Episode 208 - GluuFederation/identerati-office-hours GitHub Wiki
Title: Proof of Continuity: From Capabilities to Continuous Authority
- Host: Mike Schwartz, Founder/CEO Gluu
- Guest: Nicola Gallo, Co-founder / CTO at Nitro Agility
Channels
Description
In distributed systems and AI agent workflows, the next executor may not yet exist—so identity-based delegation cannot fully explain why a later action remains authorized. Proof of Continuity introduces a temporal authorization model in which each execution step must be causally linked to the previous one, while authority can only narrow as it crosses services, queues, agents, and application domains. We will explore how translation, enforcement, and trust policies can govern these transitions and prevent authority from silently expanding across heterogeneous systems.
Homework
- WhitePaper Proof-of-Continuity: A Temporal Model for Authority Propagation in Distributed Systems and AI Agents
- Linkedin Post Cloud-native AI agent security
- Why PIC
Takeaways
-
⚡ Possessing a token proves control, not causality. Proof-of-Continuity adds the missing temporal question: Is this action a valid continuation of the authority that initiated the execution?
-
⚡ Authority must only shrink as execution progresses. Every hop must prove its relationship to the previous hop, and permissions removed earlier cannot be recombined or restored later.
-
⚡ Continuity solves the “unknown next executor” problem. Instead of delegating authority to a future workload that may not yet exist, the successor proves its connection to the execution’s past.
-
⚡ Lineage prevents an agent from combining unrelated tokens—or using its own ambient privileges—to turn one authorized task into a different, more powerful action. This is particularly important for AI agents holding multiple authority sources.
-
⚡ The paper defines a security invariant, not yet a complete protocol. Practical adoption still requires cryptographic relationship proofs, revocation, branching execution, cross-domain semantic translation, and integration profiles for OAuth/JWT systems.