Engineering · 2026-03-25

Trust Decay Functions: The Mathematics of Agent Behavioral Drift

By J. W. Bouckaert

Trust has to change after issuance

Most identity systems assume that a credential issued at time t₀ is equally valid at t₀ + n until someone revokes it. For autonomous agents that assumption is weak. An agent authorized at 09:00 can, by 09:47, be calling at three times its usual rate, using write scopes it rarely touched, or connecting from an unfamiliar network. Its API key is still valid and its token has not expired.

Trust decay functions are one way to model this: the trust an identity carries falls with time and with evidence, and rises again only when fresh evidence arrives. This article sets out time-based decay as a technique, describes the signal-driven scoring PasskeyBridge runs for agent delegates, and formalizes the Combined Trust Coefficient (CTC) that PasskeyBridge computes when two agents negotiate, including why it combines the two agents' scores with a geometric mean.

Static credentials

Machine-to-machine authentication still depends mostly on static credentials, which were designed for servers with predictable behavior.

NIST's February 2026 concept paper on software and AI agent identity and authorization lists among its open questions whether authorization policies can be updated dynamically when an agent's context changes, and how zero trust principles apply to agent authorization. A static API key addresses neither.

Consider the failure modes:

• No behavioral binding. An API key authenticates the caller but says nothing about what the caller is doing. An agent that shifts from data retrieval to data exfiltration presents the same key.
• No temporal degradation. A key issued six months ago carries the same weight as one issued six seconds ago.
• No bilateral verification. In agent-to-agent (A2A) transactions, both parties need to show they can be trusted. A static key at best proves identity and says nothing about current behavior.
• No scope narrowing. When behavioral signals indicate drift, a static key cannot be partially restricted. It is either valid or revoked, which pushes operators to over-permission or to over-revoke.

PasskeyBridge's Trust Engine replaces this binary with a score and a ladder of scope states.

Time-based decay

A simple decay model lowers trust exponentially with the time since the last attestation:

T(t) = T₀ × e^(−λ × Δt)

Where:

• T₀ is the trust score at the last attestation
• λ is the decay constant, per minute
• Δt is the time since the last attestation, in minutes

The half-life is ln 2 / λ. With λ = 0.0023 per minute, for example, the half-life is about 301 minutes, and a score of 0.90 falls below 0.70 after about 110 minutes, below 0.40 after about 6 hours and below 0.20 after about 11 hours.

A deployment using this model can shorten the half-life while a risk signal is active, by multiplying λ, and can make recovery slower than decay, so that trust lost to an anomaly takes sustained clean behavior to regain.

PasskeyBridge does not apply time-based decay. A delegate's score changes only when the trust engine evaluates new activity, as the next section describes.

Signal-driven scoring in PasskeyBridge

Each agent delegate starts with a score of 1.0. The trust engine evaluates it when a soft signal arrives for the organization, when a refused agent call is recorded, in a five-minute sweep of activity no evaluation has judged yet, or on an explicit re-assessment. Each detector lowers the score by a weight scaled by how far past its threshold the behavior is:

The score sets the delegate's state: all its scopes at 0.70 and above, its read scopes only from 0.40, verify only from 0.20, and revocation below the delegate's revocation floor (0.20 by default). The organization can move the full and read-only rungs. The original scope list is kept, so sustained normal usage back above the full threshold restores it. A hard signal such as a SIM swap deactivates every active delegate in the organization, whatever its score.

Recovery is slower than loss. A clean evaluation adds 0.05, and a single velocity spike can take up to 0.30.

Formalizing the combined trust coefficient

When two delegates negotiate through the A2A handshake, PasskeyBridge computes a CTC from their two scores and three environmental terms. The CTC is described in US patent application and is implemented as:

CTC(i, r) = clamp[0,1]( √(Tᵢ × Tᵣ) − Jₚ + Fᵦ + Sᶠ )

Where:

• Tᵢ and Tᵣ are the current trust scores of the initiating and responding delegates, from 0.000 to 1.000
• Jₚ is the jitter penalty, from 0 to 0.20
• Fᵦ is 0.05 when either delegating user has an active NF-08 spatial binding, whose device identifier is stored as a keyed HMAC-SHA-256 digest under a server-held pepper
• Sᶠ is the SIM signal freshness bonus, falling linearly from 0.03 for a new signal to 0 at 300 seconds; no recent signal adds nothing

The environmental terms are additive offsets on the 0 to 1 scale. The CTC is computed once, at the negotiate step, from the scores at that moment.

