| Internet-Draft | Agent Identity over Avian Carriers | April 2026 |
| Beyer | Expires 3 October 2026 | [Page] |
This document specifies a method for establishing cryptographic identity and provenance attestation for agentic AI systems operating over Avian Carriers (AC). As large language models increasingly delegate sub-tasks to other models via pigeon, questions of authorship, intent, and hallucination propagation across feather-based transport layers demand urgent standardization.¶
This document extends the delegation chain model and provenance structure of draft-beyer-agent-identity-architecture-00 to the specific constraints of feather-based transport layers, and extends RFC 1149, RFC 2549, and RFC 6214 to address agent identity. It is an April 1 publication.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 3 October 2026.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document.¶
RFC 1149 [RFC1149] established the foundational framework for the transmission of IP datagrams over avian carriers. RFC 2549 [RFC2549] extended this work with Quality of Service provisions, and RFC 6214 [RFC6214] adapted the protocol for IPv6.¶
In the intervening years, a new class of network participant has emerged: the autonomous AI agent. These systems decompose complex tasks, delegate sub-tasks to other agents, and synthesize results across potentially long chains of inference. [BEYER-ARCH] defines an architectural model for human-anchored agent identity, introducing a human identity root, explicit delegation semantics, and a provenance structure for accountable agent ecosystems across existing transport mechanisms.¶
It has not escaped the attention of the author that avian carriers remain the only transport medium for which the RFC series has provided comprehensive Quality of Service guidance while leaving identity and provenance entirely unaddressed. This document extends the delegation chain model and provenance structure of [BEYER-ARCH] to the specific constraints of feather-based transport layers.¶
This document corrects that oversight.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].¶
Additional terminology specific to this document:¶
Prior to dispatch, a sending agent MUST generate a Provenance Token and attach it to the Carrier's leg band. The token encodes the full delegation chain, including the identities of all upstream agents that contributed to the instruction being transmitted.¶
The receiving agent MUST verify the token upon arrival of the Carrier. A token that cannot be verified SHOULD be treated as suspicious. The Carrier itself is presumed innocent.¶
The Provenance Token is a JSON Web Token (JWT) [RFC7519] encoded on archival-grade rice paper and secured with a cryptographic signature using Ed25519 [RFC8032]. The token implements the delegation chain structure defined in Section 3 of [BEYER-ARCH].¶
The token payload MUST include the following fields:¶
The token MUST be rolled tightly and inserted into a waterproof capsule. The capsule MUST be attached to the right leg of the Carrier. The left leg is reserved for legacy IP datagrams per RFC 1149 [RFC1149].¶
In the event that both legs are occupied, the operator MUST acquire an additional Carrier. Operators SHOULD maintain a flock.¶
The Provenance Token implements the delegation chain structure defined in Section 3 of [BEYER-ARCH], serialized as a JWT [RFC7519] on archival-grade rice paper. The following is a non-normative example of a Provenance Token payload:¶
{
"iss": "gpt-like-model-v4",
"iat": 1743465600,
"chain": [
"user-human-brandon",
"orchestrator-agent-v2",
"research-subagent-v1",
"gpt-like-model-v4"
],
"hash": "e3b0c44298fc1c149afb...truncated",
"mood": "caffeinated"
}
Implementations MUST NOT include the model's training data in the token. This would make the capsule unreasonably heavy and is considered an antipattern.¶
For the avoidance of doubt: birds do not hallucinate. They perceive ultraviolet light, navigate by magnetic fields, and have been delivering messages reliably since before the invention of the transistor. Any errors introduced during avian transit are attributable to the message, not the medium.¶
Agents that receive a message via avian carrier and find it implausible are advised to consider that the implausibility may originate from their own context window rather than from the Carrier.¶
The author notes that no avian carrier has ever confidently asserted a false legal citation.¶
Operators MUST be aware that Carriers may be intercepted, observed, or recruited by adversarial parties. A Carrier that arrives unusually late, appears disoriented, or exhibits signs of having been briefed by a competing orchestration framework SHOULD be treated with suspicion.¶
Message contents MUST be encrypted. Adversaries with access to breadcrumbs have demonstrated an ability to incentivize disclosure.¶
The threat model MUST account for raptors. A hawk intercepting an avian carrier constitutes a man-in-the-middle attack of the most literal kind. Operators in regions with high raptor density SHOULD implement carrier authentication via trained recognition patterns.¶
Note: decoy carriers bearing unsigned tokens are a valid mitigation strategy but raise ethical concerns outside the scope of this document.¶
A Carrier that has been dispatched, intercepted, redirected, and re-released with a modified payload represents a replay attack. The iat field in the Provenance Token provides limited protection against this scenario, assuming the attacker has not also modified the timestamp, which they probably have.¶
An agent MUST NOT instruct a Carrier to deliver a message to a receiving agent that will immediately instruct a different Carrier to return an instruction to the original agent. This is the avian equivalent of a fork bomb and is considered unsociable behavior.¶
Flock capacity is finite.¶
This document requests that IANA establish the Avian Identity Registry (AIR), a new registry mapping cryptographic agent identifiers to their corresponding model names, version strings, and known hallucination rates.¶
IANA is further requested to allocate a new Well-Known Leg Band Identifier namespace, distinct from the existing IP datagram leg band namespace established in RFC 1149 [RFC1149], to prevent confusion when both a datagram and an agent provenance token must be attached simultaneously.¶
Finally, IANA is requested to designate a point of contact for reports of Carriers arriving with corrupted, unsigned, or suspiciously confident tokens. The author suggests this contact be reachable by pigeon, for obvious reasons.¶