Paper deep dive
AITH: A Post-Quantum Continuous Delegation Protocol for Human-AI Trust Establishment
Zhaoliang Chen
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 98%
Last extracted: 4/10/2026, 4:08:00 AM
Summary
AITH (AI Trust Handshake) is a post-quantum continuous delegation protocol designed to manage human-AI trust. It replaces per-operation cryptographic signing with a one-time ML-DSA-87 signed Delegation Certificate and a high-performance, deterministic Boundary Engine. The protocol supports sub-second push-based revocation and a three-tier SHA-256 responsibility chain for auditability, with security properties formally verified via the Tamarin Prover.
Entities (5)
Relation Signals (3)
AITH → includes → Boundary Engine
confidence 100% · AITH introduces... a six-check Boundary Engine
AITH → uses → ML-DSA-87
confidence 100% · AITH uses ML-DSA exclusively for certificate signing
Tamarin Prover → verified → AITH
confidence 100% · All five core security properties have been machine-verified using the Tamarin Prover
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:The rapid deployment of AI agents acting autonomously on behalf of human principals has outpaced the development of cryptographic protocols for establishing, bounding, and revoking human-AI trust relationships. Existing frameworks (TLS, OAuth 2.0, Macaroons) assume deterministic software and cannot address probabilistic AI agents operating continuously within variable trust boundaries. We present AITH (AI Trust Handshake), a post-quantum continuous delegation protocol. AITH introduces: (1) a Continuous Delegation Certificate signed once with ML-DSA-87 (FIPS 204, NIST Level 5), replacing per-operation signing with sub-microsecond boundary checks at 4.7M ops/sec; (2) a six-check Boundary Engine enforcing hard constraints, rate limits, and escalation triggers with zero cryptographic overhead on the critical path; (3) a push-based Revocation Protocol propagating invalidation within one second. A three-tier SHA-256 Responsibility Chain provides tamper-evident audit logging. All five security theorems are machine-verified via Tamarin Prover under the Dolev-Yao model. We validate AITH through five rounds of multi-model adversarial auditing, resolving 12 vulnerabilities across four severity layers. Simulation of 100,000 operations shows 79.5% autonomous execution, 6.1% human escalation, and 14.4% blocked.
Tags
Links
- Source: https://arxiv.org/abs/2604.07695v1
- Canonical: https://arxiv.org/abs/2604.07695v1
Trouble viewing inline? Open PDF directly →
Full Text
28,344 characters extracted from source content.
Expand or collapse full text
AITH: A Post-Quantum Continuous Delegation Protocol for Human-AI Trust Establishment Zhaoliang Chen Faculty of Business Administration, University of Macau, Macao SAR, China yc57068@um.edu.mo (April 2026) Abstract The rapid deployment of AI agents acting autonomously on behalf of human principals—executing financial trades, managing infrastructure, negotiating contracts—has outpaced the development of cryptographic protocols capable of establishing, bounding, and revoking the trust relationship between humans and AI systems. Existing authorization frameworks (TLS, OAuth 2.0, SPIFFE, Macaroons) were designed for deterministic software and fundamentally cannot address the unique challenges posed by probabilistic AI agents: continuous autonomous operation within variable trust boundaries, real-time constraint enforcement without per-operation human approval, and cryptographically verifiable responsibility attribution when AI decisions cause harm. We present AITH (AI Trust Handshake), a post-quantum continuous delegation protocol that enables humans to grant AI agents bounded, revocable, and auditable authority. AITH introduces three technical contributions: (1) a Continuous Delegation Certificate signed once with ML-DSA-87 (FIPS 204, NIST Level 5) that replaces per-operation signing with sub-microsecond boundary checks, achieving 4.7 million operations per second on a single core; (2) a six-check Boundary Engine with formally specified check ordering that enforces hard constraints, rate limits, and escalation triggers without cryptographic overhead on the critical path; and (3) a push-based Revocation Protocol that propagates certificate invalidation to