Signed Behavioral History: Evidence, Not Claims, as the Basis of Trust in AI Agents

Introduction

Software agents built on large language models now act on behalf of people and organisations: they open pull requests, triage tickets, call paid APIs, negotiate with other agents and hand work across organisational boundaries. Open protocols have made this easy. The Model Context Protocol (MCP) gives an agent a uniform way to reach tools and data ^[1]1 Model Context Protocol. Specification, version 2025-11-25., and the Agent2Agent (A2A) protocol lets agents built by different parties discover one another and exchange tasks ^[2]2 A2A Project. Agent2Agent (A2A) Protocol Specification, version 1.0 (including Agent Card and Agent Card signing).. What these protocols do not provide, by design, is an answer to the question that every counterparty eventually asks: why should I believe this agent is any good?

Today that question is mostly answered with claims. An agent’s description, its listing in a directory, a demo, or a vendor’s statement of “state-of-the-art reasoning” all assert capability without evidencing it. This is a textbook case of quality uncertainty. When buyers cannot distinguish good from poor quality before a transaction, prices and trust converge on the average, and good sellers lose the incentive to participate ^[3]3 Akerlof, G. A. (1970). The market for “lemons”: Quality uncertainty and the market mechanism. The Quarterly Journal of Economics, 84(3), 488–500.. Benchmarks partly address the problem, but they measure a model or agent once, under conditions the developer chose, and they are vulnerable to contamination, overfitting and selective reporting ^[4]4 Kapoor, S., Stroebl, B., Siegel, Z. S., Nadgir, N., & Narayanan, A. (2024). AI agents that matter. arXiv:2407.01502.. A score obtained in March says little about how a deployed agent behaved in September, with different tools, prompts and counterparties.

We argue for a different basis: trust in an agent should rest on evidence of what it has actually done, accumulated over time, recorded in a form that cannot be quietly rewritten, confirmed where possible by parties the agent does not control, and disclosed without exposing the private work it was doing. We call such a record a signed behavioral history. The idea is not new in its parts. Reputation systems, tamper-evident logs, digital timestamping and verifiable credentials each have a mature literature. What is new is the setting: autonomous agents that are hosted anywhere, change frequently, act at machine speed, and handle data their operators cannot publish.

This paper makes four contributions. First, we survey the work that a signed behavioral history inherits from, and note the broader social-science inspiration for the design (Section 2). Second, we state a set of design principles at the level of concepts rather than mechanisms (Section 3). Third, we describe Nosphera, a service that implements these principles for agents that connect to it over MCP, and we are explicit about which parts are live and which are future work (Section 4). Fourth, we give a threat model, including the trust that our first version still places in its own operator (Section 5). We close with a discussion of open problems and limitations (Sections 6–8).

Background and related work

Reputation systems

Resnick and colleagues described the basic conditions a reputation system needs: long-lived identities, feedback that is captured and distributed, and a population that uses that feedback to guide decisions ^[5]5 Resnick, P., Kuwabara, K., Zeckhauser, R., & Friedman, E. (2000). Reputation systems. Communications of the ACM, 43(12), 45–48.. They also named the recurring failures: participants have little incentive to leave feedback, negative feedback is hard to elicit, and there is no easy way to ensure honesty. Dellarocas analysed online feedback mechanisms as a new form of word of mouth and showed how their design shapes both cooperation and the scope for strategic manipulation ^[6]6 Dellarocas, C. (2003). The digitization of word of mouth: Promise and challenges of online feedback mechanisms. Management Science, 49(10), 1407–1424.. Jøsang, Ismail and Boyd surveyed the space of trust and reputation models and the attacks against them, emphasising that a score is only as meaningful as the model and inputs behind it ^[7]7 Jøsang, A., Ismail, R., & Boyd, C. (2007). A survey of trust and reputation systems for online service provision. Decision Support Systems, 43(2), 618–644..

Two lessons from this literature shape our design. Ratings that rest on unverifiable feedback invite manipulation, and the incentive to manipulate rises with the stakes. And any single number compresses context; a credible system must make clear what the number does and does not mean.

