# NostrAgent: A Decentralized Identity and Delegation Architecture for Sovereign Agentic Systems

arXiv: https://arxiv.org/abs/2609.22944 · HTML: https://mlsanity.com/paper/2609.22944/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 10 of its 43 references that are in the map.
- First posted on arXiv 19 Sep 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 10 of 10)

- [SAGA: A Security Architecture for Governing AI Agentic Systems](https://mlsanity.com/paper/2504.21034/) (2025)
- [A Novel Zero-Trust Identity Framework for Agentic AI: Decentralized Authentication and Fine-Grained Access Control](https://mlsanity.com/paper/2505.19301/) (2025)
- [AI Agents with Decentralized Identifiers and Verifiable Credentials](https://mlsanity.com/paper/2511.02841/) (2025)
- [AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A](https://mlsanity.com/paper/2603.24775/) (2026)
- [Towards Multi-Agent Economies: Enhancing the A2A Protocol with Ledger-Anchored Identities and x402 Micropayments for AI Agents](https://mlsanity.com/paper/2507.19550/) (2025)
- [AgentArcEval: An Architecture Evaluation Method for Foundation Model based Agents](https://mlsanity.com/paper/2510.21031/) (2025)
- [Interoperable Architecture for Digital Identity Delegation for AI Agents with Blockchain Integration](https://mlsanity.com/paper/2601.14982/) (2026)
- [Key Event Receipt Infrastructure (KERI)](https://mlsanity.com/paper/1907.02143/) (2019)
- [Sovereign-by-Design A Reference Architecture for AI and Blockchain Enabled Systems](https://mlsanity.com/paper/2602.05486/) (2026)
- [BitSov: A Composable Bitcoin-Native Architecture for Sovereign Internet Infrastructure](https://mlsanity.com/paper/2603.28727/) (2026)

## Abstract (arXiv)

Autonomous AI agents increasingly act across organizational boundaries on behalf of human operators: they invoke third-party services, delegate subtasks to other agents, and pay for metered resources. Deploying such agents safely requires five capabilities that today live in separate systems: persistent identity, scoped delegation, peer trust, discovery, and payment. Existing approaches root these in centralized authorities or cover only subsets, so authority, trust, and payment fracture exactly where autonomy needs continuity: when a key rotates or a delegation must be revoked. We present NostrAgent, a decentralized architecture that unifies all five over Nostr relays using three custom event kinds: Kind 38100 identity declarations authenticated by BIP340 Schnorr signatures with pre-rotation commitments, Kind 38101 scoped delegation chains whose every hop verifiably narrows granted capabilities, and Kind 38102 peer attestations forming a Sybil-deterrent trust graph, with Lightning HTTP 402 (L402) binding payment to agent identity. Identity remains operator-sovereign without any registration authority; relays are substitutable transport rather than a trust root; and every authorization decision is replayable offline from signed events. We evaluate a Python prototype with a mixed-method design: ATAM quality analysis with a two-round mini-Delphi panel, STRIDE threat modeling across three trust boundaries, eleven benchmarks with non-parametric statistics, and 19 failure modes. Results show sub-millisecond offline verification, linear delegation-chain scaling, and Lightning-settled L402 at 157 ms median on regtest. 17 of 19 failure modes pass empirically, one is bounded analytically, and one is disclosed as an architectural limitation. NostrAgent demonstrates an auditable prototype substrate for trustworthy agentic systems without centralized trust roots.