| Internet-Draft | Live Reference Resolution | October 2026 |
| Morrison | Expires 12 April 2027 | [Page] |
A recurring class of autonomous-agent failure arises when an agent acts on a belief read from a cached, derived, or proxy copy that has silently diverged from the authority the belief claims to represent. This document describes a reference-resolution discipline for the working beliefs an agent reasons and acts from. Each belief is held as a reference to a single named lowest authority and is resolved live at the point of use, with verification. When the authority is unobservable or the resolved value is stale, the belief takes an explicit uncertainty state rather than a prior cached value; that state propagates to any belief derived from it, and an uncertain belief feeding a costly or irreversible act blocks or escalates rather than proceeding. Every resolution chain terminates in a single self-authorising root. The document is Informational. It records a discipline and a vocabulary; it does not define a wire protocol.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 12 April 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document.¶
An autonomous agent holds many working beliefs: the current value of a configuration item, which record is authoritative, whether a code path is still live, what the present state of a shared resource is. A wide class of agent errors has one shape. The agent reads such a belief from a copy that once matched an authority but has since diverged, and acts on the copy as though it were the authority. Common instances include a stale index read in place of the canonical registry, an ambient assumption carried across calls, a retained but superseded code path treated as current, and a narrative document trusted for a value that a live system owns. Point-in-time identity checks have the same shape: a confirmation made at one moment is relied on until the next, with nothing known about the interval in between (Section 3.1 of [MORRISON-IFT]).¶
Existing mechanisms address adjacent concerns. Capability systems govern the authority to act. Content-addressing and transparency logs govern the naming and integrity of data and artefacts. Message-signature schemes such as [RFC9421] bind a request to a key. None of these govern the working beliefs an agent reasons from, and none defines what an agent should do when the authority for a belief cannot be observed at the moment the belief is needed.¶
This document describes a discipline for that layer. It concerns the resolution of a belief against its authority, the handling of staleness, and the termination of resolution chains. It does not describe how any particular authority is implemented, how capabilities or credentials are provisioned, or how conflicting assertions from multiple agents are arbitrated.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
A value on which an agent will act.¶
The single named source that owns the current value of a belief. An authority is the lowest source in a precedence order that can answer for the belief: for a live value, a running system rather than a document describing it.¶
A stable identifier for a belief together with the name of its authority, held in place of a stored value.¶
The act of dereferencing a reference against its named authority to obtain a current value, at the point of use.¶
The moment, contemporaneous with the act that consumes a belief, at which resolution occurs. Resolution performed earlier and cached is not resolution at the point of use.¶
An explicit value a belief takes when its authority is unobservable, its resolved value fails verification, or a freshness bound is exceeded.¶
A self-authorising source that answers for itself, such as a cryptographic key or a ratified decision record, in which a resolution chain terminates.¶
An agent SHOULD hold a belief on which it will act as a reference rather than a stored value. The reference names the belief and its single lowest authority. Holding the belief as a reference is what makes live resolution possible; a value copied into the agent's state carries no way to detect that the authority has since changed.¶
An agent SHOULD resolve a reference at the point of use, contemporaneously with the act that consumes the belief, by dereferencing the named authority to obtain a current value and verifying that value against the authority. A cached, derived, or proxy copy of the belief SHOULD NOT stand in for a live dereference of the named authority at the point of an act.¶
Where an authority is expensive to dereference on every use, an agent MAY apply a bounded exemption only when all of the following hold: the belief follows from an observed fact under current semantics, the cost of being wrong is small and readily reversible, and either a fail-closed check catches the wrong case or the belief decays at a boundary served by a live change-detection channel. A belief feeding a costly, irreversible, or externally visible act MUST NOT be exempted and MUST be re-resolved against its authority at the point of use.¶
When the named authority is unobservable, the resolved value fails verification, or a declared freshness bound is exceeded, the belief MUST take the explicit uncertainty state rather than a prior cached value. Freshness MAY be expressed per authority as a maximum staleness interval or a monotonically-advancing epoch, and crossing the bound triggers the uncertainty state without requiring an affirmative invalidation message from the authority.¶
