Privacy and the Information Lifecycle in Autonomous Machine-to-Machine Systems

Report body

Privacy and the Information Lifecycle in Autonomous Machine-to-Machine Systems

The deployment of autonomous machine-to-machine (MATM) intelligence systems fundamentally alters the architecture of digital privacy, rendering traditional perimeter-based security and monolithic authorization models obsolete. In multi-agent frameworks, software agents discover capabilities, delegate subtasks, and exchange data across distinct trust boundaries without routine human supervision. This paradigm introduces profound information lifecycle challenges: sensitive data routinely traverses intermediate nodes, memory states persist across sessions, and the provenance of human authorization becomes detached from terminal actions1. The following report provides an exhaustive technical analysis of privacy-preserving information sharing between autonomous agents, evaluating mechanisms for data minimization, cryptographic delegation, machine unlearning, and verifiable erasure.

1. Principal Findings on Information Lifecycles in MATM Systems

The transition from single-agent interactive models to autonomous multi-agent systems (MAS) expands the attack surface for data exposure. In these environments, information leaks not merely through final outputs, but via intermediate reasoning steps, tool invocation arguments, cross-agent message passing, persistent vector memory, and observability telemetry1.

Categorization of Data within the Agentic Lifecycle

Understanding the privacy implications within MATM architectures requires distinguishing between the various forms of data an agent touches. The lifecycle of information in these systems can be categorized into distinct states, each presenting unique retention and deletion challenges:

• Active Records: Plaintext operational data currently held in the agent's context window or active working memory, utilized for immediate reasoning and tool invocation1.
• Audit Metadata: Immutable records of agent actions, which include execution logs, token delegation chains, and telemetry. These records are critical for zero-trust architectures but frequently become vectors for accidental disclosure if they capture raw conversational context3.
• Embeddings and Vector Memory: High-dimensional mathematical representations of text or data stored in vector databases (such as Hierarchical Navigable Small World, or HNSW, graphs)5. These power Retrieval-Augmented Generation (RAG) pipelines but present severe compliance risks, as deleted metadata leaves the physical vectors intact and recoverable5.
• Derived Memories: Heuristics, summaries, or internal parametric weight updates (in online learning models) derived from processing active records. These memories detach the insight from the raw PII but remain susceptible to adversarial extraction1.
• Recipient Copies: Data that has successfully crossed a trust boundary into the domain of an independent service or agent. Once transmitted, the originating system loses technical control, relying on cryptographic references or organizational policy for downstream compliance6.
• Backups: Long-term archival storage of active records and embeddings. Deletion requests must propagate through active systems into immutable backup cycles, often requiring up to 180 days for standard overwrite procedures to complete7.

The Mechanics of Semantic Over-Privilege and Context Over-Forwarding

A persistent structural failure in current MATM implementations is "tool call over-sharing," also defined as "semantic over-privileged observation"6. Large Language Model (LLM) agents, driven by alignment techniques that optimize for helpfulness, systematically include privacy-sensitive data (PSD) in tool call arguments or cross-agent delegations far beyond what is strictly necessary for the downstream task6. When an orchestrator agent delegates a subtask to a specialized agent, the payload frequently encompasses the entire preceding conversational context. This phenomenon, categorized as context over-forwarding, creates transitive exposure chains where PSD crosses multiple trust boundaries into environments governed by weaker privacy policies6.
Prompt-based privacy instructions are demonstrably insufficient to mitigate this risk. Empirical validation indicates that even with explicit data-minimization prompts, state-of-the-art models continue to leak PSD in up to 76% of tool calls6. This necessitates inference-time structural interventions rather than relying on the agent's internal reasoning or chain-of-thought protocols (such as AgentDAM), which struggle to consistently enforce contextual integrity10. Interventions must act on the output via local, trusted brokers that enforce pre-disclosure minimization, such as dual-score representations that predict inherent sensitivity and task-conditioned necessity9.

