizing unresolved status; adds an explicit interface to local Input Integrity assessment, authenticated bound materials, replay-mode, closed-world, Composition Test, and authorized-resolution semantics; narrows legal and regulatory claims; updates MCP and multi-agent prior-art references; and restructures the prior-art analysis as a component-and-gap assessment. Version 2.0 also adds an illustrative prior-authorization compatibility relation and a worked local-boundary consumption sequence; clarifies that the paper specifies a formal problem rather than presenting an ideal functionality, security reduction, or protocol proof; adds a terminology and instrument-ownership map; expands the component-and-gap analysis to address policy composition, distributed authorization, selective-disclosure credentials, and recent agent-action governance work; and clarifies the relationship between the paper's CC BY 4.0 copyright license and unlicensed patent rights. It supersedes Version 1.1 (July 2026), which aligned terminology with 5TS v1.2.0 and the FERZ authorization-artifact vocabulary, and Version 1.0 (February 2026), the original problem formalization. Keywords: cross-agent governance alignment, cross-organizational AI governance, private governance domains, privacy-preserving coordination, runtime authorization boundary, pre-execution authorization, authorization artifacts, zero-knowledge proofs, secure multi-party computation, Input Integrity, independent reconstruction