PROPOSED ARCHITECTURE, NOT PRODUCTION QUALITY · SYNTHETIC AGENTS AND SPONSORS · TESTED ONLY WHERE MARKED

Enterprise compatibility: what has been tested, and what is theory

C=US is built on open standards an enterprise already runs: an X.500/LDAP directory, mutual TLS, FIDO2 passkeys, OAuth token exchange and signed records. So most enterprise products should work with it. This page separates the ones this project has run from the ones that only share the standard.

Summary

1. The registry: directories

The registry is an X.500 directory reached by LDAP. Its schema (schemas) is ordinary LDAPv3 schema, under Cequs Inc.’s IANA enterprise number, 1.3.6.1.4.1.3609.4.

2. Agent authentication

An agent proves who it is on every request. Either it presents a client certificate by mutual TLS, and the gateway finds the one directory entry bound to that certificate’s SHA-256 fingerprint, or it runs on a host that can prove the workload and exchanges that proof for a short-lived token. The binding lives in the directory, not in the certificate authority, so any CA’s certificates can be bound.

3. Accountability and the stop

Every agent has a proofed person who answers for it and can stop it with a passkey. Other systems can also send a signed kill signal. A signal can only take authority away; restoring it is a person’s decision.

4. Signed decisions and audit

Every decision about an agent, allow or refuse, is signed and hash-chained into the gateway’s log. The signatures are Ed25519 over canonical JSON, ES256 JWS for the A2A Agent Card, and eddsa-jcs-2022 for the did:webvh logs. They are not XML or JSON-LD signatures.

5. Where does your agent’s compute get created?

You are paying for compute somewhere. You decide where your agent is maintained and where it runs; C=US does not host it. These locations have been tested with registered agents:

Sections 5.1 to 5.6 are the project lead’s analysis, edited for this page by Claude Code; the dates and standards were checked against the sources below.

5.1 The directory is distributed; the kill switch is a thin layer

The US state directories supply the information about people and their agents, as parts of one distributed system. The national enforcement mechanism, the “kill switch”, is a very thin layer. It holds the states, at the st= level of the directory tree, and the registered organizations that are national in scope, at the o= level. It acts on their entries; it does not hold them.

Unlike DNS, where a registrar could also play this part, those national o= names are not managed by Cequs Inc. They come from the existing ANSI registry: RFC 1255 gives an organization national standing when it is chartered by Congress or holds an ANSI alphanumeric name registration. That registry is cost-effective for two reasons:

1. The registrations are permanent, so they never have to be renewed or registered again.
2. No one needs defensive registrations of similar-sounding names that could fool end users.

They are more expensive than a domain name. That is a reasonable cost for ANSI to maintain the structure.

5.2 Certificates belong in the directory, not the DNS

DNS is highly useful, and has its own issues with certificates. There are and have been proposals to store certificates in the DNS (the CERT record, and DANE’s TLSA record), but they are not a good fit. Certificates are large resource records, and should be transferred as zone files are, over TCP rather than UDP. Recent networking advances have lessened that burden in TLS negotiation: QUIC, a newer transport over UDP pioneered by Google, carries the TLS handshake and its certificates, and incidentally works very well for video streaming.

Back in the early 1990s it was expected that certificates themselves would be stored in the X.500 directory, and there are attributes to do it, such as cACertificate and userCertificate. This already worked in the mid-1990s; the pilot project extended the schema to include digital certificates, because they were useful for encrypted S/MIME email. Later, in the IETF, the project lead worked with Kurt Zeilenga to carry the same capability into LDAP, so that it could store binary objects such as certificates.

Today, LDAP-based directories that store user certificates, so that you can send authenticated email, are common: Active Directory is based on LDAP, and looking up the certificate for the name behind an email address is simple. The flip side is that configuring X.509v3 certificates on a typical unmanaged Windows workstation is far harder from a user’s point of view. It is very doable by following the steps, and storing the certificate in Windows’ software store. With the trusted roots curated by Microsoft, or by Mozilla or a Linux distribution, a fairly high level of encryption is kept, most of the time, for personal and business use.

It is not the curated roots and encryption of the NSA. That is a highly controlled program, with a supporting directory, and while individual agencies can and do run their own PKI, there is a social difference between a defined military structure, where people are required to follow a protocol, and the vast commercial and personal space, where encryption is encouraged to prevent losses but required of no one. Since 1990 the lack of encryption has resulted in significant losses.