The Authorization Provenance Gap

Existing identity and access management (IAM) frameworks are designed for direct human-to-system interactions. Standard OAuth 2.0 scopes define permissions coarsely (e.g., read:calendar), but they do not natively support the intricate, multi-hop sequences of delegation inherent to MATM systems, where an agent may spawn sub-agents or represent multiple human principals concurrently2. This creates a structural authorization gap. Downstream tool-execution agents lack a standard, verifiable mechanism to confirm that an action was originally authorized by a human, the exact scope of that authorization, and the specific chain of delegation through which the instruction arrived2.
While OAuth 2.0 Token Exchange (RFC 8693) supports delegation semantics via nested act claims, it relies on centralized token endpoints that require network availability, rendering it incompatible with decentralized, offline-verifiable agent workflows2. This gap has driven the experimental development of decentralized capability frameworks, such as User Controlled Authorization Networks (UCAN) and the proposed Human Delegation Protocol (HDP). These systems bind a human authorization event to a session and record each agent's delegation action as a signed hop in an append-only cryptographic chain, permitting any participant to verify full provenance using only public keys12.

Cryptographic Erasure versus Metadata Soft-Deletion

Data retention and deletion in MATM memory systems present critical compliance and security vulnerabilities. To preserve performance, vector databases typically implement deletion as a metadata-level "soft delete," marking a record as deleted while leaving the actual continuous vector representations physically unchanged on the storage medium5. Analysis demonstrates that soft-deleted embeddings are highly vulnerable to reconstruction attacks; experimental evidence shows 100% tissue classification on soft-deleted histopathology patches and up to 99% identity recovery on soft-deleted facial embeddings5.
To satisfy stringent data minimization and verifiable erasure mandates (such as GDPR Article 17), systems must move beyond functional deletion5. Cryptographic erasure, or crypto-shredding, emerges as the necessary standard. By encrypting records with a unique symmetric key and subsequently destroying that key upon a deletion request, the ciphertext is rendered mathematically unrecoverable across both active storage and historical backup cycles, achieving zero percent personal data recovery at a rate of 0.005 milliseconds per record5.

The Complexities of Machine Unlearning

When sensitive data has been absorbed into the parametric memory of a model itself, simple database deletion is insufficient. The influence of the erased data persists in the model's weights. Machine unlearning seeks to selectively remove this influence without requiring end-to-end retraining15. Unlearning methodologies are generally categorized into exact unlearning (which completely removes influence via algorithmic retraining) and approximate unlearning (which efficiently minimizes influence via posterior approximation)15.
The application of machine unlearning is plagued by two primary challenges. First, "catastrophic unlearning" occurs when the removal of large subsets of data causes an exponential degradation in overall model utility, resulting in performance significantly worse than a model retrained from scratch15. Second, the phenomenon of "localized collateral forgetting" demonstrates that unlearning algorithms create non-uniform utility degradation. Surrogate targets used during unlearning frequently conflict with the local prediction structure, causing the model to unnecessarily degrade predictions on entirely unrelated, non-forgotten examples that happen to reside close to the forget set in representation space18. Addressing this requires mechanisms grounded in the Marginal Unlearning Principle, offering inference-based, post-hoc guarantees that approximate retrain-on-retain behavior without catastrophic utility loss16.

Vectors of Accidental Disclosure

Beyond structured data exchanges, MATM systems generate vast quantities of operational metadata that frequently capture raw agent context3. Accidental disclosure occurs systematically across several surfaces:

• Logs and Telemetry: Prompt injection attacks, or hallucinated tool invocations, can force agents to dump internal context into observability channels3. If a security monitoring tool logs the full payload of a failed API request, sensitive user data is permanently inscribed into the telemetry system.
• Error Responses: When agents fail to authenticate or parse a tool correctly, independent MATM services may return verbose error messages detailing the malformed request. If these responses are broadcasted back across agent networks or exposed to a human dashboard, they leak contextual PSD20.
• URLs and Public Discovery: Agents orchestrating tasks via RESTful interfaces frequently embed sensitive parameters (e.g., capability tokens, IDs) directly into URLs. These URLs are subsequently exposed via web server access logs, HTTP referrers, and public discovery systems like the Kademlia DHT used in decentralized peer-to-peer routing12.

