cnf binds a mandate to a key. Keys are held by software.
Software has bugs, supply chains, and operators — and all three change
over the mandate's lifetime.
Treat agent identity as exactly what it is: proof of which key, not proof of whose current intent. Between issuance and presentation, the agent's operator may have changed policy, the agent may have been compromised, or the user may have revoked delegation in a channel the verifier never sees.
This is why behavioral baselines matter in agent payments: not because agents are untrustworthy, but because a mandate tells you what the key was authorized to do at issue time — and nothing about whether the entity holding it now still deserves that trust. Velocity, counterparty diversity, and delegation-pattern drift are the signals that let you distinguish "the user's agent doing the user's business" from "the key doing something else."
Series rubric: APAF-1 — Agent Payment Assurance Framework. ← All research