The uncertainty state is a value that a belief carries. It is neither the absence of a value nor a low numeric confidence attached to an asserted value.¶
The uncertainty state is contagious. An agent MUST propagate it to every belief derived, in whole or in part, from an uncertain belief, so that the state is carried across the agent's belief graph rather than terminating at the belief that first became uncertain. Two warranted beliefs that resolve to contradictory values cancel to the uncertainty state, which requires re-resolution or escalation; they are not reconciled by a precedence pick.¶
Uncertainty is default-closed at the point of consumption. When an uncertain belief is an input to an act classified as costly or irreversible, the agent MUST block the act or escalate for resolution rather than proceed on the uncertain belief. The classification of an act as costly or irreversible is itself a belief resolved under this discipline. The obligation applies to the conjunction of several uncertain inputs, so that two or more individually marginal uncertainties compound into the obligation to block.¶
Without this contract, marking a belief uncertain would only move the problem downstream.¶
Every resolution chain MUST terminate in exactly one constitutive root, a self-authorising source drawn from a closed set such as a cryptographic key or a ratified decision record. A constitutive root answers for itself and fails closed; it is conferred from outside the belief graph rather than being another belief inside it. Before an act, an agent SHOULD reject a reference whose resolution chain is circular or fails to terminate in such a root, and SHOULD record which reference was rejected.¶
A ratified decision that supersedes an implementation outranks a retained but unmarked instance of that implementation. A belief in the liveness of the superseded implementation takes the uncertainty state until the implementation is removed or carries a machine-readable supersession marker.¶
An agent that exposes belief resolution to other components SHOULD return, with the value and atomically bound to it, at least: the identifier of the authority that answered, a freshness indicator, and a provenance type. Because these are bound to the value, a consumer cannot obtain the value without them.¶
A provenance type is drawn from a closed set. This document does not define the set normatively, but distinguishing at least a direct read of an authority, a presumption, and an unverified inference is RECOMMENDED. A value carrying a presumption or an unverified-inference provenance type MUST NOT be relabelled as a direct read by any downstream consumer.¶
This discipline concerns beliefs, not the authority to act, and so complements capability and delegation systems. It concerns live resolution and staleness, not the integrity of static artefacts, and so composes with content-addressing and transparency logs. The provenance types of Section 6 and the closed substrate-class labels of [SUBPROV] both keep an unverified inference distinct from a direct read, the first for an agent's working beliefs and the second for assertions in model output. [SUBSTRATEOBS] applies the same preference for observing a live source over a declared copy to coordination between concurrent sessions. Arbitration among several already-emitted and conflicting assertions, and the provisioning of capabilities or credentials, are out of scope for this document.¶
The discipline relocates trust rather than removing it. An agent following this discipline trusts its authorities and the freshness bounds it declares for them. The gains are that the trust is placed in a single named source per belief, that the source is re-checked at the point of use, and that failure to observe the source degrades to an explicit blocking state rather than to silent use of a stale value. An implementation that declares over-generous freshness bounds, or that permits a lower-precedence source to answer for a belief, weakens these gains.¶
Constitutive roots are the base of trust. Compromise of a cryptographic key or subversion of the process that ratifies a decision record compromises every belief whose chain terminates in that root. Roots therefore warrant the protections appropriate to keying material and to governance records.¶
The uncertainty state is a denial surface. An adversary who can make an authority unobservable can drive dependent beliefs to uncertainty and thereby block costly acts. This is a fail-closed outcome and is preferable to silent action on stale values, but implementers should ensure that the escalation path for a blocked act cannot itself be starved.¶
This document has no IANA actions.¶
draft-morrison-live-reference-resolution-01 (October 2026):¶
Corrects the title of [SUBSTRATEOBS], and credits the provenance labels in Section 7 to [SUBPROV], which defines them.¶
Adds [MORRISON-IFT] to Section 1 as a further instance of the failure this document addresses.¶
Removes commentary on the document's own purpose from Section 1 and Section 4.3.¶
Shortens prose in Section 4, Section 5, Section 6 and Section 7. No requirement changes.¶
This discipline was distilled from operational failure patterns observed in autonomous coding agents.¶