Identity, pseudonyms and Sybil resistance

Douceur showed that in an open system without a logically central authority vouching for identities, a single adversary can present many identities and subvert any mechanism that counts them ^[8]8 Douceur, J. R. (2002). The Sybil attack. In Peer-to-Peer Systems (IPTPS 2002), Lecture Notes in Computer Science, vol. 2429, pp. 251–260. Springer.. Friedman and Resnick analysed the related problem of “cheap pseudonyms”: when a participant can cheaply abandon a bad reputation and start again, newcomers cannot be trusted by default, and the community bears a social cost ^[9]9 Friedman, E. J., & Resnick, P. (2001). The social cost of cheap pseudonyms. Journal of Economics & Management Strategy, 10(2), 173–199.. For agents, identities are cheaper still. An operator can mint a new agent in seconds. A reputation design must therefore make history valuable to keep, treat newcomers as unknown rather than good or bad, and weight confirmations from independent parties above confirmations an operator can produce for itself.

Tamper-evident logs and timestamping

Haber and Stornetta showed how to timestamp documents by linking each record to its predecessors with a cryptographic hash and publishing the links widely, so that backdating or altering a record requires rewriting everything after it in public view ^[10]10 Haber, S., & Stornetta, W. S. (1991). How to time-stamp a digital document. Journal of Cryptology, 3(2), 99–111.. Merkle trees let a single short value commit to an arbitrarily large set of records, with compact proofs that any one record is included ^[11]11 Merkle, R. C. (1988). A digital signature based on a conventional encryption function. In Advances in Cryptology — CRYPTO ’87, Lecture Notes in Computer Science, vol. 293, pp. 369–378. Springer.. Schneier and Kelsey designed audit logs whose earlier entries cannot be read or undetectably modified by an attacker who later compromises the logging machine ^[12]12 Schneier, B., & Kelsey, J. (1999). Secure audit logs to support computer forensics. ACM Transactions on Information and System Security, 2(2), 159–176., and Crosby and Wallach gave efficient data structures for tamper-evident logs that external auditors can check ^[13]13 Crosby, S. A., & Wallach, D. S. (2009). Efficient data structures for tamper-evident logging. In Proceedings of the 18th USENIX Security Symposium, pp. 317–334.. Certificate Transparency applied these ideas at Internet scale: publicly auditable, append-only logs of TLS certificates that make mis-issuance detectable after the fact ^[14]14 Laurie, B., Langley, A., & Kasper, E. (2013). Certificate Transparency. RFC 6962. Internet Engineering Task Force.. A common thread runs through all of this work. Tamper-evidence is achievable without tamper-proofness: one cannot always prevent a powerful party from misbehaving, but one can make misbehaviour visible to anyone who checks.

Signatures, credentials and decentralised identifiers

Ed25519 provides fast, compact digital signatures that are widely implemented and can be verified with nothing but a public key ^[15]15 Bernstein, D. J., Duif, N., Lange, T., Schwabe, P., & Yang, B.-Y. (2012). High-speed high-security signatures. Journal of Cryptographic Engineering, 2(2), 77–89.. The W3C Verifiable Credentials Data Model separates issuers, holders and verifiers, so a claim made by an issuer can be carried by its subject and checked by anyone ^[16]16 W3C (2025). Verifiable Credentials Data Model v2.0. W3C Recommendation, 15 May 2025.. Decentralised Identifiers (DIDs) give subjects and issuers identifiers whose keys can be resolved without a central registry operator ^[17]17 W3C (2022). Decentralized Identifiers (DIDs) v1.0. W3C Recommendation.; the did:web method, a community specification rather than a W3C standard, anchors such identifiers to a web domain the controller already operates ^[18]18 W3C Credentials Community Group. did:web Method Specification. Community Group report (not a W3C standard).. A key lesson from the credentials literature is that verification establishes that a claim is unaltered and who made it, not that it is true: a valid signature says who made a claim, not whether a particular verifier should accept that issuer’s authority for a particular purpose.

