Authority Continuity
Economics has studied agency under asymmetric information for more than fifty years. Stephen Ross gave an early formal treatment of the principal-agent problem in 1973. Jensen and Meckling’s 1976 paper defined agency costs and integrated agency theory with property rights and finance to analyze ownership structure. Holmström, Grossman, Hart, Moore, Tirole and many others subsequently developed major parts of contract and organization theory. Work in this broader tradition later received Nobel recognition, including the 2016 prize to Oliver Hart and Bengt Holmström for contributions to contract theory.
PIC-X exposes discovery at two levels: a server control-plane document and a per-realm PIC-X discovery document.
The server is not an issuer. A realm is an isolated trust domain and issuer boundary. Realm discovery publishes issuer-scoped endpoints, keys, token-exchange metadata, and PIC authority and continuity capabilities.
/.well-known/server-configuration
|
+--> realm: acme
|
v
/realms/acme/.well-known/pic-x-configuration
Discovery Model
The server-level document describes the PIC-X instance. The realm-level document describes the issuer clients use for PIC exchange and verification.
PIC-X receives an OAuth access token at the selected realm token endpoint, validates it, and derives the initial PIC Context of Authority, or PCA. A PCA is the logical Context of Authority. Its signed representation is a PIC PCA COSE. PIC-X then returns a realm-signed PIC Token JWT carrying a settled PIC Continuity COSE in pic.root.
PIC-X stands for Provenance Identity Continuity Exchange.
Verifiable Authority Continuity across execution boundaries.
PIC has reached a point where the questions are becoming practical:
How can we use it? How can we test it? What should a real implementation look like?
Answering those questions requires more than specifications. It requires building the components that enable software engineers and architects to experiment with PIC in real systems.
The question. This article examines one narrowly defined security property: whether authority propagated across time and multiple execution boundaries remains verifiably attributable to the concrete execution and request for which it was granted.
The change of question in authority propagation: from actor selection to execution continuity
One scope condition should be kept in mind throughout this article: the following discussion of who concerns only the propagation of authority after initial authentication and authority origination. It addresses what happens when already-established authority is handed off, exchanged, resumed, attenuated, or otherwise continued across a later execution boundary. It does not claim that identity is unnecessary for authentication, initial authorisation, eligibility, accountability, revocation, or other security properties.
AI agent security is usually approached as an identity problem: the question becomes “what is the agent’s identity, and what is it allowed to do?”. This framing is inherited from decades of human-centric and client-centric authorization design, and it works reasonably well as long as the entity being authorized is stable, persistent, and accountable in its own right. AI agents are none of those things in practice, and the framing produces a steady accumulation of edge cases that identity-centric security models keep trying to patch without changing the underlying assumption.