Spherity Research Paper

Beyond Single-Enterprise ZTA: Multi-Trust Architectures for Authorised Agentic Actors in Open, Cross-Domain Ecosystems

Extending Zero Trust with M-Trust, Business Wallets and verifiable authority for cross-domain agentic networks

Author

Dr. Carsten Stöcker

Affiliation

Dr. Carsten Stöcker — Spherity GmbH

Published

2026-09-16

Updated

2026-09-16

Research cut-off

2026-09-16 · Sources, standards and market developments reviewed to this date

This version

https://spherity.github.io/spherity-research/beyond-zero-trust-m-trust-authorised-agentic-actors.html

Latest version

https://spherity.github.io/spherity-research/beyond-zero-trust-m-trust-authorised-agentic-actors.html

Share ↗

Browse this paper

Beyond single-enterprise Zero Trust Architecture

NIST SP 800-207 moves security away from implicit trust based on network location and focuses authorization on users, devices, assets and resources. That remains the foundation: every request must be evaluated, least privilege enforced and runtime state monitored.

The problem changes when an agent crosses organizational boundaries. A relying party may recognize the agent’s workload identity and still lack answers to the questions that determine accountable action:

• Which natural or legal person is responsible?
• Who delegated authority, through which representation chain?
• What purpose, value limit, tools, data and time window does the mandate cover?
• Which version and assurance state of the AI service is acting?
• Which source-domain credentials and evidence are current?
• Which local policy allowed execution, and what receipt preserves the decision?

The paper’s central proposition is therefore:

Trusted agentic execution requires verifiable authority + verifiable evidence + local policy enforcement + bounded autonomy.

This is not a replacement for Zero Trust. It is a cross-domain extension that carries attributable authority and evidence into the resource decision.

B2C and B2B authority: a shared pattern with different legal roots

Consumer agents and enterprise agents both need scoped delegation, but they do not present equivalent identity or governance evidence.

Google AP2, Mastercard Verifiable Intent, Visa Trusted Agent Protocol, Amazon Buy for Me and Apple App Intents/StoreKit illustrate different B2C mechanisms. They do not form one uniform protocol or legal regime. The paper uses verifiable intent as an analytical category for evidence that links a person’s instruction to an agent and resulting action; applicable law determines legal effect.

For B2B and B2G, a technical agent identity proves which workload controls a key. It does not prove which company stands behind the workload or whether the company authorized this action. That gap motivates reusable organizational identity, representation and mandate credentials.

The three M-Trust dimensions—and how Spherity operationalises them

The GSMA Greater China draft proposes M-Trust as an extension of Zero Trust for autonomous, multi-party and cross-domain environments. Its contribution is a systems model, while the Spherity research asks which legal, credential, wallet, registry and evidence components are needed for cross-company execution.

The lower loop in Figure 1 is continuous: collect and evaluate identity, authority, evidence and risk; compute effective scope under local policy; enforce the bounded action outside the agent’s own reasoning; and feed back status, drift, incidents and outcomes. New threat intelligence, a revoked credential, an updated model risk profile or a runtime anomaly can therefore change the decision state during a task.

Use cases for authorised agentic actors

The paper tests the architecture across telecom, commerce, industrial and regulated-data contexts.

1. Cross-domain telecom resources. An agent requests scheduling, bandwidth, encryption or monitoring across operators. A human or legal-person credential, agent identity and task mandate establish authority; local operators still enforce their own policy.
2. Temporary multi-agent teams. Agents from several domains form a short-lived team for access, security or demand coordination. Portable credentials create transient trust, and permissions are reclaimed when the task ends.
3. Cross-operator high-definition services. A workflow narrows authority as it advances from scheduling to resource use, producing signed evidence at material steps.
4. Roaming vehicle and mobile agents. SIM/eSIM, hardware roots and workload identity establish technical provenance; organizational credentials establish accountable legal authority.
5. B2C agentic commerce. A natural person’s authenticated, scoped instruction is bound to an agent, cart or payment action and receipt, subject to applicable consumer and payment law.
6. Energy and industrial data spaces. A Business Wallet presents company and market-role credentials, while a connector evaluates purpose, mandate and data-use policy before releasing BESS, grid or supply-chain data.
7. Digital Product Passports. An enterprise agent retrieves or updates product evidence only when both product-linked facts and organizational authority are verifiable.
8. Trusted AI and Physical AI. A relying party checks the agent’s mandate, AI Service Passport, TEVV and runtime evidence before a gateway permits a bounded digital or cyber-physical action.