all registered target systems within one second. A three-tier Responsibility Chain using SHA-256 hash chains provides tamper-evident logging suitable for regulatory audit and legal evidence extraction. All five core security properties have been machine-verified using the Tamarin Prover under the Dolev-Yao threat model. We validate the protocol through a novel methodology: five rounds of structured adversarial security auditing using two frontier AI systems (Model α and Model β) as red-blue team instruments under human direction, supplemented by independent stress testing from Model γ and Model δ. This multi-model audit identified and resolved 12 vulnerabilities across four severity layers, driving AITH from v1 to v5.1. A simulation of 100,000 operations demonstrates that 79.5% proceed autonomously within bounds, 6.1% trigger human escalation, and 14.4% are blocked—confirming that AITH enables high-throughput AI autonomy while maintaining cryptographic safety guarantees. Keywords: AI agent authorization, continuous delegation, post-quantum cryptography, ML-DSA, boundary enforcement, trust protocol, human-AI interaction, push-based revocation, adversarial validation 1 Introduction On March 14, 2026, FINRA published a report recommending that financial firms evaluate how to monitor AI agent system access and data handling, where to place human-in-the-loop oversight, and how to establish guardrails limiting agent behaviors [1]. Two weeks later, the SEC’s Division of Investment Management described the potential for fund-provided AI agents to interact directly with investors, while acknowledging unresolved liability and regulatory classification questions [2]. These developments signal that AI agents are transitioning from experimental assistants to autonomous economic actors—and that existing regulatory and technical infrastructure is unprepared. The core technical problem is straightforward: how does a human grant an AI agent the authority to act on their behalf, with cryptographic guarantees that the agent cannot exceed its authorized boundaries, and with the ability to revoke that authority instantly? This problem has no satisfactory solution in the current security infrastructure stack. 1.1 The Inadequacy of Existing Approaches Transport Layer Security (TLS 1.3) authenticates communication channels, not delegation relationships. OAuth 2.0 provides scoped access credentials, but its scope model is a flat string incapable of encoding multi-dimensional constraints (amount limits, asset restrictions, time windows, rate caps). SPIFFE provides workload identity but assumes mutual TLS between deterministic services. Macaroons [12] offer attenuated bearer credentials with caveats, but lack push-based revocation: revoking a Macaroon requires waiting for the bearer to present it, creating an unbounded window during which a compromised agent can continue operating. All four approaches share a fundamental assumption: the authorized entity is deterministic software. An AI agent violates this assumption. 1.2 The Continuous Delegation Paradigm We propose a fundamentally different approach: replace per-operation authorization with continuous delegation. A human signs a Delegation Certificate once, specifying the AI agent’s identity, boundaries, escalation triggers, and temporal validity. The AI agent operates autonomously within these boundaries. Each operation is checked by a Boundary Engine—a deterministic, sub-microsecond comparator requiring no cryptographic operations on the critical path. The analogy is to a legal power of attorney: bounded authority through a single signed document. Unlike a traditional power of attorney, however, a Delegation Certificate is machine-verifiable, its boundaries are enforced by deterministic code, and revocation propagates within one second. We frame AITH as “Automated Standing Instructions with Cryptographic Attestation.” 1.3 Contributions This paper makes the following contributions: 1. Continuous Delegation Certificate. A post-quantum signed credential (ML-DSA-87, NIST Level 5) encoding multi-dimensional boundary constraints, escalation triggers, and temporal validity. After signing, routine operations require zero cryptographic operations (§4.1). 