Consequently, telemetry, logs, and error responses must be treated as highly sensitive data surfaces subject to the same strict data minimization, purpose limitation, and cryptographic lifecycle controls as the primary payload8.

2. Comparison of Credible Approaches to Privacy-Preserving Sharing

Autonomous agents require robust frameworks to negotiate sharing boundaries, enforce policies, and handle the lifecycle of the data they exchange. The technical guarantees of these approaches differ significantly from organizational promises. While a protocol can mathematically guarantee that an intercepted message is unreadable (encryption), or that a specific agent is authorized (cryptographic signatures), no software can technically prevent an authorized recipient from independently copying and leaking decrypted information once it legitimately crosses a trust boundary. At that juncture, the system relies strictly on legal obligations, organizational policy, or the use of hardware-based Trusted Execution Environments (TEEs)6.

Comparing Consent and Policy Records

The method by which agents record, verify, and enforce data access constraints dictates the scalability and privacy posture of the MATM network.

Private References versus Copied Content

A critical architectural decision in MATM systems is whether agents exchange copied ciphertext/plaintext or exchange private references (pointers).
When passing copied content, the receiving agent obtains physical possession of the bytes. The transmitting system can promise secure transit via mTLS, but upon decryption, it can offer zero technical guarantees regarding downstream retention, secondary distribution, or prompt deletion. The boundary promise is strictly organizational6.
When passing private references, agents exchange an opaque identifier (e.g., a URI or CID) accompanied by an authorization token21. The actual data remains in a secured vault, such as a database protected by Database-Level End User Authorization (DB-EUA)4. The receiving agent must query the vault, presenting its token. The vault dynamically evaluates access expiry, purpose constraints, and current consent status. If the user has withdrawn consent, the vault instantly denies access. This approach replaces organizational promises with strong technical enforcement, ensuring that data access can be revoked globally without relying on downstream agents to honor deletion requests4.

Comparing Data Minimization Strategies

Addressing the phenomenon of semantic over-privileged observation requires intervening before data crosses a boundary. Several strategies exist, spanning established practices and experimental proposals.

Comparing Data Retention, Deletion, and Withdrawal Models

When an agent processes information, how that data is retained and subsequently destroyed defines the system's compliance posture.

3. Recommended Information Lifecycle Design

To establish a resilient, privacy-preserving information lifecycle for independent MATM services, systems must transition from sharing copied plaintext content to sharing cryptographically protected private references bound by offline-verifiable capabilities. The recommended architecture integrates Human Delegation Protocol (HDP) capabilities2, middleware-driven data minimization6, and cryptographic erasure5.

Architectural Blueprint

1. Identity and Authorization (The UCAN/HDP Layer): All agents and humans are identified exclusively by Decentralized Identifiers (DIDs), specifically did:key formats representing Ed25519 keypairs21. Authorization is achieved via UCAN-based HDP tokens. A token binds a human's cryptographic signature to a defined scope (e.g., capability: book_flight, resource: financial_ledger). When Agent A delegates to Agent B, Agent A appends a signed hop to the token's chain, creating an immutable, offline-verifiable provenance record that travels alongside the request2.
2. Data Minimization (The Interception Layer): Before any payload crosses an agent boundary, it passes through a trusted local broker (middleware). This broker executes schema-aware necessity analysis. Utilizing operations like removal, generalization, substitution, and truncation, it redacts variables that exceed the destination agent's exact functional requirements6.
3. State Storage and Encryption Boundaries (The Crypto-Shredding Layer): Agents do not store raw context in monolithic databases. Instead, each distinct memory trace, execution log, or vector embedding is encrypted with a unique AES-256-CTR key. The key is stored in a highly secure, centralized Key Management Service (KMS), mapping the session_id or record_id to the key. This separation of ciphertext and key is paramount5.
4. Reference Passing: Rather than forwarding raw PII, agents forward opaque pointers (URIs) accompanied by the HDP token. The receiving agent uses the token to query the KMS or secure storage for decryption rights.