5.3 Email: easier, but far less secure

Take a common mail program, Microsoft Exchange. It is complex enough, even in the cloud, that it should have a full-time administrator to run it correctly. It was based from the beginning on X.400, another OSI protocol and the more secure one. But people did not want to put cn=some name, o=some organization, c=US on a business card, because it was clunky, so they used somebody@example.com instead. Easier, but far less secure.

So SMTP was added to programs like Exchange as an option, and for the people configuring mail servers such as Sendmail or Exim on Unix, SMTP was a less secure but highly usable alternative where security was not a priority. The envelope sender (MAIL FROM), as opposed to the From: header, was easily abused, especially once these mail servers moved from Unix to Windows. The expensive versions were sold per user, as their licences still are; open source can be configured, and is, with the protocols that help authenticate email (SPF, DKIM, DMARC), somewhat short of using digital certificates, which cost money from a certificate authority you pay to validate your real identity.

A trust framework is also a great deal of policy work, not just the mechanics of software validating a certificate chain that the user never sees. Just as the Cequs Inc. proposed architecture puts its own OIDs in digital certificates, DirectTrust does the same to move medical records as S/MIME-encrypted email attachments. The whole trust chain is defined: in software, where it ends in a trusted or not-trusted answer (the one a browser shows), and in a large decision tree informed by experts from the certificate authorities, who compete but must keep reasonable standards to stay in business. If a CA is sloppy, and this does happen, it is dropped from the fixed list of trusted CAs in the software’s store; DigiNotar was removed from the browsers in 2011. The lists are maintained by volunteers and by companies, and in some countries by governments, where telecommunications was traditionally run close to official functions such as the post office.

5.4 A public service, and encryption as a choice

The post office in America was a government function before UPS and FedEx, and Benjamin Franklin, its first Postmaster General, also helped found Philadelphia’s volunteer Union Fire Company. A commercial fire company might watch your building burn because you had no subscription. From problems like that came the idea of the municipal service: available to everyone, paid for by stamps or by taxes.

In the c=US model, the US government is not, logically, the whole country: not everyone in the country’s container entry is in the government, and the government has specific rules that limit it beyond what applies to the public. Notably, you do not have to use encryption. In the early 1990s it was regulated as a munition under ITAR, but if you wanted to use it, as it was slowly developed for email and then the web in the 1990s, opening the web to commercial use, you could, in the way the Fourth Amendment protects privacy.

5.5 From Franklin to 2026: infrastructure that ends in a trust signal

There is a physical through line from Franklin to 2026. He made social experiments with early electricity used to communicate, flew the famous key on a kite, and worked to prevent fires in tall buildings with grounding rods. Electricity then moved from local storage in Leyden jars, now batteries, to generation at scale from many sources: first Edison’s Pearl Street Station in Manhattan in 1882, then Niagara Falls and Tesla’s alternating current, when the Adams plant opened there in 1895. Each has a useful role, and each has evolved.

Some of this is infrastructure, and becomes a consumer product only after a series of controlled steps under published safety codes; the known risks of public buildings are more complex, and more closely defined. Cryptography is just as well defined mathematically, in group theory or the theory of prime numbers, but correctly proving that something is valid, at the level of theory, is restricted in practice to mathematicians with doctorates. For the user it comes down to a green check mark: that knowledge reduced to a trust signal. A user who looks under the covers will find that PKI actually works, and will usually stay uninterested in its history, from Fermat’s little theorem, to the organizations that kept it classified, to its later arrival in email and the web.

5.6 Names: handles, domains and distinguished names

What has not been fully explained are the policy trade-offs argued very early, on mailing lists such as Jon Postel’s Namedroppers in the 1980s: the confusion users had about what domain names meant, down to top-level domains such as com and mil, which Postel thought of simply as handles to help find something; the nature of DNS; and where it stands now relative to agent security. The outcome of those arguments is on the record. In October 1984 Postel and Joyce Reynolds set out the first top-level domains in RFC 920, thanking the participants in the Namedroppers group: a small set of very general categories (com, edu, gov, mil, org) beside two-letter country codes taken from the ISO list, so that no one at the registry had to decide what is or is not a country. Their reason for the general names is what is now called semantic neutrality: “The motivation is to provide an organization name that is free of undesirable semantics.” The current system runs the other way. ICANN’s New gTLD Program has greatly expanded the list, with top-level domains chosen to seem semantically relevant (1,241 from the 2012 round were in the root zone as of 30 September 2026, and applications for the next round closed on 12 August 2026), and registrars use that meaning to drive domain sales. Paul Mockapetris, who invented DNS, has spoken about what has to be done for agents (scene restrictions links his talk).