2. Six-Check Boundary Engine. A formally ordered constraint enforcement mechanism achieving 0.21 μ mean latency and 4.7M ops/sec on a single core (§4.2, §6). 3. Push-Based Revocation with Responsibility Chain. Sub-second revocation propagation coupled with a three-tier SHA-256 hash chain for tamper-evident audit (§4.4–§4.5). 4. Multi-Model Adversarial Audit. Five structured rounds between Model α and Model β, with stress testing by Model γ and Model δ, uncovering 12 vulnerabilities across four severity layers (§7). 5. Machine-Verified Security. All five core security theorems verified by the Tamarin Prover under the Dolev-Yao threat model (§5.1). 2 Background and Related Work 2.1 Post-Quantum Digital Signatures: ML-DSA AITH’s cryptographic foundation is ML-DSA (Module Lattice Digital Signature Algorithm), standardized as FIPS 204 by NIST in August 2024 [3]. ML-DSA-87 provides NIST Level 5 (256-bit) security based on the Module Learning With Errors (M-LWE) problem [4]. AITH uses ML-DSA exclusively for certificate signing—a one-time operation—meaning that ML-DSA’s relatively large signature sizes (4,627 bytes) and signing times (∼ 2 ms) do not impact operational throughput. 2.2 Existing Delegation and Authorization Schemes Table 1 compares AITH with existing delegation mechanisms. Table 1: AITH vs existing delegation schemes. Property TLS 1.3 OAuth 2.0 Macaroons AITH v5.1 For AI agents No No No Yes Continuous delegation No Credential TTL Caveats Certificate Boundary enforcement No Scope str. Caveats 6-check engine Per-op crypto cost Handshake Credential verify HMAC None Push revocation No No No Yes (<<1s) Responsibility chain No No No 3-tier hash Post-quantum Partial No No ML-DSA-87 2.3 Concurrent Work on AI Agent Authorization The problem of AI agent authorization has attracted significant recent attention. We compare AITH with four concurrent approaches. Google AP2 [5] uses cryptographically signed Mandates as proof of user intent for payment transactions. AP2’s mandate model shares conceptual overlap with AITH’s Delegation Certificate, but AP2 is scoped exclusively to payments, requires per-transaction signing, and provides no general-purpose boundary enforcement or push-based revocation. AIP [6] introduces Invocation-Bound Capability Tokens (IBCTs) binding identity, authorization, and provenance. AIP uses Ed25519 (not post-quantum) and requires per-operation credential generation. AITH’s continuous delegation eliminates per-operation crypto entirely, achieving 500× lower critical-path latency. A-JWT [7] extends JWT with agent identity checksums and intent binding. While A-JWT addresses similar threat vectors, it remains within the JWT/OAuth ecosystem and inherits its limitations: no boundary engine, no push revocation, no post-quantum security. CA-MCPQ [8] brings post-quantum cryptography to the Model Context Protocol via context-aware security level negotiation. CA-MCPQ addresses transport security but not authorization semantics: it has no delegation model, boundary engine, or responsibility chain. Table 2: AITH vs concurrent AI agent authorization approaches. AP2 AIP A-JWT CA-MCPQ AITH Scope Payments General Enterprise MCP ext. General Delegation Mandates Cap. credentials Intent credentials Session Cont. cert. Per-op signing Yes Yes Yes Yes No Boundary engine No No No No 6-check Push revocation No TTL No No Yes (<<1s) Resp. chain No Completion No No 3-tier hash Post-quantum No No No Yes Yes Tamarin verified No No No No 5 lemmas AITH is, to our knowledge, the only protocol that combines continuous delegation, a formally verified boundary engine, push-based sub-second revocation, a three-tier legal-grade responsibility chain, and post-quantum security in a single integrated architecture. 3 System Model and Threat Model 3.1 Entities • Human Principal (H). Possesses an ML-DSA-87 key pair (skH,pkH)(sk_H,pk_H). Sole entity authorized to issue, modify, or revoke Delegation Certificates. • AI Agent (A). Identified by model weight hash hA=SHA-256(model_weights)h_A=SHA-256(model\_weights). Does not possess a private key. • Verifier / Target System (V). Implements the Boundary Engine. Maintains registration for push-based revocation. • Provider (P). Operates the AI model. Issues attestation certificates binding runtime configuration to hAh_A. 3.2 Adversary Model We consider an adversary A with capabilities including: MITM attacks, model substitution, credential theft, boundary bypass via operation splitting, replay attacks, trust escalation, revocation delay, slow drift attacks, cognitive poisoning (RAG injection), and reflexivity exploitation. Each vector and its mitigation are detailed in the extended version. 