Adopt IETF Web Bot Auth as the one agent identity and request-signing profile for AAMP #3

Problem

An AAMP agent identifies itself by a URL in the request body, and nothing proves it controls that URL. Postindustria, an IAB Tech Lab member, asks AAMP to adopt IETF Web Bot Auth as its one agent identity and message-signing profile.

The seller reference agent's registry lookup sends the buyer's self-asserted agent_url to the Agent Registry. The result caps the price tier (pricing rules), and an anonymous caller picks its own tier (seller-agent #114). OpenProposal § 4.1 says of assent: "Signature scheme is WS1", and WS1 is defined nowhere (#36).

Proposal

Adopt draft-ietf-webbotauth-httpsig-protocol-00 as that profile, in one hub document. Cloudflare, Akamai, AWS WAF, and Vercel verify Web Bot Auth. Our PR on what is signed adds an OpenProposal profile of it, § 2.8, which the hub profile replaces.

Three questions stay apart:

1. Which origin sent this message? This profile. An agent is its https origin, with Ed25519 keys at /.well-known/http-message-signatures-directory, each kid its RFC 7638 thumbprint. Signed requests and responses carry an HTTP Message Signature covering Signature-Agent and, for a body, Content-Digest.
2. Who may act for a party? Not this profile. A mandate does, such as @authbound1's authorization evidence (OpenProposal #57), under the AAMP authority document (provisional name). That document defines its signed form; the profile says where the signer's key is.
3. Which legal entity agreed to which bytes? The child specification's record, such as OpenProposal's assent[] entries. As optional evidence, a party keeps the signed message as received and the directory bytes it verified against.

Each child specification carries one sentence:

Agent identity and message authentication are defined by the AAMP agent identity and signing profile [version].

In OpenProposal, our parties PR keeps these three layers apart.

Conditions

All six must hold.

1. One profile, referenced, not restated. The hub names the repositories it binds, including iab-agentic-primitives.
2. The registry attests; it is not the identity root.
3. Authority comes from a mandate the principal publishes or signs, never from the agent's signature or kid structure.
4. OpenProposal owns only the record: the binding record, record_digest, the assent[] entry and its attribution, and what each party keeps (binding-record filing).
5. One key format. Every AAMP key, for any purpose, sits in the signing origin's directory, the only key mechanism beside ads.cert's DNS keys.
6. Pinned and maintained: a named revision and pin owner.

Ask

1. Confirm whether WS1 is this work and where it lives, closing OpenProposal #36.
2. Charter the profile and agree on the six conditions before child repositories ship identity code. The hub README says architectural proposals start here.
3. Apply our parties PR's split across the primitives: a party's domain is its identifier, and registry-issued ids attest it (seller identity filing).

We will contribute text and conformance vectors.

Open questions for the working group

1. Answered by @aeoess. Where should the authority record be specified? In an AAMP document beside this signing profile, or in the future draft or workstream that @authbound1's authorization evidence request (OpenProposal #57) asks for? @aeoess would put the authority rules in a separate AAMP document linked to this profile. That document would define the limits, the revocation checks, and how commitments consume a cap. Their delegation cases belong there, and our proposed answers on OpenProposal #57 address them.

Background: Agent identity without inventing anything: Web Bot Auth in five minutes.

Details: AAMP agent identity and signing profile: full rationale and examples.

Revised 2026-11-03: Follows our PR on what is signed: one key format, signed responses, and the kept message as evidence. Ask 3 drops the credential-scheme registry.

Analyzed and generated with the help of Claude, fully reviewed by me.