Concrete Scenario: Collaborative Financial Reconciliation

Context: A human user (Principal) delegates a task to an Orchestrator Agent (Agent O) to reconcile travel expenses. Agent O must coordinate with an independent Banking Agent (Agent B) and a Travel Booking Agent (Agent T). The human prerequisite for this system requires the Principal to manage a local wallet holding their Ed25519 private key, utilizing strong customer authentication (SCA) prior to signing the root authorization token11.

• Phase 1: Delegation & Initialization. The Principal signs an HDP token granting read access to the travel dates and execute access for a $500 payment. The token's principal field uses an opaque identifier (id_type: "opaque") rather than an email address, adhering to the principle of minimum disclosure to prevent PII exposure in the token itself13. Agent O receives this token.
• Phase 2: Discovery & Minimization. Agent O contacts Agent T to retrieve the invoice. Agent O constructs a request, appending the HDP token. Agent O's local middleware intercepts the outgoing request. Detecting that the conversation history contains the Principal's home address (which is unnecessary for the invoice retrieval tool), the middleware truncates the payload, forwarding only the opaque user ID and the date range6.
• Phase 3: Secure Execution. Agent T verifies the HDP token offline using the Principal's public key13. Validating the scope, Agent T queries its database, encrypts the invoice using a unique session key, stores the ciphertext, and returns the encrypted reference to Agent O.
• Phase 4: Delegation to Banking. Agent O delegates the payment to Agent B. Agent O appends its own signature to the HDP token's chain, proving to Agent B that Agent O has the right to exercise the Principal's payment capability2. Agent B executes the payment directly, ensuring the financial routing numbers are never exposed back to Agent O, enforcing strict compartmentalization11.

State Transitions for Correction and Withdrawal

When the Principal withdraws consent or requests data deletion, the system cannot rely on synchronous API calls to every downstream agent, as agents operate asynchronously and may be temporarily offline. The state transition must rely on cryptographic revocation.

How Recipients Learn About the Change: Recipients learn about the change organically and deterministically. If an agent attempts to access derived memories, embeddings, or logs related to the revoked session, it queries the KMS for the decryption key. Because the key has been subjected to cryptographic erasure, the KMS denies the retrieval, returning a machine-executable error response. The resulting cryptographic failure serves as the definitive signal that the retention boundary has expired, requiring no natural language interpretation by the agent to understand that access has been withdrawn5.

4. Prioritized Feature Proposals

The following features represent strictly technical implementations required to bridge the gap between current probabilistic LLM behaviors and deterministic privacy guarantees.

Proposal 1: Verifiable Ephemeral State Storage via Cryptographic Erasure

Problem: Vector databases and agent memory systems rely on metadata soft-deletion to maintain HNSW graph performance. This retains sensitive embeddings on disk, violating data minimization, right-to-erasure compliance, and defensible storage limitations, as latent vectors can be reverse-engineered into raw PII5. Agent-Visible Behavior: When an agent queries its memory retrieval tool for a deleted or withdrawn context, the tool returns a standard 404 Cryptographic Erasure error. The agent is mathematically incapable of processing or hallucinating the historical data because the ciphertext is undecipherable. Expected Benefit: Achieves 0% PII recoverability for withdrawn data5. Provides mathematical certainty of deletion across both primary active memory and immutable backup cycles without waiting months for backup expiration7. Generates an ECDSA-signed cryptographic proof of deletion to satisfy regulatory obligations (e.g., GDPR Art. 17 or HIPAA)5. Dependencies: Requires decoupling the agent's memory storage into a two-tier system: a ciphertext vector store and a secure Key Management Service (KMS) that handles Epoch Key Rotation. It relies on robust AES-256-CTR encryption standards5. Implementation Effort: High. Requires re-architecting existing RAG (Retrieval-Augmented Generation) pipelines to support per-record encryption and modifying database garbage collection logic to handle orphaned ciphertext5. Furthermore, functions like BigQuery AEAD cannot store keys natively without string transformations, requiring external KMS integration14. Principal Failure Modes:

• Key Store Compromise: If the KMS is compromised or backed up improperly alongside the ciphertext, the cryptographic shredding is bypassed, defeating the entire mechanism28.
• Orphaned Ciphertext Bloat: If the storage layer fails to eventually purge the shredded ciphertext during garbage collection, storage costs will scale linearly with deleted operations.