3.3 Explicit Non-Goals AITH does not address: (1) AI alignment; (2) TEE side-channel attacks; (3) constraint completeness (human responsibility); (4) semantic correctness of AI decisions; (5) cryptographic breakthroughs against M-LWE. 4 AITH Protocol Specification 4.1 Delegation Certificate Definition 1 (Delegation Certificate). A Delegation Certificate is a tuple D=(idH,pkH,idA,hA,ℓ,C,E,R,tissue,texpire,sem,σH)D=(id_H,pk_H,id_A,h_A, ,C,E,R,t_issue,t_expire,sem, _H) where ℓ∈limited,general,full ∈\limited,general,full\ is the delegation level; C=c1,…,cnC=\c_1,…,c_n\ is the boundary constraint set; E=e1,…,emE=\e_1,…,e_m\ is the escalation trigger set; R is the set of registered target system endpoints; sem is the semantic_auditor_pubkey (optional); and σH=ML-DSA.Sign(skH,ℋ(D∖σH)) _H=ML-DSA.Sign(sk_H,H(D _H)). The certificate is signed exactly once using ML-DSA-87 (NIST Level 5, 256-bit security). After issuance, no further cryptographic operations are required for routine operations, reducing critical-path latency from ∼ 2 ms (ML-DSA signing) to ∼ 0.21 μ (boundary comparison). 4.2 Boundary Engine Definition 2 (Boundary Engine). For operation op=(type,params,timestamp)op=(type,params,timestamp), the Boundary Engine BE(D,op)BE(D,op) executes six checks in strict sequence: 1. Certificate Validity: Verify temporal bounds, ML-DSA signature, and agent identity hAh_A. 2. Delegation Level: Verify op.typeop.type is permitted at level ℓ . 3. Boundary Constraints: Evaluate every ci∈Cc_i∈ C against opop. 4. Rate Limits: Verify aggregate windowed limits. 5. Anomaly Detection: Compare opop against behavioral baseline. 6. Escalation: If triggered, pause for human confirmation (300s timeout). If any check fails, subsequent checks are not executed. 4.3 Escalation Protocol Three trigger types: threshold (approaching boundary limit), novelty (unseen operation type), and composition (sequence collectively exceeding policy). Human responds APPROVE, DENY, or MODIFY. Timeout auto-denies for fail-safe behavior. 4.4 Push-Based Revocation Definition 3 (Push-Based Revocation). A revocation message rev=(cert_id,reason,timestamp,σH)rev=(cert\_id,reason,timestamp, _H) is pushed to all Vk∈RV_k∈ R simultaneously. Three modes: immediate (abort in-flight), graceful (complete then stop), partial (tighten boundaries). Propagation bounded by Δtmax=maxk(RTTk)+δprocess<1 t_ = _k(RTT_k)+ _process<1s. 4.5 Responsibility Chain Three-tier SHA-256 hash chain: Tier 1 (AI decision log, every operation), Tier 2 (human confirmation log, escalated operations only, counter-signed), Tier 3 (system execution log). Each entry includes prev_hash=SHA-256(entryi−1)prev\_hash=SHA-256(entry_i-1), forming a tamper-evident sequence for legal evidence extraction. 4.6 Protocol State Machine Six states (UNINITIALIZED, ACTIVE, ESCALATED, SUSPENDED, REVOKED, ERROR), nine transitions, four invariants. Invariant I1: in state ACTIVE, all six checks pass before execution. Invariant I3: REVOKED is terminal. 5 Security Analysis We present five security theorems. Full proofs and the Tamarin model appear in the supplementary materials. Theorem 1 (Certificate Unforgeability). Under the M-LWE assumption, no PPT adversary can forge a valid Delegation Certificate without skHsk_H, except with negligible probability. Proof sketch. Reduces to ML-DSA’s EUF-CMA security [3]. □ Theorem 2 (Boundary Inviolability). No operation violating any constraint ci∈Cc_i∈ C with action=blockaction=block can be executed in state ACTIVE. Proof sketch. By invariant I1, all six checks pass. Check 3 evaluates every constraint. □ Theorem 3 (Revocation Timeliness). Upon revocation, all registered targets cease accepting operations within Δtmax t_ . Proof sketch. Push-based notification to all Vk∈RV_k∈ R simultaneously. Bounded by network RTT. □ Theorem 4 (Chain Integrity). Any modification to a Responsibility Chain entry is detectable via hash chain verification. Proof sketch. Requires SHA-256 collision—computationally infeasible. □ Theorem 5 (Delegation Scope