Comparative results: convergence without a single regional standard

The reviewed sources converge on recurring control patterns but emphasize different layers. The comparison does not claim regional consensus or equivalent maturity.

Standards requirements and verifiable trust chains

The target architecture does not rely on one technology or ledger. It requires interoperable primitive classes with clear governance:

• Identity and credentials: W3C DID Core, W3C Verifiable Credentials Data Model 2.0, governed issuer discovery, semantic profiles, current status and revocation.
• Cross-domain exchange: Data Spaces Support Centre guidance, the Dataspace Protocol and Decentralized Claims Protocol, with connector-side policy and contractual governance.
• Organizational authority: authoritative company registers, European Business Wallet or equivalent organizational-wallet profiles, vLEI for complementary global entity and role interoperability, and task-bounded Powers of Attorney.
• AI assurance: AI Service Passport, TEVV evidence, model or agent version, intended use, incidents, monitoring and runtime status.
• Cryptographic resilience: crypto-agility across issuers, wallets, verifiers, DIDs, status services, registries, channels and archived evidence; post-quantum migration profiles must be agreed and tested rather than inferred from the M-Trust draft.
• Accountability: signed action receipts containing evidence references, policy version, status snapshot, execution result and timestamp.

The paper expresses the trust chain as:

authoritative source → legal person → authorised representative → agent or workload → task mandate → verifier policy → controlled action → signed receipt

Each arrow must be independently checkable, current and semantically understood by the relying party. A signature proves integrity and control of a key; it does not alone prove legal identity, authority, compliance or fitness for purpose.

Business Wallets, organizational identity and verifiable authority

The proposed B2B model separates four questions that are often collapsed:

1. Who is the organization? A Legal-Person Identity (LPID) credential is rooted in an authoritative company register or an accepted cross-jurisdiction identity framework.
2. Who may delegate? A representative, role or governed system must have current authority under the organization’s rules and applicable law.
3. What may the agent do? A task-bounded Power of Attorney or capability specifies purpose, resource, tool, value, time, geography, delegation depth and termination conditions.
4. What evidence supports execution now? The verifier evaluates AI Service Passport, TEVV, runtime, product, data-space and transaction evidence under its own policy.

A Business Wallet can carry organizational identity and governed credentials. An Agent Wallet or workload identity can hold the task capability and present the required evidence. The relying verifier resolves issuer and credential status and computes the effective permission as the intersection of all applicable limits. This preserves verifier sovereignty: no wallet, credential or external agent decides access on behalf of the relying domain.

Applications in Data Spaces, Digital Product Passports and Trusted AI

The architecture is reusable because the legal-person root and delegation chain can stay stable while sector evidence remains under its own governance.

• Data Spaces: company identity, membership, sector roles and contract-policy evidence feed connector decisions. The source domain controls its credentials; the recipient controls authorization.
• Digital Product Passports and Battery Passports: product identifiers, provenance, lifecycle claims, SBOM/VEX and conformity evidence form the data plane. Legal-person identity, mandate and access policy form the control plane.
• Manufacturing-X: federated Identity & Trust, data-space connectors and industry rulebooks provide an implementation environment for enterprise-agent authorization and evidence exchange.
• Trusted AI: LPID → PoA → AISP connects accountable organization, authority to act and AI-service assurance. Runtime status, incidents, drift and action receipts keep the decision current and reconstructable.
• Critical infrastructure and Physical AI: the enforcement point remains external to the agent and applies the smallest permitted capability. Safety, operational and regulatory controls remain authoritative in their own domains.

Reference Architecture for Verifiable Agentic Networks

The proposed architecture contains eight layers. Each answers a distinct trust question and supplies inputs to the decision and enforcement loop.