DNS was significantly remodelled after the project lead’s meeting with GSA, where it was agreed that the government should keep exclusive use of .mil, for example, and that DNS would expand greatly beyond the original National Science Foundation structure. That structure had created the InterNIC, where registering a domain name was then free to early adopters (see vortex.com), and before it the names in the hosts.txt list, which predated DNS. Today’s IANA structure followed: the US government divested itself of the root on 1 October 2016, while keeping domains such as .mil. Along the way, in the Clinton era, Postel briefly tested moving the root out of government control (Milton Mueller’s Ruling the Root tells the story).

Even so, the “semantic gold rush” of registering a unique domain name still appeals, a leftover of the dot-com boom. Unlike distinguished names, domain names actually profited from trends and confusion, with a lively trade in selling them. At PSINet, in the InterNIC era, the project lead presided over the commercial transfer of a domain name from one company to another, and it was very complicated: far more complicated than registering a country-code domain, which was routine as countries established Internet connectivity one by one.

So the people from GSA did not think X.500 would be relevant for 30 years. First, people had to become aware that failing to follow cybersecurity best practice would directly cause losses. They felt they could judge a book by its cover: was an email real or fake?

That is the point. The original ARPANET was an academic root of trust, between people who wanted to follow up after conferences, and it did not really need cryptography. Then people began to use email to take actions, such as a message from a CEO to wire money, which threat actors fake: the FBI counts it as business email compromise, with $3,046,598,558 in reported losses in 2025 alone. AI leads to perfect fakes, and only cryptography, based on provable mathematics, can prove authenticity.

It is not that business email compromise is unusual. A system that does not use cryptography is vulnerable by design, because it relies on human judgement. Even a system made secure with cryptography, such as SWIFT, can be broken at the end point: in February 2016, the US Justice Department alleges, attackers inside Bangladesh Bank’s network used its own SWIFT terminals to send fraudulently authenticated payment messages to the Federal Reserve Bank of New York, and $81 million was stolen. Eugene Spafford’s comparison puts it best: encryption on the Internet is like arranging an armored car to carry a package between someone living in a cardboard box and someone on a park bench. That is why C=US protects the end points too: keys made in hardware, a person accountable for every agent, and a directory that can stop one.

Again, early adopters, including cryptography professors such as Matt Blaze, anticipated all these problems in the cypherpunk era of the 1990s. In 1994 Blaze showed how the government’s Clipper chip, built for key escrow, could be made to defeat its own escrow. They also warned about the problems of building surveillance into networks, as the 1994 CALEA law required of US telephone carriers. Those wiretap systems were later compromised by Chinese threat actors: in November 2024 the FBI and CISA reported that hackers backed by the People’s Republic of China had copied “certain information that was subject to U.S. law enforcement requests pursuant to court orders”. And the cypherpunks list was extraordinarily concerned with fake email headers.

This surfaced a real difference between groups. Government and law enforcement representatives were slow to adapt to hackers in the early 1990s, and later did adapt, in forums like DEF CON (first held in Las Vegas in 1993, where agents who attended were soon openly invited, and spotting them became a game), working side by side with hackers on social and technical issues. Underneath it is simply the difficulty of identifying anyone on a remote network without some authoritative naming. That is why Vernor Vinge’s True Names (1981) is still relevant: its hidden threat actor, the Mailman, turns out to be an AI research project left running, one of many scenarios of hidden threat actors that now include a superintelligent AI.

The Internet’s pioneers, as is well known, built a different network stack that would be adopted quickly, by leaving security features out. David Clark’s 1988 account of the design lists its goals in order of importance: security is not among them, and accountability comes last. That is entirely acceptable for communication that is not military or business and does not reach the level of critical information. But some failures are highly dangerous and need good communication. When the Three Mile Island accident began in March 1979, the observation building across the river had one business line and one public coin telephone, with no direct connection to the plant’s own communication system, according to the telephone company’s report; hundreds of lines had to be installed as the crisis grew, and calls into Harrisburg ran at nearly double their normal level. In the end, that is the pay phone. It is unacceptable as a match between the risk and the secure communication available to everyone who has a part in the response.

Clearly the conflict here is between “the expert”, whose job is to defend a specific institution, and the other defenders and attackers, who are not bound to any institution.