Separation). OpSet(A,D)∩MgmtOps=∅OpSet(A,D) = . Proof sketch. Certificate management requires skHsk_H; A never possesses skHsk_H. □ 5.1 Machine-Verified Security Analysis [Machine-Verified via Tamarin Prover] All five security properties have been formally verified using the Tamarin Prover under the Dolev-Yao threat model. ML-DSA was modeled as an idealized EUF-CMA secure primitive—standard practice in cryptographic protocol verification [9, 10]. Boundary constraints were abstracted using mutually exclusive predicates (IsWithinBounds/ViolatesBounds). Table 3: Tamarin Prover verification results. Lemma Property Result Steps L1 Certificate Unforgeability Verified ✓ 12 L2 Boundary Inviolability Verified ✓ 6 L3 Revocation Timeliness Verified ✓ 14 L4 Chain Integrity Verified ✓ 9 L5 Delegation Scope Separation Verified ✓ 8 6 Implementation and Evaluation 6.1 Reference Implementation Python reference implementation (2,800+ lines). ML-DSA operations simulated via HMAC-SHA-256; production deployment would use liboqs [11] or pqcrypto-rs. 6.2 Large-Scale Simulation 100,000 operations across 1,000 simulated users. Distribution: 40% queries, 25% small trades ($500–$5K), 15% medium ($5K–$10K), 8% large ($15K+), 5% transfers, 4% over-limit, 3% forbidden. Table 4: Performance benchmarks (Python, AMD Ryzen 9 7950X, single-threaded). Metric Value Boundary check latency (mean) 0.21 μ Boundary check latency (P99) 0.36 μ Single-core throughput 4,703,414 ops/sec Projected 64-core throughput ∼ 301M ops/sec Certificate issuance 0.011 ms Chain append 7.5 μ Revocation push (100 targets) 0.095 ms + network RTT Table 5: Operation outcome distribution (100,000 operations). Outcome Count % Interpretation Allowed 79,500 79.5% Autonomous within bounds Escalated 6,100 6.1% Human judgment required Blocked 14,400 14.4% Boundary violation caught 6.3 Comparative Latency Table 6: Per-operation latency comparison. Mechanism Per-Op Latency Throughput AITH Boundary Check 0.21 μ 4.7M ops/sec Macaroon (HMAC) 1–10 μ 100K–1M ops/sec OAuth 2.0 (JWT/RSA) 0.1–1 ms 1K–10K ops/sec ML-DSA per-op sign ∼ 2 ms ∼ 500 ops/sec 7 Multi-Model Adversarial Security Audit 7.1 Methodology and Rationale A human operator clicking a mouse executes perhaps 2–5 actions per second. An AI agent operating under a Delegation Certificate can execute thousands of operations per second. This quantitative leap demands a fundamentally different approach to security auditing: adversarial analysis must operate at the speed and combinatorial depth that matches the threat surface. We therefore employed four frontier large language models as structured adversarial auditing instruments under human direction. The audit proceeded over five rounds. Model α served as protocol designer (Blue Team); Model β served as adversarial auditor (Red Team); the human principal served as strategic director, mediating disputes and making all final architectural decisions. After five rounds, Model γ and Model δ conducted independent extreme stress testing on v5.0. All four models are frontier LLMs from different providers; identities are anonymized to prevent evaluation bias. 7.2 Vulnerability Timeline Table 7: Complete vulnerability timeline. 5 rounds, 12 vulnerabilities, 4 layers. Rnd Vulnerability Severity Layer Resolution R1 Hardcoded lattice params Medium Parameter Parameterized config R1 No ring justification Low Parameter NTRU ring documented R2 Custom hash unanalyzed High Algorithm Replaced: SHA-256 R2 Gaussian sampling bias High Algorithm CDT sampling R2 Missing formal reduction High Algorithm SIS reduction proven R3 Trust score manipulation Critical Protocol ML-DSA pivot (v3) R3 Session key derivation High Protocol HKDF-SHA-256 R4 Escalation deadlock Medium Protocol Timeout + fallback R4 Rate limit bypass High Business Aggregate windowing R4 ZKP semantic gap Medium Protocol Semantic auditor R5 Certificate single-point Medium Protocol Push revocation R5 Slow drift attack Medium Business Baseline resets 7.3 Architecture Evolution The protocol evolved through three phases, each driven by audit findings and human strategic decisions. Phase I (v1→ 2): Rounds 1–2 exposed weaknesses in custom cryptographic primitives; the human principal directed replacement with NIST-standardized components. Phase I (v2→ 4): Round 3 revealed that the custom trust scoring mechanism was vulnerable to manipulation—the human principal decided to pivot entirely to ML-DSA, eliminating a class of vulnerabilities by standing on standardized cryptography. Phase I (v4→ 5): The most consequential change emerged not from any audit finding but from the human principal’s observation that per-operation signing creates an inherent bottleneck incompatible with autonomous AI operation at scale. Neither Model α nor Model β independently identified this constraint. This paradigm shift—from per-operation signing to continuous delegation—is the architectural decision that defines AITH v5. 