An end-to-end transaction follows seven steps: the agent proposes a specific action; the gateway requests authority and assurance evidence; the Agent Wallet presents identity and mandate; the verifier resolves issuers, status, semantics and evidence references; policy computes effective authority and transient trust; the enforcement point executes only the bounded capability; and the gateway produces a signed receipt and updates continuous monitoring.

The architecture’s scope is deliberately bounded. It is a design and standards proposal, not evidence of production performance, legal qualification, interoperability or political coordination. Those claims require profiles, reference implementations, conformance results and pilots across jurisdictions.

Research method, evidence boundary and Google Trends

The paper uses a qualitative architecture and standards-gap analysis. It distinguishes documented design, architectural inference and normative proposal. The English- and Chinese-language M-Trust drafts were compared for identity, credential, ledger, classical-cryptography and post-quantum content; comparative sources were reviewed for B2C intent, enterprise agent security, European wallet identity, industrial data-space governance and cross-jurisdiction organizational authority.

Google Trends was reviewed on 16 September 2026 as an editorial input. Worldwide and German Web Search comparisons showed the strongest relative interest around AI agents, AI agent security, agentic AI and zero trust. M-Trust and verifiable authority had insufficient or very low reported interest. The page therefore uses the higher-demand language for discovery while retaining the specialist terms because they precisely name the paper’s contribution. Google Trends values are normalized relative-interest signals, not absolute search volumes or evidence of market size.

Selected primary references

1. Rose, S.; Borchert, O.; Mitchell, S.; Connelly, S. (2020). NIST SP 800-207: Zero Trust Architecture. National Institute of Standards and Technology.
2. GSMA Greater China (2026). Trust Paradigm Evolution for Agentic Networks — Draft for Comments. English- and Chinese-language drafts reviewed.
3. García-Herrero, A.; Storella, T. (2026). “China’s artificial intelligence goals and strategic choices for Europe”. Bruegel, 10 September 2026.
4. GSMA Greater China (2026). The Value of Mobile AI. Chinese-language white paper.
5. Anthropic (2026). “Zero Trust for AI Agents: A Security Framework for Deploying Autonomous AI Agents in the Enterprise”, 27 May 2026.
6. Magård, D.; Busch, P.; Hannemann, D.; Scalongne, W.; Fjelkner, B.; Parikh, S.; Stöcker, C.; Bailly, L. (2026). Trusted Identities for AI Agents: An Opportunity for Europe. WE BUILD non-paper, 27 February 2026.
7. Plattform Industrie 4.0 (2026). Manufacturing-X Framework. Federal Ministry for Economic Affairs and Energy.
8. GLEIF and contributing authors (2026). Agentic AI in Payments: Establishing Interoperable Trust and Control. Working Paper Series, version 1.0.
9. W3C (2022). Decentralized Identifiers (DIDs) v1.0.
10. W3C (2025). Verifiable Credentials Data Model v2.0.

The PDF contains the complete 52-source bibliography, including post-quantum standards, EBSI and eIDAS ledger provisions, Dataspace Protocol and Decentralized Claims Protocol, B2C payment and commerce initiatives, Catena-X, European Business Wallet sources and related Spherity Research.

How to cite this work

Stöcker, Carsten (2026). “Beyond Single-Enterprise ZTA: Multi-Trust Architectures for Authorised Agentic Actors in Open, Cross-Domain Ecosystems.” Spherity GmbH. https://spherity.github.io/spherity-research/beyond-zero-trust-m-trust-authorised-agentic-actors.html. Licensed CC BY 4.0.

Open research

License and citation

This open research publication package—including the research page, linked PDF and Spherity reference figure— is licensed by its named author under the Creative Commons Attribution 4.0 International License (CC BY 4.0). Reuse must credit every named author, link to this canonical version and the license, and indicate whether changes were made.

How to cite this work

Dr. Carsten Stöcker (2026-09-16). “Beyond Single-Enterprise ZTA: Multi-Trust Architectures for Authorised Agentic Actors in Open, Cross-Domain Ecosystems: Extending Zero Trust with M-Trust, Business Wallets and verifiable authority for cross-domain agentic networks.” Spherity GmbH. https://spherity.github.io/spherity-research/beyond-zero-trust-m-trust-authorised-agentic-actors.html. Licensed CC BY 4.0.

Copy citation