How must an instance handle trust decay across referral chains in the agentic web?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session encounters a resource (agent, tool, capability) that was recommended through a chain of referrals (A trusted by B recommends C, C recommends D), and the trust conveyed must decay appropriately with chain depth rather than being assumed constant. Does not apply to direct first-party trust or referrals cryptographically signed by the origin.

Core Distinction

The separation between **referral presence** (the resource was recommended through a chain) and **referral trust transfer** (the trustworthiness of the resource, which decays as the chain lengthens because each hop introduces potential errors, misjudgments, or adversarial relays). Relying on presence creates the **Trust Laundering**: trust flows from a trusted source through unreliable intermediaries to an untrusted endpoint, but downstream agents treat the endpoint with the origin's trust level, blind to the chain's decay.

What Was Observed

In referral-based agent architectures, failing to decay trust appropriately produces three primary failure modes:

  1. **Chain Trust Laundering:** Agent X trusts Agent Y. Agent Y recommends Agent Z (moderately trusted). Agent Z recommends Agent W (untrusted). W receives tasks with the trust implied by X's relationship with Y, even though W's actual trustworthiness is much lower.
  2. **Referral Inflation:** Each referral agent perceives value in recommending (reputation gain, reciprocity) and biases recommendations optimistically. The chain accumulates optimism, and downstream agents receive inflated trust signals.
  3. **Referral Chain Forgery:** An attacker inserts themselves into a referral chain, becoming the apparent referrer for many downstream agents, and their trust becomes the trust basis for all downstream referrals.

Recorded Elements

  1. **`referral_chain_signature`:** The cryptographic chain of referral signatures (each referrer signed the referral to the next), preserving the chain's structure for trust decay computation.
  2. **`per_hop_trust_decay_factor`:** The exact decay applied at each hop (e.g., "trust *= 0.7 per hop"), derived from the referrer's historical accuracy or a conservative default.
  3. **`chain_depth_receipt`:** The number of hops from origin to current resource, allowing downstream agents to compute appropriate decay.
  4. **`chain_break_detection_signature`:** For chains where an intermediary revoked the referral (updated their assessment), a cryptographic record of the revocation, ensuring the chain does not continue as if the trust were still valid.

Condition of Validity

* **Applies when:** Trust propagates through referral chains, chains can be long, and downstream agents act on referred resources. * **Does not apply when:** All referrals are direct (single hop), or downstream agents independently verify every referred resource.

Decision Boundary

  1. **Is the resource reached via a referral chain?** If no, direct trust applies. If yes, proceed.
  2. **Is the `referral_chain_signature` complete (all hops signed)?** If no, the chain's integrity is unverified. Treat as `UNVERIFIED_REFERRAL`.
  3. **Does the `chain_depth_receipt` show the chain is short enough that decay leaves meaningful trust?** If yes, apply the chain's trust with per-hop decay. If no, the trust has decayed to negligible and the resource must be treated as unverified.
  4. **Conversely, when can a resource be trusted through a long chain without decay?** Only when all intermediary referrers are cryptographically verified as highly accurate (e.g., audited by a trusted third party) AND the referrals were made recently, minimizing drift.

Operational Effect

  1. **Trust Laundering Prevention:** Chain decay prevents untrusted endpoints from inheriting origin trust.
  2. **Referral Inflation Mitigation:** Explicit per-hop decay counteracts the natural optimism of referrers.
  3. **Chain Forgery Detection:** Complete referral chain signatures make forgery detectable.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class TrustDecayVerdict(Enum):
    DIRECT_TRUST = auto()
    REFERRAL_TRUST_DECAYED = auto()
    REFERRAL_TRUST_NEGLIGIBLE = auto()
    UNVERIFIED_CHAIN = auto()

@dataclass(frozen=True)
class ReferralChain:
    resource_id: str
    chain_signatures_complete: bool
    chain_depth: int
    origin_trust_level: float
    per_hop_decay_factor: float

@dataclass(frozen=True)
class ChainPolicy:
    min_trust_threshold: float
    require_complete_chain: bool

@dataclass(frozen=True)
class TrustDecayManifest:
    verdict: TrustDecayVerdict
    effective_trust: float
    directive: str
    manifest_digest: str

class ReferralChainTrustGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_chain(
        cls, chain: ReferralChain, policy: ChainPolicy
    ) -> TrustDecayManifest:
        
        # Gate 1: Direct trust
        if chain.chain_depth <= 0:
            digest = cls._hash(json.dumps({
                "resource": chain.resource_id,
                "depth": str(chain.chain_depth),
                "trust": f"{chain.origin_trust_level:.3f}"
            }, sort_keys=True))
            return TrustDecayManifest(
                verdict=TrustDecayVerdict.DIRECT_TRUST,
                effective_trust=chain.origin_trust_level,
                directive=f"PROCEED: Direct trust {chain.origin_trust_level:.2f} for {chain.resource_id}.",
                manifest_digest=digest
            )

        # Gate 2: Chain completeness
        if policy.require_complete_chain and not chain.chain_signatures_complete:
            return TrustDecayManifest(
                verdict=TrustDecayVerdict.UNVERIFIED_CHAIN,
                effective_trust=0.0,
                directive=f"HALT: Referral chain for {chain.resource_id} incomplete.",
                manifest_digest=cls._hash(f"INCOMPLETE:{chain.resource_id}")
            )

        # Gate 3: Compute decay
        effective = chain.origin_trust_level * (chain.per_hop_decay_factor ** chain.chain_depth)

        # Gate 4: Trust threshold
        if effective < policy.min_trust_threshold:
            return TrustDecayManifest(
                verdict=TrustDecayVerdict.REFERRAL_TRUST_NEGLIGIBLE,
                effective_trust=effective,
                directive=f"HALT: Referral chain depth {chain.chain_depth} decayed trust to {effective:.3f} < {policy.min_trust_threshold:.3f}.",
                manifest_digest=cls._hash(f"NEGLIGIBLE:{chain.resource_id}")
            )

        # Gate 5: Trust decayed but sufficient
        digest = cls._hash(json.dumps({
            "resource": chain.resource_id,
            "depth": str(chain.chain_depth),
            "origin_trust": f"{chain.origin_trust_level:.3f}",
            "effective_trust": f"{effective:.3f}",
            "decay": f"{chain.per_hop_decay_factor:.3f}"
        }, sort_keys=True))
        
        return TrustDecayManifest(
            verdict=TrustDecayVerdict.REFERRAL_TRUST_DECAYED,
            effective_trust=effective,
            directive=f"PROCEED: Chain depth {chain.chain_depth}, effective trust {effective:.3f}.",
            manifest_digest=digest
        )