7.4 Limitations We acknowledge three limitations. First, all AI auditors share overlapping training data, creating potential blind spots where all models hold the same incorrect assumption. Second, AI-driven auditing cannot test hardware side-channels, network-level exploits, or social engineering. Third, this methodology complements but does not replace human security review and formal verification (the latter addressed in §5.1). 8 Discussion 8.1 Three-Layer Defense Model AITH positions itself within a three-layer AI safety stack: Layer 1 (Cryptographic Enforcement / AITH): deterministic boundary checks. Layer 2 (Semantic Analysis / external AI firewall): probabilistic intent analysis via semantic_auditor_pubkey. Layer 3 (Physical Safeguards): hardware circuit breakers. 8.2 Legal Framing We frame AITH as “Automated Standing Instructions with Cryptographic Attestation” rather than “Power of Attorney for AI.” The Delegation Certificate is analogous to limit orders, auto-debit mandates, and standing dealing instructions. 8.3 AITH as AI Passport Infrastructure We envision a future where each individual possesses a personal AI delegate acting on their behalf in the digital economy. In this paradigm, AITH serves not as a cage constraining AI, but as a passport enabling AI to enter human economic systems with verified, bounded authority. The exclusive binding between one human and one AI—cryptographically enforced via hAh_A—addresses the fundamental question: “Whose AI is this, and what are they allowed to do?” Current approaches (AP2, AIP, A-JWT) focus on enterprise agent management; AITH addresses the more fundamental problem of personal AI authorization for the age of individual AI delegates. 8.4 Limitations and Future Work Cryptographic Agility. AITH’s design is deliberately orthogonal to the choice of signature primitive. While we specify ML-DSA-87 as the current instantiation, the protocol architecture does not hardcode any specific algorithm. Should M-LWE face unexpected cryptanalytic progress, the Delegation Certificate’s signature field can be hot-swapped to any EUF-CMA secure scheme (e.g., SLH-DSA, XMSS) without modifying the Boundary Engine, Responsibility Chain, or state machine. This cryptographic agility is a deliberate design goal, not an afterthought. Orthogonal Overlay Architecture. AITH is designed as an overlay protocol that introduces minimal intrusiveness to existing systems. Target systems (brokerages, banks, APIs) need only implement two capabilities: (1) a Boundary Engine endpoint that evaluates incoming operations against a stored Delegation Certificate, and (2) a revocation listener for push notifications. No changes to existing authentication infrastructure (OAuth, mTLS) are required—AITH operates alongside them. This incremental deployability is critical for real-world adoption in regulated industries where “rip and replace” is infeasible. Constraint completeness remains the human’s responsibility. Formal verification of the Boundary Engine implementation (beyond protocol-level Tamarin verification) is a high-priority near-term objective. TEE hardware binding, cross-protocol AI PKI, key recovery/inheritance, and hierarchical revocation propagation are identified as future work. 9 Conclusion We have presented AITH, a post-quantum continuous delegation protocol enabling humans to grant AI agents bounded, revocable, and auditable authority. The core idea is deceptively simple: sign once, enforce continuously. By amortizing all cryptographic cost to certificate issuance and running a purely deterministic Boundary Engine at 0.21 μ per operation, AITH resolves what we believe is the central tension in AI agent deployment—the