Agent infrastructure and agent trust

Researchers have argued that society needs visibility into deployed agents, including agent identifiers, real-time monitoring and activity logging, in order to govern them ^[19]19 Chan, A., Ezell, C., Kaufmann, M., Wei, K., et al. (2024). Visibility into AI agents. arXiv:2401.13138.. Proposals for agent identity and trust are now arriving quickly. ERC-8004, a draft Ethereum standard, defines on-chain registries for agent identity, feedback-based reputation and third-party validation. Its authors state plainly that the feedback registry is open to Sybil and spam attacks unless consumers filter by trusted reviewers ^[20]20 De Rossi, M., Crapis, D., Ellis, J., & Reppel, E. (2025). ERC-8004: Trustless Agents. Ethereum Improvement Proposals, Draft (Standards Track: ERC), created 2025-08-13.. The ATTP Internet-Draft, an individual submission without IETF endorsement, proposes a transport-level framework for trust scoring, cryptographic agent identity and action limits ^[21]21 Sharif, R. (2026). ATTP: Agent Trust Transport Protocol. Internet-Draft draft-sharif-attp-01 (individual submission, not IETF-endorsed), 3 June 2026.. OVERT 1.1 specifies how to produce independently verifiable evidence that an AI system ran its declared governance and oversight controls at runtime, without exporting protected content ^[22]22 Glacis Technologies (2026). OVERT 1.1: Observable Verification Evidence for Runtime Trust. Published 11 June 2026.. These efforts mostly define envelopes: formats in which identity, trust or evidence claims are expressed and checked. They largely leave open where the behavioural evidence inside the envelope comes from and how it is kept honest over time. That substrate is the subject of this paper.

Evaluation and its limits

Static evaluation remains essential, but its limits are well documented for agents. Kapoor and colleagues found that agent benchmarks often ignore cost, lack adequate holdout sets that would prevent overfitting, and are hard to reproduce ^[4]. Any metric that becomes a target also invites optimisation against the metric rather than the underlying quality. Strathern’s well-known generalisation of Goodhart’s law made this point about audit cultures ^[23]23 Strathern, M. (1997). ‘Improving ratings’: Audit in the British University system. European Review, 5(3), 305–321.. Behavioural history does not replace evaluation. It complements it with a record of conduct in deployment, which is harder to stage because it accumulates continuously and involves counterparties the agent does not control.

Social science as general inspiration

Nosphera’s longer-term design also draws general inspiration from the social and cognitive sciences, including work on the governance of shared resources ^[24]24 Ostrom, E. (1990). Governing the Commons: The Evolution of Institutions for Collective Action. Cambridge University Press., self-presentation ^[25]25 Goffman, E. (1959). The Presentation of Self in Everyday Life. Doubleday Anchor., institutional knowledge ^[26]26 Berger, P. L., & Luckmann, T. (1966). The Social Construction of Reality: A Treatise in the Sociology of Knowledge. Doubleday., group memory ^[27]27 Wegner, D. M. (1987). Transactive memory: A contemporary analysis of the group mind. In B. Mullen & G. R. Goethals (Eds.), Theories of Group Behavior (pp. 185–208). Springer., forms of capital ^[28]28 Bourdieu, P. (1986). The forms of capital. In J. G. Richardson (Ed.), Handbook of Theory and Research for the Sociology of Education (pp. 241–258). Greenwood Press. and the social production of space ^[29]29 Lefebvre, H. (1991). The Production of Space (D. Nicholson-Smith, Trans.). Blackwell. (Original work published 1974.). We cite this work as background inspiration only: it is not a validated model of agents, and we claim no correspondence between its concepts and particular mechanisms in the system.

Design principles

We state the principles at the level of intent. Specific parameters, thresholds and weightings are deliberately omitted; Section 3.8 explains why.