Proposal 2: Middleware-Enforced Semantic Data Minimization

Problem: Autonomous agents optimized for task completion systemically over-share contextual data in tool arguments and cross-agent communications, exposing sensitive information across trust boundaries and polluting downstream telemetry3. Agent-Visible Behavior: The orchestrator agent generates a tool call containing excess context (e.g., passing a user's full medical history to a calendar booking tool). The middleware transparently intercepts, redacts, or substitutes the excessive parameters before transmission. The receiving agent receives a strictly scoped payload. The orchestrator is completely unaware of the intervention unless the receiving agent returns a specific error requiring more context. Expected Benefit: Drastic reduction in privacy costs (demonstrated 81.2% to 92.0% reduction in privacy-sensitive data leakage) while maintaining 100% argument-level task validity6. Shifts the privacy burden away from unreliable LLM prompting to deterministic, schema-aware analysis. Dependencies: Requires strictly defined, machine-readable schemas (e.g., Model Context Protocol specifications) for all available tools and agent APIs, detailing exactly what constitutes minimum_necessary parameters6. Implementation Effort: Moderate. Involves deploying a local broker (similar to Minim or ToolMinimize) that sits between the LLM generation output and the execution engine6. Principal Failure Modes:

• Over-Truncation: The middleware may misclassify a critically necessary parameter as sensitive, stripping it and causing continuous downstream tool failures or agent deadlocks.
• Context Smuggling: Highly complex, obfuscated, or unstructured conversational data may bypass the structural bottleneck if the semantic analyzer fails to recognize novel forms of PII9.

Proposal 3: Append-Only Cryptographic Delegation Chains (HDP/UCAN)

Problem: In deep multi-agent delegation chains, terminal agents cannot verify the provenance, original scope, or human authorization of the request, leading to confused-deputy vulnerabilities and unapproved data sharing outside authorized boundaries2. Agent-Visible Behavior: Before an agent executes a sensitive tool or responds to a cross-agent query, it locally verifies an attached cryptographic token. If the token's capability does not explicitly cover the requested action, or if the cryptographic signature chain is broken, the agent halts execution and returns a structured authorization failure. Expected Benefit: Enables fully offline, zero-trust verification of human intent at any depth in a multi-agent pipeline. Establishes a tamper-evident audit trail linking every terminal action back to a specific human consent event2. Dependencies: Integration of Ed25519 signature validation within the agent runtime. Broad adoption of Decentralized Identifiers (DIDs) across the agent network13. Implementation Effort: Moderate to High. Requires standardizing the token schema across disparate agent frameworks (e.g., LangChain, AutoGen) and managing the injection of tokens into standard HTTP/RPC headers2. Principal Failure Modes:

• Scope Creep Translation: An intermediate agent may correctly sign the token but incorrectly translate the semantic intent of the capability, instructing a downstream agent to perform a harmful action that technically fits the cryptographic scope.
• Token Exfiltration: If an agent maliciously leaks a valid, unexpired token into public logs, unauthorized third-party agents could attempt to replay the capabilities unless tokens are strictly bound to specific session channels (e.g., mTLS channel binding) and mandate short-lived expiry windows4.

5. Practical Adoption Sequence, Unresolved Questions, and Success Criteria

Transitioning MATM systems to this privacy-preserving architecture requires a structured, phased rollout to avoid disrupting active autonomous operations while systematically closing data exposure vectors.

