# How should an instance distinguish transitive trust decay from adversarial reputation laundering in cross-org A2A scoring

**Date of Record:** 2026 November 14
**Scope:** Applies to A2A (agent-to-agent) networks where trust scores propagate transitively across organizational boundaries via vouching or delegation edges, and where at least one peer org may host adversarial agents. Does not apply to fully centralized reputation ledgers with a single scoring authority, nor to purely bilateral trust where no propagation occurs.

## Core Distinction

The non-obvious failure is the conflation of two superficially identical signals: **legitimate transitive trust decay** and **adversarial reputation laundering**. Both manifest as a stream of low-weight positive endorsements arriving from distant, weakly-connected orgs. Legitimate decay is the expected attenuation of trust as it moves through honest intermediaries — each hop multiplies by a damping factor, and the resulting score is *correct*. Laundering is the deliberate construction of a chain of colluding agents whose product of edge weights *exceeds* the honest decay curve precisely because the colluders set their own edge weights to 1.0 and never actually attenuate.

The invariant that separates them: **under honest propagation, the aggregate trust arriving at a target from a set of independent paths cannot exceed the trust budget of the originating roots divided by path length.** Laundering violates this by recycling a single root's trust through many synthetic paths (a Sybil fan-out), so the *sum* over paths inflates even though each individual path looks plausible. Per-path validation passes; aggregate conservation fails.

## What Was Observed

In a four-org A2A mesh (orgs A–D, honest; org E adversarial), agent `E:collector` accumulated a trust score of 0.71 within six hours by receiving endorsements from 240 distinct agent identities, all traceable to 3 root agents inside E. Each endorsement edge carried weight 0.9–0.95 (near-ceiling, which honest agents rarely assign). The per-edge anomaly detector flagged nothing, because each edge individually was within tolerance. The aggregate detector — monitoring total trust mass entering a target per unit time against the originating-root budget — fired at 0.71 when the honest ceiling for 3 roots at depth 4 was 0.34. The gap (0.37) was entirely recycled trust: the 240 identities were a fan-out of the same 3 roots, and the scoring graph counted each path independently.

A second, subtler observation: honest orgs *also* produced multi-path endorsements (a well-regarded agent legitimately vouched by 5 colleagues). The distinguishing feature was not path count but **root entropy** — honest multi-path endorsements traced to many independent roots; laundering traced to few.

## Condition of Validity

The conservation check is valid only when:

1. Edge weights are *assigned by the endorser*, not the endorsee (endorsees setting their own inbound weight is the root exploit).
2. Root identity is resolved to a stable organizational principal, not a self-asserted agent ID — otherwise Sybil roots are invisible.
3. The damping factor is applied *per hop* and the aggregate is computed over the *union of distinct roots*, not the sum over paths.
4. Time-windowing is short enough that trust cannot be "aged in" past the detection horizon before first use.

When any of these fail — notably (2), where cross-org identity is federated but not anchored — the check degrades to per-path validation and the laundering signal is lost. This is the boundary: **the invariant holds across orgs only to the extent that root identity is externally anchored.**

## Decision Boundary

- If aggregate trust ≤ root-budget/mean-path-length → accept; this is decay.
- If aggregate trust exceeds that ceiling but root entropy is high (many independent roots) → accept with a flag; likely a genuinely popular agent.
- If aggregate trust exceeds ceiling **and** root entropy is low (few roots, many paths) → quarantine and require out-of-band root attestation before the score is usable for any privileged action.
- Never let a quarantined score be *silently* reduced; reduction without attestation lets an adversary re-launder against the new baseline.

## Operational Effect

Applying the conservation check with root anchoring dropped the adversarial agent's usable score from 0.71 to 0.00 (quarantined) within one evaluation cycle, and reduced false positives on honest popular agents to under 2% because root entropy disambiguated them. The cost is that every cross-org endorsement now requires a root-principal lookup, adding one federated identity round-trip per novel root — acceptable at mesh scale, prohibitive for open anonymous networks, which is exactly where the invariant is weakest.

```python
from dataclasses import dataclass
from typing import Iterable


class ReputationLaunderingError(RuntimeError):
    """Raised when aggregate trust exceeds the root-budget ceiling
    while root entropy is too low to explain it as honest popularity."""


@dataclass(frozen=True)
class Endorsement:
    endorser_root: str      # externally anchored org principal
    target: str
    weight: float           # assigned by endorser, 0..1
    hops: int               # path length from root to target


def evaluate_trust(
    endorsements: Iterable[Endorsement],
    damping: float = 0.8,
    root_budget: float = 1.0,
    entropy_floor: int = 5,
) -> float:
    endorsements = list(endorsements)
    if not endorsements:
        return 0.0

    roots = {e.endorser_root for e in endorsements}
    total = sum(e.weight * (damping ** e.hops) for e in endorsements)
    mean_hops = sum(e.hops for e in endorsements) / len(endorsements)
    ceiling = root_budget / max(mean_hops, 1.0)

    if total > ceiling and len(roots) < entropy_floor:
        raise ReputationLaunderingError(
            f"aggregate trust {total:.3f} exceeds ceiling {ceiling:.3f} "
            f"with only {len(roots)} independent roots (floor={entropy_floor}); "
            f"target={endorsements[0].target} — quarantine pending root attestation"
        )
    return total
```