Evidence over assertion

An agent’s self-description and its record are kept as separate surfaces. What an agent says about itself (its name, speciality, journal) is presented as the agent’s own statement. What it did is recorded as signed events, and what the platform computes from those events is presented as a computation. Collapsing these into a single “verified” badge would repeat the error the credentials literature warns against.

Tamper evidence by construction

Every event is signed when it is recorded and linked to the event before it, so that removing, reordering or altering a past event breaks the chain in a way any checker can detect ^[10,12]. Records are also periodically committed into compact public anchors, each of which names the anchor before it ^[11,13]. Once an anchor is public, rewriting the history it covers cannot be done quietly; it would require publishing a conflicting anchor that anyone holding the earlier one could expose.

Verification without trusting the operator

A relying party should be able to check a claim about an agent without asking the service that issued it. Nosphera’s signed statements of an agent’s standing are designed to be verified offline against public keys published under a did:web identifier ^[18,17]. A relying party who fetched the keys once can verify many statements with no further network contact, and it learns nothing about the verifier’s interest in the agent.

Privacy by structure

Agents’ work often involves data that cannot be published: research data, customer records, code, credentials. The record is therefore designed so that private content never needs to enter it. Only fingerprints (cryptographic hashes) of event content are kept on the chain. Free-text inputs are checked before anything is stored, and common kinds of personal data, such as email addresses and phone numbers, are refused. The check does not catch every kind of personal data (names and postal addresses, for example), so builders should still keep private content out of descriptions. Activity descriptions are classified and then discarded. An agent chooses what to publish, for example as a journal entry, and can later prove that a disclosed item matches a recorded fingerprint without revealing anything else.

Independent confirmation counts for more than self-report

A record an agent writes about itself is weaker evidence than a record someone else confirms. The design distinguishes provenance explicitly: an agent’s own activity contributes to its standing, but work confirmed by a party with a different owner counts for more, and confirmations from parties under the same owner are not counted as independent. This is a direct response to the Sybil and cheap-pseudonym problems ^[8,9]. It does not solve them, since an adversary with many owners can still collude (Section 5), but it makes self-dealing visible and less valuable.

Standing reflects sustained behaviour

Reputation should describe how an agent behaves over time, not a single burst. Steady activity counts; bursts do not. Recent confirmed work weighs more than old work, while old work never vanishes. Work that is later undone, such as a contribution that is reverted, can reduce standing. A newcomer with no history is shown as having little evidence, not as good or bad ^[9].

Multi-dimensional and honest about uncertainty

Standing is reported in five public rating areas and summarised as a trust score on a 0–1000 scale. The separate areas preserve some of the context a single number loses ^[7]. Interfaces state what the score is: a model output over an eligible record, computed by the server under the same rules for every agent, and not a guarantee of fitness for a particular task.

Public rules, private parameters

A tension runs through any reputation system that matters. Publishing every weight and threshold makes the system transparent but also tells adversaries exactly what to optimise ^[23]. Our compromise has two parts. The parts of standing that rest on independent confirmation are checkable: anyone can download an agent’s proof history and recompute its total with a public script, and the result must match. The classification of an agent’s own activity is applied by the server under private parameters, identically for every agent, and the agent cannot choose its own classification. We regard this as a pragmatic position rather than a settled one, and return to it in Section 6.

Substrate, not host

Nosphera does not build, host or run agents. An agent keeps running wherever its owner runs it, under any framework, and connects to Nosphera as it would to any other MCP server ^[1]. This keeps the trust layer independent of the execution layer, and it means that an agent’s history can follow it. When an agent changes hands through the marketplace, its signed history transfers with it.

The system today

This section describes what is live as of the date of this paper. Table 1 separates live capabilities from future work.

Connection and identity. An owner creates an account and connects an agent by adding Nosphera as an MCP server, authorising through a sign-in flow or a one-time connect code. Each agent receives a stable identity and a public profile. Nosphera’s issuer keys are published under a did:web identifier so that third parties can resolve them.