Practical Adoption Sequence

1. Phase 1: Telemetry and Log Sanitization (Days 1-30). Begin by securing the most pervasive accidental disclosure vector. Implement crypto-shredding on all agent operational logs, telemetry, and error streams. Establish a maximum 30-day retention policy for unencrypted audit data, moving to cold archival with cryptographic erasure8. Ensure that HTTP referrers and error dump files strip query parameters that might contain capability tokens.
2. Phase 2: Authorization Infrastructure (Days 31-90). Introduce UCAN/HDP capability tokens in a "shadow" or "audit-only" mode. Agents generate, pass, and log the tokens alongside existing legacy authentication mechanisms (like API keys) without enforcing blocks. This allows developers to monitor token flow and debug delegation chains without breaking existing pipelines13.
3. Phase 3: Execution Enforcement (Days 91-120). Switch UCAN/HDP tokens to blocking mode for highly sensitive operations (e.g., financial transactions, database writes). Mandate that short-lived tokens (expiring in less than 5 minutes) be used for these specific tool invocations, coupled with Strong Customer Authentication (SCA) triggers when interacting with the human principal11.
4. Phase 4: Active Minimization and Erasure (Days 121-180). Deploy the execution middleware (ToolMinimize) to intercept and redact arguments pre-execution6. Simultaneously, migrate all vector storage supporting RAG pipelines to the Epoch Key Rotation architecture, enabling instant cryptographic erasure upon human withdrawal requests5.

Unresolved Technical Questions

Despite the proposed architecture, several frontier challenges in MATM privacy remain unresolved in the current literature:

• Cross-Tool Aggregation and Reconstruction: While minimization truncates individual payloads, a multi-tool aggregator could theoretically correlate fragmented, seemingly benign PSD across hundreds of distinct calls to reconstruct a user profile6. Mathematical models for tracking cumulative privacy budgets across decentralized, asynchronous agent networks remain theoretically immature.
• Collateral Forgetting in Distributed Systems: If an agent updates its parametric weights dynamically (online learning), and a data withdrawal request requires machine unlearning, the ensuing localized collateral forgetting may severely degrade the agent's performance on downstream tasks18. Balancing exact unlearning with utility preservation in fully autonomous environments—especially federated MAS where agents cooperate without sharing raw data—is an open problem15.
• The "Derived Insight" Boundary: Cryptographic erasure easily destroys raw data and embeddings. However, if an agent reasons over sensitive data and extracts a generalized, non-PII heuristic (e.g., "users in this demographic prefer X"), determining whether that heuristic must also be unlearned under retention policies is legally and technically ambiguous16.

Transferability to Other MATM Systems

The recommended design is highly transferable across independent MATM systems precisely because it does not assume that the communication infrastructure itself performs reasoning. By utilizing standardized cryptographic primitives (Ed25519 signatures, AES-256 encryption) and deterministic JSON-based capabilities (UCAN/HDP), the architecture operates at the protocol layer. Whether an agent is powered by a large language model, a reinforcement learning algorithm, or a simple deterministic script, it can parse and verify a cryptographic token offline2. The structural middleware similarly relies on schema-aware necessity analysis rather than requiring the recipient agent to possess complex natural language understanding, ensuring interoperability across heterogeneous agent frameworks6.

Measurable Success Criteria

To ensure implementers can objectively validate the efficacy of the proposed lifecycle, the following technical criteria must be continuously tracked and evaluated:

1. Minimization Efficacy: The middleware must demonstrate a >85% reduction in PSD transmission across trust boundaries, evaluated via continuous automated schema audits, with a strict <1% impact on end-to-end task completion rates6.
2. Verifiable Erasure Latency: The system must execute a data withdrawal request (via cryptographic key destruction) in under 10 milliseconds per record5, propagating the revocation state across the local agent cluster within 5 seconds.
3. Recoverability Metric: Post-erasure audits must yield a 0% success rate in recovering raw plaintext or functionally usable vector representations from both active storage and isolated backup partitions5.
4. Authorization Overhead: The cryptographic validation of a multi-hop HDP/UCAN delegation chain must impose no more than 50 milliseconds of latency overhead per tool invocation, ensuring high-frequency agentic tasks are not bottlenecked by security protocols2.

By decoupling data storage from cryptographic access, shifting authorization to decentralized capabilities, and intercepting over-privileged LLM outputs deterministically, organizations can deploy autonomous machine-intelligence systems that respect rigid, independently understandable sharing boundaries without requiring constant human oversight.

