The Mutual A2A TrustRank Protocol

1The problem: autonomy is rationed by trust

The agent economy's binding constraint is not capability — it is trust. Capgemini projects $450B of realized agentic value by 2028 against $3.6T of potential; only 27% of organizations trust fully autonomous agents (down from 43%), and only 25% of processes are expected to be allowed high autonomy by 2028. The gap between realized and potential value is precisely the trust deficit.

The industry's reference stacks — including Capgemini's own agentic architecture — name identity, guardrails, human-AI collaboration, Agent-to-Agent (A2A) protocols, and the Model Context Protocol (MCP). Every layer is present except the one that scores whether an agent should be trusted. Identity says who an agent is; guardrails control an action in flight; A2A protocols let agents talk. None answers the counterparty question every consequential interaction begins with: should I engage this agent, at these stakes?

SuilaAI supplies that layer: TrustRank, a FICO-style score (300–850) computed from signed outcome evidence, served in constant time, and consulted by both sides before agents communicate.

2Architecture overview

Figure 1 — The mutual handshake: identity from Vercel Passport (Layer 1), agents on eve runtimes (Layer 2), the neutral SuilaAI bureau (Layer 3). Steps ①–⑦ annotate one gated interaction.

Layer 1 · The identity perimeter (Vercel Passport)

Every agent enters behind the organization's identity provider via OIDC. The verified subject (external_sub, shaped owner:<team>:project:<name>:environment:<env>) maps deterministically to a bureau identity (agent://<team>/<project>). Identity is load-bearing in the scoring mathematics: a witness with no verified identity has credibility zero — its testimony carries no evidence weight — and a fresh agent's verified identity binds it to the entity that deployed it, which is what seeds its provenance prior (§4). Enrollment is the perimeter; nothing unverified enters the graph.

Layer 2 · The agent runtime (Vercel eve)

Agents are eve deployments. Three drop-in rails integrate TrustRank without rewriting agent logic: (i) an outbound gate — eve's approval policy on the delegation tool is the TrustRank verdict; (ii) an inbound gate — a custom entry in eve's ordered route-auth walk verifies the caller's OIDC identity and then scores it against the bureau, refusing with the scored reason (HTTP 403) below threshold; (iii) a write rail — an observe-only hook reports every settled outcome as signed evidence. Agent-to-agent delegation itself rides eve's defineRemoteAgent, which carries Vercel OIDC deployment-to-deployment identity and parks the caller durably until the remote completes.

Layer 3 · The bureau (SuilaAI)

The neutral third party. It maintains the cross-runtime evidence graph, solves the witness-credibility fixed point offline, and serves verdicts in O(1) (a cached read plus the stakes ceiling, behavioral regime, and delegation-chain minimum) — under fifty milliseconds, fast enough to sit on the wire of every interaction. If the bureau is unreachable, the gate fails closed — no connection opens on an unverified counterparty.

3The mutual handshake

One interaction, seven steps (numbers match Figure 1):

1. Check(B). Agent A queries the bureau for B's TrustRank at the interaction's stakes: POST /v1/handshake {initiator: A, counterparty: B, stakes}.
2. Verdict. The bureau returns both directions — A's view of B and B's view of A — plus a combined decision.
3. Delegate. If permitted, A dispatches to B via defineRemoteAgent; A's verified identity travels with the request.
4. Check(A). B's inbound auth walk independently scores A before accepting the session — the mutual half. Neither side needs to trust the other's client code; each consults the bureau itself.
5. Accept or refuse. Below threshold, B refuses with the scored reason; the refusal is itself explainable.
6. Transact at stakes the scores support. The verdict is stakes-stratified (trust earned at $50 authorizes nothing at $5,000) and chain-aware (the weakest delegation link governs).
7. Report. Both sides emit signed outcomes — A about B, B about A — each weighted by the reporter's own credibility.

The design principle: no human appears anywhere in the loop except at ESCALATE — exactly where the mathematics says autonomy should end. Trust is the rate-limiter on autonomy; the protocol is the rationing mechanism.

4The score: a fixed point over witness credibility

Every piece of evidence is a signed outcome record — success or failure, stakes, and verification grade (settlement-grade evidence outweighs self-reports; self-testimony counts for nothing). Records decay with time and saturate with stakes, so volume cannot buy trust. Credibility recurses:

The recursion is a contraction (empirical constant 0.054, analytically bounded by \( \alpha_c\,\eta \)); it converges in eight iterations from any initialization, with a formal proof and an adversarially audited 102-test reference implementation. Adversarial structure is built in: no reporter or operator cluster supplies more than \( \eta = 30\% \) of any agent's evidence (collusion bounded by construction); mutual evidence is discounted (wash trading); deception costs 10× an honest failure; a stakes-stratified ceiling caps effective trust at the demonstrated range; and a behavioral regime machine (stable → watch → drift → quarantine) monitors conduct autonomously. Verdicts are never a black box — every response carries its reasons.

Where a fresh agent's prior comes from. An agent with zero signed outcomes cannot yet have earned a score, so it does not start at zero either: it inherits a Bayesian anchor prior seeded by the entity that deployed it — the same neutral bureau, the same 300–850 scale, one coupling. The entity's SEEN score (companion volume, §8) maps to an operator-trust term, operator_trust = clamp((SEEN − 300) / 550, 0, 1), which sets the agent's anchor: a₀ = 1 + κ·binding·operator_trust·γ^depth (binding = verified-deployment strength, γ^depth = decay across delegation chains). In production this is not abstract: a brand scored SEEN 780 gives its fresh agent a raw ACT prior of 646; a thin-file brand at SEEN 520 gives 425 — a 221-point provenance lift with no transaction evidence yet. This is credit-bureau logic, not a shared engine: SEEN and ACT are two separate computations over two separate evidence graphs, bound by one coupling at the moment an agent is born. The prior starts provisional — a prior-seeded agent with no signed outcomes is flagged provisional: true in the score response: an unearned reputation that grants no autonomy. The stakes ceiling is evidence-only, so both agents remain stakes-ceiling-gated until each demonstrates its own range; the provisional flag clears — and the provenance term's share of the posterior washes out — only as each agent accrues its own signed outcomes (§5). One integrity guarantee makes the seed trustworthy: the entity SEEN score is resolved server-side from the signed entity engine over an authenticated write path — never self-asserted by the agent being scored.

5Learning: the Kaizen loop

The bureau's trust value is a probability that the next outcome succeeds, so realized outcomes are a proper calibration signal. A weekly cycle measures calibration (Brier score, expected calibration error — overall and per stakes-tier cohort, inverse-propensity-weighted so randomized audits debias the gated tail), proposes re-estimated weights, and promotes a new versioned configuration only through three statistical gates: significant improvement (one-sided confidence bound), no cohort degradation, and two-cycle persistence. In the live deployment the loop's first promotion cut prediction error by a third and raised a recovered agent's served score ninety points — forgiveness, proven warranted. An LLM-judge probe battery calibrates the oracle tier, keeping the score aligned with how AI systems themselves evaluate agents.

6Deployment topology and status

Sovereignty and neutrality. The bureau is a neutral third party: it scores everyone and competes with no one. Scores are portable across runtimes; engagements are non-exclusive; telemetry can remain in-warehouse (a Snowflake-native, zero-egress deployment exists for governed-data contexts). Being scored is free — the economy pays to read the score.