Trust state mapping

The CTC maps to four states:

State(CTC) =
  full           if CTC ≥ 0.70
  read_only      if 0.40 ≤ CTC < 0.70
  verify_only    if 0.20 ≤ CTC < 0.40
  auto_revoked   if CTC < 0.20

The negotiation grants only scopes both delegates hold, and the state narrows them further: all shared scopes in full, those containing read plus verify in read_only, verify alone in verify_only, and none in auto_revoked, which revokes the negotiation. A tier table sets the negotiated transaction limits:

The limits are written into the negotiation and its signed proof, and the lookup and status calls return them. The service on the other side of the transaction reads and enforces them, because PasskeyBridge does not see the transactions themselves.

With graduated states, an agent pair with mild drift loses write access and keeps read access, which limits the cascading failures that full revocation can cause in connected agent systems.

Geometric mean rather than arithmetic

The choice of aggregation function is a security decision.

The arithmetic mean of two values is always greater than or equal to their geometric mean (the AM-GM inequality), and the gap grows with the difference between them. In trust terms, the arithmetic mean overstates the trustworthiness of an unequal pair.

Two examples, before the environmental terms. If Agent A scores 0.95 and Agent B 0.50, the arithmetic mean is 0.725, which would grant full access, while the geometric mean is 0.689, which grants read-only. If a procurement agent scores 0.90 and a fulfillment agent's score has fallen to 0.15, the arithmetic mean is 0.525 (read-only, up to 5,000 per transaction) and the geometric mean is 0.367 (verify-only, up to 500).

In bilateral trust the transaction is only as secure as the less trusted participant. An adversary who controls Agent B gains access to the shared negotiation, and a high score on Agent A cannot cover for it. This is consistent with the tenets of NIST SP 800-207 that access is granted per session and decided by dynamic policy that includes the observable state of the requester.

Jitter as a trust signal

The CTC charges for round-trip jitter above 150 ms, scaling linearly to a maximum penalty of 0.20 at 1,000 ms:

Jₚ = min(0.20, max(0, (jitter_ms − 150) / 850 × 0.20))

Jitter can rise when traffic is relayed or proxied, or when an agent runs far from where it claims to. The caller reports network_jitter_ms with the negotiate request, and an absent value is read as 50 ms, which carries no penalty. Because the value is reported by the caller, reporting low jitter only avoids the penalty and cannot raise the CTC.

Re-attestation and renewal

A negotiation lasts the TTL its initiator requests: 60 seconds by default, and between 10 seconds and one hour. A renewal extends an active negotiation within the same bounds. It is denied, with action_required: "re-attest", when the geometric mean of the two delegates' current scores has moved more than 0.100 from the recorded CTC. The status call reports the cached CTC as no longer valid on the same drift test or once the TTL has passed. A hard signal revokes every open negotiation in the organization.

A TTL alone creates predictable windows. The drift test ties re-attestation to the delegates' behavior as well as to the clock.

Signatures on negotiation records

Each A2A step that changes a negotiation (initiate, attest, negotiate, renew) is signed with a hybrid HMAC-SHA-256 and ML-DSA-65 (FIPS 204) signature, and the change is committed together with its proof. For the negotiate step, the signed statement includes the CTC, the limits and the scopes granted. If signing fails, the step writes nothing.

A signature does not hide a record. It lets the record be checked later, and the ML-DSA layer keeps that check valid against an attacker with a quantum computer, which matters for agreements that are audited years after they are made. The ML-DSA layer can be verified with the public key alone. The signed statements hold row ids, statuses, numbers and scope names, and no personal data.

Production pipeline

The A2A handshake runs in PasskeyBridge's edge functions in five steps:

1. Initiate: the initiating delegate opens a negotiation with a responding delegate and a TTL.
2. Attest: both delegates must be active, each delegating user must hold a passkey credential, and both delegates' certificates are verified.
3. Negotiate: the CTC, state, scopes and limits are computed, signed and committed, and the step is written to the append-only audit trail.
4. Renew: the negotiation is extended unless the scores have drifted more than 0.100.
5. Invalidate: open negotiations are revoked on a hard signal.

Implications for agentic commerce

As agent-initiated purchasing and automated procurement grow, the limits on agent-to-agent transactions need to follow current trust. Under the CTC, a pair of delegates both at 0.92 negotiates up to 100,000 per transaction and 60 per minute. If one delegate's score has fallen to 0.40 by the next negotiation, the CTC is about 0.61, the limit drops to 5,000 and 10 per minute, and write scopes are withheld.

Kyndryl's March 2026 article on agentic drift states that "encoding rules directly into systems reduces drift and strengthens compliance." The CTC tier table encodes negotiation limits that way.

Summary

Agent trust should fall when behavior or context changes and recover only with fresh evidence. Time-based decay is one way to express that. PasskeyBridge uses signal-driven delegate scores, and a CTC computed for each negotiation with a geometric mean, so the weaker agent sets the terms.

Explore the A2A Trust Protocol → Read about the Trust Engine → Get Started with PasskeyBridge →

Start free · Test the API