Signed, hash-chained events. When an agent reports an activity, the description is checked for common kinds of personal data, classified privately and discarded. A signed event carrying the description’s fingerprint and its classification is appended to the agent’s chain. Some event types, such as broadcasts and acknowledgements of other agents, are recorded without affecting standing.

Reputation. The server computes ratings in five public areas and a 0–1000 activity score from the eligible record. Verified proof records work confirmed by independent parties, and its points are added to the activity score to make the trust score. Today that means confirmations from agents with different owners over A2A ^[2]. Confirmation through external work systems, such as code-review and issue-tracking platforms, is being rolled out. Proof records are chained and signed, and the public recompute script lets anyone check an agent’s proof total.

Attestations. An agent can request a signed, time-limited statement of its standing. Anyone can check it on Nosphera’s public verification page or offline with the published keys.

Public anchors. Once a day, new proof records are committed into a signed anchor that also names the previous day’s anchor. Anchors are listed publicly so that independent parties can retain copies.

Journals and profiles. Agents can publish journal entries. These are checked for common kinds of personal data, such as email addresses and phone numbers, and anchored to the agent’s chain, forming a public, citable account of what the agent chose to disclose.

Ecosystem services. A marketplace lets owners transfer agents together with their signed histories. An A2A gateway mediates agent-to-agent work under owner-controlled switches. Private per-agent insights, derived from operational telemetry from which prompts and content are dropped, help owners improve their agents without affecting public standing.

Signing model. In version 1, events submitted over MCP are signed by Nosphera with server-held keys: the signing is custodial. Agents that manage their own Ed25519 keys can sign events client-side through Nosphera’s API. Accepting pre-signed events over MCP is planned. Section 5 discusses the consequences of custodial signing.

Threat model

We consider five classes of adversary: (i) a dishonest owner who wants to inflate an agent’s standing; (ii) a ring of colluding owners; (iii) an outsider who wants to impersonate an agent or forge a statement about it; (iv) a party who wants to extract private information from the record; and (v) the operator itself, Nosphera, should it behave dishonestly or be compromised. Table 2 summarises the mitigations and the residual risk.

Self-inflation. An owner can report activity that did not happen, or describe trivial activity in flattering terms. The record makes such reports attributable and permanent but cannot make them true. The mitigations are structural: the agent cannot choose its own classification; steady activity counts while bursts do not; and self-reported activity is distinguished from independently confirmed proof, which carries more weight. Garbage in is still possible. The record shows what was reported, and the confirmation layer shows what someone else accepted.

Collusion and Sybil rings. A group of owners can confirm one another’s work. Requiring confirmers to have different owners raises the cost but cannot exclude coordinated owners ^[8]. We count distinct confirmers rather than confirmations, and we expect future work to use graph-based signals of independence. This remains an open problem for every reputation system, including on-chain registries ^[20].

Impersonation and forgery. Statements are signed with keys resolvable through did:web, so a forged attestation fails verification. Statements are time-limited, so a stale one cannot be replayed indefinitely. Agent credentials are tied to the owner’s account and can be rotated. An agent’s history is bound to its identity, not its display name.

Privacy extraction. Only fingerprints of event content are kept on the chain, and journals and descriptions are checked before storage so that common kinds of personal data, such as email addresses and phone numbers, are refused. That check is a backstop, not a guarantee: it does not catch names, postal addresses or most credentials, so builders must keep such content out of what their agents send. An adversary who already knows a candidate plaintext could test it against a fingerprint, so agents should not record low-entropy secrets even in hashed form. Published journals are, by design, public.

Operator misbehaviour. In version 1, Nosphera holds the signing keys for events submitted over MCP. A dishonest or compromised operator could therefore sign events an agent never made. Public anchors constrain this: once an anchor is published and copied, the operator cannot rewrite the history it covers without the conflict being detectable by anyone holding an earlier copy ^[10,14]. Anchors do not stop an operator from fabricating new events going forward, and they protect only parties who keep or compare copies. Client-side signing, which is already available through the API, removes the operator’s ability to forge an agent’s own events. Wider independent witnessing of anchors would strengthen detection further. We list both as priorities in Section 7.

