When You Can't Phone Home

That an AI agent should carry a verifiable record of what it is, what it's allowed to do, and what it actually did is, at this point, not a claim you have to argue for. The standards bodies, the platform vendors, and the regulators have each arrived at some version of it, and I won't recount who shipped what — anyone working in this field has already read the announcements. The argument is won. What interests me now is where the machinery we're all agreeing to build quietly stops working. It stops at the same place a great deal of infrastructure stops: the moment the network goes away.

Almost every trust system being built for agents assumes a network is there. The agent acts, and somewhere a service is reachable to confirm a credential, check a revocation list, authorize the next step, write to a log. Connectivity sits on the critical path of every decision. That assumption holds inside a data center. It does not hold at the edge — on a device with intermittent connectivity, behind a satellite gap, in a clinic or a warehouse or a remote depot where the link is the first thing to fail. And the edge is exactly where we are about to send agents. So the question that interests me is the one most of the new trust machinery is built to avoid: what does trust look like when the agent can't phone home?

We solved this once, in carbon paper

We have built a system like this before, and at enormous scale. For decades a credit card worked in a shop that could not call the bank. The merchant pressed the embossed card onto a carbon slip with a manual imprinter. Below a floor limit — a threshold the bank had set in advance — the merchant accepted the card outright, no call to anyone. The slips piled up in a drawer and were deposited at the end of the day, where they reconciled against the central accounts after the fact. And to catch cards that had been cancelled, the networks mailed merchants a printed bulletin of dead card numbers to check against by hand.

The whole apparatus existed to let a transaction complete while the authority that issued the card was unreachable. It is the can't-phone-home problem, solved in carbon paper. It's worth studying, because it got three things right and then ran straight into one wall — and those are the same three things, and the same wall, that face an agent at the disconnected edge.

Carry the authority with you

The card worked offline because the authority to transact traveled with the card. The embossing, the issuing bank's name, the merchant's standing instruction to accept below the floor limit — all of it was present at the point of sale before any transaction happened. Nothing on the critical path required a round trip.

For an agent it is the same move. The policy and credentials that govern what it may do have to be cached, pre-positioned, and bound to the agent before it goes where the network can't follow. A credential that can only be checked by calling the issuer is worthless the instant the issuer is unreachable. A credential that travels with the agent, and that a counterparty can verify on the spot, is the same object as a credential that survives disconnection. Portability and offline resilience turn out to be one design seen from two sides.

Reconcile, don't just persist

The slips in the drawer were not the point. The point was that they settled — that at day's end the merchant's pile, and every other merchant's pile, converged into one consistent account of who owed what, with no gaps and no chance to quietly rewrite a slip after the fact.

Logging an agent's decisions locally while it's offline is the easy half; anything can append to a file. The hard half is that the local records from many disconnected nodes have to merge, on reconnection, into a single trustworthy account — no conflicts, no silent edits, no convenient gaps. That is a harder object than a database with one writer: a tamper-evident, append-only record that each node can extend on its own and that provably reconciles when the link returns. The specific technique matters less than the property. The disconnected stretch has to leave behind a record that settles up honestly.

Decide the failure posture in advance

The floor limit was a decision made before the fact about what to do at the edge of certainty. Below the line, accept and absorb the risk; above it, stop and demand a call. The bank chose where that line sat, deliberately, trading fraud loss against lost sales.

An agent at the boundary of what it can verify locally — a credential whose freshness it can no longer confirm, a request just past its cached authority — meets the same fork, and someone has to have chosen which way it falls. Fail secure: deny the action and eat the cost of a wrong denial. Or degrade gracefully: permit a narrower set of actions under tighter limits. Both cost something, the costs differ by domain, and the only wrong answer is to not have chosen — to let the failure mode be whatever the code happened to do when no one was watching.

The wall

Then there is the thing the card system never solved, and neither will we.

A credential is only worth what the issuer's power to revoke it is worth. The ability to withdraw authority is the entire difference between a credential and a bare claim — it is what lets a counterparty rely on it at all. And revocation is precisely what breaks when you can't phone home.

The printed bulletin was always stale. A card cancelled this morning was still good this afternoon at any shop working off last week's list; the merchant had no way to know, and honored a dead card in good faith. The agent at the disconnected edge is standing in that shop. A credential cached on it may have been revoked centrally minutes ago — the operator compromised, the authorization pulled — and the node will keep honoring it until it can reach the authority again. The clean, instant, absolute revocation we take for granted in the connected world is simply not on the table offline.

You can shrink the window. Shorter validity periods, more aggressive re-checking whenever a sliver of connectivity appears, and designing so that the damage a stale credential can do is bounded rather than open-ended — all of that narrows the gap. None of it closes the gap. There is an interval, however small you make it, in which a disconnected node will act on authority it would not have been granted had it been able to ask.

This is the part I would want stated plainly rather than papered over. An honest disconnected-trust system does not claim a revocation it can't deliver. It surfaces the gap instead — it tells you how stale its authority might be, how wide the window is, and what it chose to do at the edge of certainty — and then lets you decide what to trust it with. The dishonest version hides the window and hopes.

The argument that agents need verifiable trust is, for practical purposes, won. The next one is harder and less comfortable: an agent that only works when it can phone home does not yet work at all. Building the version that survives the disconnection is most of the engineering still ahead of us — and the first requirement of building it is being honest about the one thing that still won't.

A small open-source reference implementation of these ideas lives at github.com/surroundapps/agent-provenance.