A reading page. It starts from one source — Li et al., Agentic Communication Networks (2026) — and from the correction Martin Pompéry made to an earlier draft of it on 2026-10-26. Everything beyond the quotations is marked ⟨Inference⟩.
The question
When an autonomous agent acts — invokes a service, delegates a subtask, moves a robot — three different questions get asked in one breath, and collapsing them is the common failure:
| Question | What answers it |
|---|---|
| Who acted? | identity |
| Was it allowed to? | authority / authorisation |
| Who consumed what? | resource accounting |
| Who is answerable for the outcome? | accountability |
The first three are lookups against infrastructure the industry knows how to build. The fourth is a claim about a causal chain, and it is the one that does not reduce to the others.
How ACN treats it: accountability as identity management
The Li paper files accountability under the entity level, not beside it. §2.5, listing what the entity level covers: “agent naming and identification, authentication and authorization, agent–principal relationships, authority and delegation, registration and discovery, lifecycle management, mobility, and accountability.”
§7.1 is titled “From Device Identity to Agent Identity” and absorbs it: ACN “requires mechanisms for representing the identity of the acting agent, the authority under which an action is performed, and the corresponding resource usage and accountability.” The section’s closing principle is phrased as a property of identity:
“An agent should remain a recognizable and accountable network entity even when its endpoint, runtime, or communication session changes.”
The mechanisms follow suit. §4.5 delivers “lifecycle-wide security and accountability … through identity authentication, access control, secure communication, trusted computing, resource accounting, operational auditing, and verification.” §5.5 makes that concrete: DIDs, PKI, digital signatures, zero-trust access control, capability-based authorisation, policy engines, anomaly detection, “standardized audit logs and tamper-resistant records”, blockchain-based evidence preservation, trusted timestamps. Identity infrastructure, plus tamper-evident logging.
⟨Inference: the tell is a terminological slide in §7.1. The section titles its second challenge “the relationship among identity, authority, and accounting” and discusses attributing resource consumption across locations, devices, services and sessions — a metering problem, which genuinely is identity plus measurement — and then closes on accountability, which is not. The two words carry the paragraph between them without the difference ever being stated.⟩
The one sentence where it escapes
§7.4, “Trust, Governance, Privacy, and Accountability”:
“Governance must also determine responsibility when autonomous actions cross multiple agents and domains. If an agent delegates a task, another agent selects a service, and the network coordinates the underlying resources, accountability cannot be established solely from packet logs. ACN needs an auditable relationship among authority, decisions, actions, and outcomes.”
⟨Inference: this says accountability is relational and causal — a chain from authority through decision and action to outcome — rather than a lookup. One can know with certainty which agent acted and under which credential, and still not know who is answerable, because the decision was composed across parties. That is a real diagnosis and it is correct.⟩
And the next paragraph returns to the log. The research list is “minimum disclosure, privacy-preserving capability discovery, selective context exposure, policy composition, trust federation, delegation chains, provenance, explainable coordination decisions, accountable execution and security”; the standardisation list is “trust and policy descriptors, authority credentials, delegation and revocation procedures, audit records, provenance information”. Better records, standardised.
⟨Inference: diagnosis beyond identity, therapy within it. This is the precise shape of the omission, and it is worth stating that way rather than as “the paper ignores accountability” — it does not ignore it, it reaches the edge of the identity frame, looks over, and steps back.⟩
Why the step back matters
⟨Inference throughout.⟩
Identity tells you who. A log tells you what was recorded. Neither tells you whether the record corresponds to what happened — and in a cross-domain setting no party has reason to trust another’s record.
The paper’s own strongest use case is exactly that setting. §6.3 has an operator network, a municipal emergency network and a utility/logistics network forming a temporary federation, where “static agreements cannot anticipate every combination of failure, load, geography, and policy” and each domain must “preserve each domain’s control” ⟨corrected 2026-10-29: quoted here as “preserve [its] own control”; the bracket covered a substitution the source does not make⟩. Its requirement list asks for “auditable decisions, accounting, revocation, and graceful exit”. A tamper-resistant audit log is tamper-resistant with respect to outsiders; with respect to its keeper it is an assertion. The federation case is precisely where that assertion has no backing.
Ostrom’s second puzzle, already carried elsewhere in this wiki, states the consequence: without monitoring, there can be no credible commitment. ACN has monitoring by assumption — it presumes the audit record is trustworthy. It does not have monitoring by construction.
What CCTI’s stack actually answers here
⟨Inference. This section exists because an earlier draft got it wrong and the correction is the useful part.⟩
The tempting move is to point at the Epistemic Integrity Certificate — it is the CCTI primitive that concerns an agent’s reasoning, and §7.4 concerns agents’ decisions, so they look adjacent. They are not. The EIC is an ex-ante commitment device: privately commit beliefs and conditions for cooperation, match over them, negotiate the further evidence needed to reach agreement. It attacks bargaining failure — making cooperation reachable without disclosure. §7.4 states an ex-post attribution problem: once the thing has happened across a delegation chain, who is answerable. Being about reasoning is not the same as being about what was done. ⟨Per Martin Pompéry, 2026-10-26: reading the EIC as an accountability primitive is a misreading of it.⟩
The part of the CCTI stack that does bear on §7.4 is the attested-evidence layer (WP-A), and specifically two of its four evidence types:
- Business data — attested claims about cross-organisational interaction. That is the cross-domain hand-off §7.4 cannot establish from packet logs.
- Recursive proofs — claims supported by another instance of the same infrastructure. ⟨Inference: structurally this is what a delegation chain needs. A→B→C produces a claim at C whose validity depends on claims at B and A; a recursive proof is the form in which that dependency is carried rather than asserted. The paper’s requirement — “an auditable relationship among authority, decisions, actions, and outcomes” — is a request for exactly this object, written by people who do not have it in their toolkit.⟩
Two caveats kept visible. (1) Both published CCTI-adjacent instances of attested evidence — Man & Kleppmann (2026) and Heiss et al. (2023) — anchor trust in a tamper-resistant signing sensor, which is an assumption of the same family as trusting an audit log, moved down the stack. CCTI’s M5 gate commits to removing it. Until then the contrast with ACN is sharper in principle than in deployed practice. (2) Verifiability constrains what an agent can assert, not what it does — the objection already carried on the CCTI page from the Upright material. Attested evidence makes a chain checkable; it does not make the decisions in it good.
Open
- The paper asks, and does not answer: “how much of this information must be visible to the network and how much can remain within application and security systems” (§7.1). That is the entity-level version of the minimum-disclosure question.
- Whether a chained, cross-domain delegation record can be made verifiable without a shared trust anchor is not addressed by either side. ACN assumes an anchor it calls an audit log; CCTI has so far assumed one it calls a signing sensor.
Related
- Li et al., Agentic Communication Networks (2026) — the source
- Cryptographic trust infrastructure · Epistemic Integrity Certificate · CCTI
- Coordination failure vs. bargaining failure — which failure each instrument attacks
- Ostrom’s commons design principles
- Agent protocol interoperability — the other half of the same source