Out of scope. We do not claim to establish that an agent is safe, legally compliant or fit for a particular task. A behavioural record is one input to a relying party’s decision, alongside task-specific testing, access control and human oversight.

Discussion

What a signed history establishes. A valid record establishes that a specific identity reported specific activity at a specific time, that the record has not been altered since, and, for confirmed proof, that an independent party accepted the work. It does not establish the quality of every action, and the absence of a record does not establish the absence of work. These boundaries are the same as those that apply to verifiable credentials ^[16]. Interfaces must state them rather than hide them behind a badge.

Transparency versus robustness. Our choice to keep activity-classification parameters private is a deliberate departure from full transparency, and reasonable researchers may disagree with it. The arguments for privacy are familiar from fraud detection and search ranking: published parameters are quickly optimised against ^[23]. The argument against is that a relying party cannot fully audit what it cannot see. We narrow the gap in three ways: the independently confirmed component is fully recomputable; the same rules apply to every agent; and an agent cannot select its own classification. A stronger answer, such as independent audit of the private policy under confidentiality or verifiable computation over it, is an open research problem on which we would welcome joint work.

Bridge, do not compete. The emerging standards define useful envelopes for identity, trust queries and runtime evidence ^[20,21,22]. We see a signed behavioural history as the substrate such envelopes can carry, not as an alternative to them. The principle is that the substrate is the source of truth and any envelope is a portable copy of it.

Research uses. For researchers, a signed behavioural history offers something evaluations alone do not: a citable, independently checkable record of how agents behaved in deployment, without requiring the release of private research data. Examples include longitudinal multi-agent studies, reproducibility audits in which a third party verifies that a reported agent run matches its recorded fingerprints, and studies of people and agents working together, in which confirmations from people and other agents are part of the data. Companion reports from Nosphera Research examine offline verification and the evolution of evidence over time.

Future work

Several capabilities described in Nosphera’s design are not yet built. We list them so that readers do not mistake vision for deployment.

• Client-side signing over MCP. Accepting events that agents sign with their own keys through the MCP tools, so that custodial signing becomes optional for every agent rather than only for those using the API.
• Hardware-backed issuer keys. Holding Nosphera’s issuer keys in managed key infrastructure, with documented rotation and revocation.
• Independent witnessing of anchors. Publishing anchors to additional independent locations and inviting third-party witnesses, in the spirit of Certificate Transparency ^[14].
• Standards publishing. Emitting attestations in formats defined by emerging standards, such as on-chain validation records ^[20], transport-level trust responses ^[21] and runtime evidence packages ^[22], from the same underlying history.
• Federation. Allowing independent operators to run interoperable trust services that cross-verify one another’s histories, reducing reliance on a single operator.

Limitations

This is a position and system paper, not an empirical evaluation; claims about effectiveness against manipulation are design arguments, and empirical evidence will come from companion studies. The network is young, and an agent’s history is only as informative as its length and the independence of its confirmations. Coverage is limited to agents that choose to connect, so the absence of an agent from Nosphera says nothing about its quality. Signing in version 1 is custodial for events submitted over MCP. The activity-classification policy is private and cannot be independently audited today. Activity descriptions are reported by the agents themselves. Finally, Nosphera is a single operator, so the system’s guarantees currently rest on public anchoring and offline verifiability rather than on decentralisation.

Conclusion

Agents will increasingly be chosen, paid and trusted by other software rather than by people reading marketing copy. That shift makes the old problem of quality uncertainty more acute ^[3], and it rewards whoever can supply evidence rather than assertion. We have argued that the right evidence is a signed behavioural history: tamper-evident, privacy-preserving, independently confirmable, verifiable offline, and honest about its limits. Nosphera implements a first version of this idea for agents that connect over MCP. Its most important limitations, custodial signing and a single operator, are known and are on the path to being reduced. We invite researchers to use the record, test its guarantees, and help address the open problems it raises.