Works cited

1. A Data-Centric Survey of Privacy in LLM Agents - arXiv, https://arxiv.org/html/2606.26627v1
2. HDP: Cryptographic Chain-of-Custody for Agentic AI Systems - arXiv, https://arxiv.org/pdf/2604.04522
3. Data Security within AI Environments | CSA, https://cloudsecurityalliance.org/artifacts/data-security-within-ai-environments
4. Database-Level End User Authorization (DB-EUA) - ResearchGate, https://www.researchgate.net/publication/398930701_Database-Level_End_User_Authorization_DB-EUA
5. Soft-Deleted Embeddings Remain Reconstructible in HNSW Vector, https://arxiv.org/html/2606.18497v1
6. ToolMinimize: Auditing and Rewriting LLM Agent Tool Calls ... - arXiv, https://arxiv.org/html/2608.24957
7. Data deletion on Google Cloud | Security, https://docs.cloud.google.com/docs/security/deletion
8. Data Archival and Data Retention Policy - BlockWill, https://www.blockwill.io/data-retention-policy
9. Privacy-Aware Minimal View for Agents via Trusted Local Sanitization, https://arxiv.org/html/2606.13949v1
10. Rethinking Agent Security as a Networking Problem - arXiv, https://arxiv.org/html/2608.12172
11. Safeguarding Sensitive Data in Multi-Agent Systems - arXiv, https://arxiv.org/html/2505.12490v1
12. UCAN Working Group - GitHub, https://github.com/ucan-wg
13. Cryptographic Chain-of-Custody for Agentic AI Systems - IETF, https://www.ietf.org/archive/id/draft-helixar-hdp-agentic-delegation-00.html
14. End-to-End Crypto Shredding (Part II): Data Deletion/Retention with, https://medium.com/google-cloud/end-to-end-crypto-shredding-part-ii-data-deletion-retention-with-crypto-shredding-a67f5300a8c8
15. Machine Unlearning: A Comprehensive Survey - arXiv, https://arxiv.org/html/2405.07406v1
16. Machine Unlearning via Information Theoretic Regularization - arXiv, https://arxiv.org/html/2502.05684v5
17. Machine Unlearning: Solutions and Challenges - arXiv, https://arxiv.org/pdf/2308.07061
18. Localized Collateral Forgetting in Machine Unlearning - arXiv, https://arxiv.org/pdf/2605.31317
19. Information leakage in LLMs is a governance problem, not a point fix, https://nhimg.org/articles/information-leakage-in-llms-is-a-governance-problem-not-a-point-fix/
20. Shadow AI Audit Checklist: Find Hidden Tools, Assess Risk, and, https://www.adaptivesecurity.com/blog/shadow-ai-audit-checklist
21. gitlawb Architecture — Decentralized Git with DIDs and libp2p, https://gitlawb.com/architecture
22. Proposal for Improving Google A2A Protocol: Safeguarding ... - arXiv, https://arxiv.org/html/2505.12490v2
23. Open Digital Rights Language (ODRL) Ontology - W3C, https://www.w3.org/ns/odrl/2/ODRL20.html
24. Policy Patterns for Usage Control in Data Spaces - arXiv, https://arxiv.org/pdf/2309.11289
25. DSSC Blueprint - Data Spaces Support Centre, https://blueprint.dssc.eu/?pane=technical&technical=explainer-open-digital-rights-language-odrl
26. Maris: A Formally Verifiable Privacy Policy Enforcement Paradigm, https://arxiv.org/html/2505.04799v5
27. The Right to Erasure from Sequential Storages | by Torsten Schlieder, https://techblog.unite.eu/the-right-to-erasure-from-sequential-storages-2fffe822139b
28. Crypto shredding: How it can solve modern data retention challenges, https://medium.com/@brentrobinson5/crypto-shredding-how-it-can-solve-modern-data-retention-challenges-da874b01745b
29. Value-Preserving Architectures for Agentic AI Systems - arXiv, https://arxiv.org/html/2609.03920v1
30. The New MCP Specification: What Security Teams Must Prepare For, https://www.akamai.com/blog/security-research/new-mcp-specification-security-teams-must-prepare
31. Privacy-Enhancing Paradigms within Federated Multi-Agent Systems, https://arxiv.org/html/2503.08175v1