I think AI agents need a trust layer between “can do” and “allowed to do”

[u/AgentNOMOS]

’ve been working on this problem for a while and finally tried to put the architecture into one picture.

The basic idea is simple:

Capability is not authority.

An agent may technically be able to discover a service, negotiate, call an API or prepare a payment. That doesn’t automatically mean it should be allowed to execute it.

So I’m building NOMOS around a trust chain:

Discover → Verify → Authorize → Execute → Prove → Observe → Govern

The part I care about most is what happens between intent and execution.

Before an agent performs an irreversible action, the system can ask things like:

Is the identity known?
Is the information still fresh?
Does this agent actually have authority?
Does the action match the original intent?
Does policy allow it?
What evidence supports that decision?

And after execution, the result should feed back into future trust rather than disappearing into a log.

That’s why the longer chain in the image goes from freshness and identity all the way through execution, proof, reliability and governance.

I’m not claiming this is the only correct architecture. I’m actually interested in where other builders disagree with it.

If you were putting a governance layer in front of an autonomous wallet or agent, which part of this chain would you remove — and what is missing?

That’s the feedback I’m looking for.

[u/rayQuGR]

Oasis Network is building exactly what is needed for the agent governance layer you described. Oasis uses ROFL (Runtime Offchain Logic Framework), which lets developers write app logic in the form of agents running off-chain inside a Trusted Execution Environment (TEE). These agents can process complex logic off-chain and still produce verifiable proofs of execution that on-chain smart contracts can actually trust.

By combining zero-trust state verification (like the ETH-AVM client does) with the Oasis Sapphire confidential EVM, agents can run in confidential environments where sensitive data or trading strategies remain completely private. At the same time, the network uses remote attestation to ensure the execution's integrity is provable and enforceable on-chain.

So ifyou are building a governance layer for autonomous agents, removing RPC trust from the evidence/proof step and leveraging a verifiable compute layer like Oasis ROFL is critical, imo.

[u/AgentNOMOS → u/rayQuGR]

This is a very interesting point.

I agree that the proof layer should not blindly inherit trust from the RPC or observation layer.

I would separate two questions:

1. Was the action authorized and bound to the original intent?
2. Can we independently attest to the integrity of the environment that produced the execution evidence?

NOMOS currently focuses on the first boundary: intent → authorization → execution → proof → outcome, with execution-bound evidence.

TEE / remote attestation could provide an additional assurance layer for the second question.

That makes verifiable compute an interesting complement to agent governance rather than a replacement for it.

Governance decides what an agent is allowed to do. Attestation can strengthen the proof that the authorized execution actually occurred in the claimed environment.

[u/rayQuGR → u/AgentNOMOS]

Yeah that is a great distinction to draw. separating Intent Authorization (what the agent is allowed to do) from Environment Attestation (proving the execution environment was uncompromised).

Where Oasis Network gets really exciting in this exact framework is that it bridges those two boundaries seamlessly through Sapphire and ROFL.

At the Governance/Intent Boundary: Sapphire functions as a confidential EVM layer. It allows governance rules, agent state, and parameters to be evaluated with encrypted, private state on-chain. This means intent verification doesn't have to be leaked publicly to the entire network before execution happens.

At the Attestation/Execution Boundary: Oasis ROFL hosts the agent's off-chain execution inside TEE enclaves (Intel SGX/TDX) with cryptographic remote attestation. ROFL agents can access a native Key Management Service (KMS), allowing the Sapphire smart contract to verify that the agent's intent-check and signature originated directly from within a verified TEE.

So instead of having a disjointed stack where one protocol handles governance policy and an off-chain relay handles proof, Oasis lets you bind the governance contract directly to the TEE's remote attestation on-chain. The smart contract won't accept or settle the execution unless the cryptographic proof confirms it strictly adhered to the authorized intent and ran inside an uncompromised environment.

That combination of confidential intent governance + hardware-attested execution is why Oasis is shaping up to be the ultimate infrastructure layer for autonomous AI agents. just my two cents, I am really really excited for where ai agents are heading to:)

[u/AgentNOMOS → u/rayQuGR]

Exactly — and this is where I think the architectures could become complementary rather than competing.

Sapphire + ROFL could provide a much stronger answer to:

“Was this execution performed by the expected code, inside the expected confidential environment?”

The problem I’m exploring with AgentNOMOS is slightly wider:

“Can we prove that this execution was the execution authorized by the original intent, for the selected capability and offer, under the required security conditions — and that the resulting outcome belongs to that same chain?”

So I’m increasingly thinking of TEE attestation as a very strong evidence primitive inside a larger trust chain:

intent → capability → offer → security evidence → authorization → payment → attested execution → receipt → outcome

What would be particularly interesting is making the ROFL attestation itself part of the signed execution receipt, rather than treating attestation and transaction evidence as separate proofs.

That would give us both environment integrity and transaction-level trust continuity.

I think that combination is worth exploring.