Security
PIC Profile 0.2 defines centralized PIC-X-mediated authority continuity.
This walkthrough follows one sensitive-document execution from OAuth authority into PIC Token JWT 0, then through two workload-produced candidate transitions.
OAuth authority
|
v
PCA 0
{ read document-42, save }
|
| Worker 1 reads document-42
| remove read authority
v
PCA 1
{ save }
|
| Worker 2 stores the result
| remove save authority
v
PCA 2
{ no execution invariants }
Cryptographic byte values, compact tokens, signatures, hashes, and COSE byte strings below are illustrative. The structure and field semantics follow Profile 0.2.
PIC Profile 0.2 defines centralized PIC-X-mediated authority continuity.
The active profile is:
https://pic-protocol.org/profiles/0.2
This article defines the external PIC Token JWT envelope and the native COSE artifacts used by that profile.
OAuth access token + Initial Continuity Proposal
|
v
PIC-X
|
v
realm-signed PIC PCA COSE 0
|
v
realm-signed settled PIC Continuity COSE 0
|
v
realm-signed PIC Token JWT 0
Non-initial advancement is candidate-based:
PIC-X exposes discovery at two levels: a server control-plane document and a per-realm PIC-X discovery document.
The server is not an issuer. A realm is an isolated trust domain and issuer boundary. Realm discovery publishes issuer-scoped endpoints, keys, token-exchange metadata, and PIC authority and continuity capabilities.
/.well-known/server-configuration
|
+--> realm: acme
|
v
/realms/acme/.well-known/pic-x-configuration
Discovery Model
The server-level document describes the PIC-X instance. The realm-level document describes the issuer clients use for PIC exchange and verification.
PIC-X receives an OAuth access token at the selected realm token endpoint, validates it, and derives the initial PIC Context of Authority, or PCA. A PCA is the logical Context of Authority. Its signed representation is a PIC PCA COSE. PIC-X then returns a realm-signed PIC Token JWT carrying a settled PIC Continuity COSE in pic.root.
PIC-X stands for Provenance Identity Continuity Exchange.
Verifiable Authority Continuity across execution boundaries.
PIC has reached a point where the questions are becoming practical:
How can we use it? How can we test it? What should a real implementation look like?
Answering those questions requires more than specifications. It requires building the components that enable software engineers and architects to experiment with PIC in real systems.
The question. This article examines one narrowly defined security property: whether authority propagated across time and multiple execution boundaries remains verifiably attributable to the concrete execution and request for which it was granted.
The change of question in authority propagation: from actor selection to execution continuity
One scope condition should be kept in mind throughout this article: the following discussion of who concerns only the propagation of authority after initial authentication and authority origination. It addresses what happens when already-established authority is handed off, exchanged, resumed, attenuated, or otherwise continued across a later execution boundary. It does not claim that identity is unnecessary for authentication, initial authorisation, eligibility, accountability, revocation, or other security properties.
AI agent security is usually approached as an identity problem: the question becomes “what is the agent’s identity, and what is it allowed to do?”. This framing is inherited from decades of human-centric and client-centric authorization design, and it works reasonably well as long as the entity being authorized is stable, persistent, and accountable in its own right. AI agents are none of those things in practice, and the framing produces a steady accumulation of edge cases that identity-centric security models keep trying to patch without changing the underlying assumption.
On April 20–21, 2026, the 4th International Workshop on Trends in Digital Identity (TDI 2026) takes place in Verona. The workshop program also includes the talk “Provenance Identity Continuity (PIC): Secure Authority Propagation from Human and Non-Human Origins Across Trust Boundaries”, presented by Nicola Gallo and Antonio Radesca (Nitro Agility Srl).
On March 3, 2026, LF Decentralized Trust hosted the session “From Identity-First to Authority Continuity”, presented by Nicola Gallo.
On March 3, 2026, LF Decentralized Trust hosted the session “Trusted AI Agents by Design: From Trust Ecosystems to Authority Continuity”, presented by Nicola Gallo.