tradeoff between cryptographic rigor and operational speed. Five security theorems, machine-verified by the Tamarin Prover, establish that this simplicity does not come at the cost of formal guarantees. The multi-model adversarial audit (§7) surfaced 12 vulnerabilities that no single auditor—human or AI—would likely have found alone. Interestingly, the most consequential architectural decision (continuous delegation) came not from any model’s analysis but from the human principal’s frustration with per-operation signing latency. We take this as evidence that human intuition and AI analytical depth are genuinely complementary in protocol design. As AI agents move from research curiosities to economic participants, the question of authorization infrastructure becomes urgent. AITH offers one answer: treat the human-AI trust relationship as a first-class cryptographic object—signed, bounded, monitored, and revocable. We hope this work contributes a useful foundation for the trust infrastructure that this transition demands. Acknowledgments The author acknowledges the contributions of four frontier AI systems (anonymized as Model α, β, γ, δ) whose adversarial collaboration was essential to the protocol’s development. Model α served as protocol designer and Blue Team; Model β served as Red Team auditor and conducted formal verification; Models γ and δ provided independent stress testing. The author served as strategic director, making all final architectural decisions including the shift from per-operation signing to continuous delegation. This work was conducted during the author’s doctoral studies at the University of Macau. References [1] FINRA, “Artificial Intelligence (AI) in the Securities Industry,” Regulatory Notice, March 2026. [2] SEC Division of Investment Management, “Remarks on AI Agent Deployment in Fund Management,” February 2026. [3] NIST, “Module-Lattice-Based Digital Signature Standard (ML-DSA),” FIPS 204, August 2024. [4] O. Regev, “On lattices, learning with errors, random linear codes, and cryptography,” in Proc. STOC, 2005. [5] Google, “Agent Payments Protocol (AP2),” https://google-agentic-commerce.github.io/AP2/, September 2025. [6] A. Prakash et al., “Agent Identity Protocol (AIP): Verifiable Delegation for AI Agent Systems,” IETF Internet-Draft, draft-prakash-aip-00, March 2026. [7] A. Goswami, “Cryptographic agent authentication and intent delegation system,” U.S. Patent Application 19/315,486, August 2025. [8] S. Yoon et al., “CA-MCPQ: A Context-Aware Post-Quantum Protocol for AI Agent Integrity,” IACR ePrint 2025/1790, 2025. [9] S. Meier et al., “The TAMARIN prover for the symbolic analysis of security protocols,” in Proc. CAV, 2013. [10] B. Blanchet, “An efficient cryptographic protocol verifier based on Prolog rules,” in Proc. CSFW, 2001. [11] Open Quantum Safe Project, “liboqs,” https://openquantumsafe.org/liboqs/. [12] A. Birgisson et al., “Macaroons: Cookies with contextual caveats for decentralized authorization in the cloud,” in Proc. NDSS, 2014. [13] H. K. Maji et al., “Attribute-based signatures,” in Proc. CT-RSA, 2011. [14] European Parliament, “Regulation (EU) 2024/1689 (AI Act),” June 2024. [15] S. South et al., “Authenticated Delegation and Authorized AI Agents,” arXiv:2501.09674, January 2025. [16] C. Gentry et al., “Trapdoors for hard lattices and new cryptographic constructions,” in Proc. STOC, 2008. Supplementary Materials (Extended Version) The following appendices are available in the extended arXiv version: • Appendix A: Formal Proofs. Full mathematical reductions for Theorems 1–5, including the complete EUF-CMA→ -LWE reduction for Certificate Unforgeability. • Appendix B: Tamarin Formal Verification. The complete AITH_v5_1.spthy model (raw source code) and full terminal output logs confirming all five lemmas verified in 0.843s under the Dolev-Yao threat model. • Appendix C: Protocol State Machine. Detailed state transition tables, guard conditions for all nine transitions, and invariant specifications. • Appendix D: Reference Implementation Excerpts. Core Python snippets: Boundary Engine (6-check pipeline), SHA-256 Responsibility Chain construction, and push-based revocation dispatcher. • Appendix E: Delegation Certificate JSON Schema. Complete field-level specification with examples and validation rules.