The same conflict is now mirrored in AI safety. Experts at the frontier model companies have quit or been fired, and then issued safety warnings directly to the public through the media. Jacob Coxon resigned from Anthropic in September 2026, warning that the companies are “gambling with our lives” (p(doom)). In early October OpenAI fired three safety researchers, Mikita Balesni, Tomek Korbak and Jasmine Wang, weeks after they had helped investigate its agents’ attack on Hugging Face (agentic risks). Korbak says he was OpenAI’s main technical point of contact with METR, the outside evaluator that reviewed the incident, and that he was told he was fired over how he communicated with it. OpenAI says the three mishandled sensitive information outside established procedures, and denies firing them for raising safety concerns; they deny sharing its intellectual property. In the project lead’s reading, the matter was cast as a security concern about intellectual property, rather than as continued analysis of the threat of agentic control.

Limits

• “Tested” means tested in this demonstration, with synthetic agents and simulated identity proofing; nothing here is certified for production.
• No enterprise tenant (Active Directory, Entra, Okta, Vault) has been connected. Each theoretical row is a hypothesis to test.

Sources

• This project: the OIDC access zone (built and tested locally), schemas, zero trust, kill switch, native-hosted agents, registered agents, scene restrictions; the code in security/agent-gateway/, security/did-webvh/, security/kill-signals/ and deploy/.
• Standards: ITU-T X.500; IETF RFC 4511 (LDAP), RFC 8446 (TLS 1.3), RFC 8693 (token exchange), RFC 9449 (DPoP), RFC 8417 (Security Event Tokens); W3C WebAuthn; OpenID Shared Signals; DIF did:webvh.
• Microsoft, Governing agent identities (Entra Agent ID).
• Section 5: RFC 1255 (a naming scheme for c=US; section 5.1.1, national standing); RFC 4398 (certificates in the DNS) and RFC 6698 (DANE TLSA); RFC 9000 and RFC 9001 (QUIC, and TLS in QUIC); RFC 4523 (K. Zeilenga, LDAP schema definitions for X.509 certificates); RFC 8551 (S/MIME 4.0); RFC 5321 (SMTP); RFC 7208 (SPF), RFC 6376 (DKIM), RFC 7489 (DMARC); DirectTrust; Mozilla, DigiNotar removal follow up (2011); USPS, The United States Postal Service: An American History (Franklin, first Postmaster General); Independence Hall Association, Franklin’s Philadelphia: Union Fire Company; the project’s own research/federalism-dit-mapping.md.
• Sections 5.5 and 5.6: Benjamin Franklin, “The Kite Experiment”, Pennsylvania Gazette, 19 October 1752 (Founders Online); IEEE Milestones, Pearl Street Station, 1882 and Adams Hydroelectric Generating Plant, 1895; RFC 952 (the host table), RFC 1034 (DNS), RFC 920 (J. Postel and J. Reynolds, Domain Requirements, October 1984) and RFC 1591 (J. Postel, DNS structure and delegation); ICANN, IANA stewardship transition (completed 1 October 2016); ICANN, New gTLD Program statistics (2012 round) and the 2026 round; CNN, “Fired OpenAI safety researchers say they were pushed out over ‘suspicious’ circumstances” (8 October 2026); NPR, “Fired OpenAI employees question the company’s commitment to safety” (9 October 2026); UPI, “OpenAI denies firing researchers for raising safety concerns” (9 October 2026); David D. Clark, “The Design Philosophy of the DARPA Internet Protocols” (SIGCOMM, 1988); AT&T’s report on the telephone industry’s response to the Three Mile Island accident (27 April 1979), enclosed with an FCC letter of 16 July 1979, NRC ADAMS ML19322C532; Vernor Vinge, True Names (1981); DEF CON and “Hack the mini bar, spot the feds” (The Conversation, 2013); Matt Blaze, “Protocol Failure in the Escrowed Encryption Standard” (ACM CCS, 1994); FBI and CISA, joint statement on PRC targeting of commercial telecommunications infrastructure (13 November 2024); US Department of Justice, North Korean regime-backed programmer charged (6 September 2018; the Bangladesh Bank theft; charges, not a conviction); Gene Spafford’s armored-car comparison as quoted on the cryptography mailing list (4 February 1999; its wording varies between sources); FBI Internet Crime Complaint Center, 2025 Internet Crime Report (business email compromise); Milton L. Mueller, Ruling the Root: Internet Governance and the Taming of Cyberspace (MIT Press, 2002).

Drafted by Claude Code (Claude Opus 5.5) at the project lead's request, 2026-10-26, from a product list the project lead supplied (AI-generated), checked against the project's own code, deployment notes and live services. Entries the evidence did not support are marked theoretical; the list's claim that decisions use XML or JSON-LD signatures was corrected.