Enforceable Trust for Enterprise AI Agents: A Framework for Establishing, Measuring, and Enforcing Agent Trustworthiness

This paper argued that trust in enterprise AI agents cannot be enforced while it remains a static attribute of an identity. EAT redefines trust as a computed state: gated by cryptographic identity and provenance, graded by attested and decaying evidence about behaviour, intent alignment and compliance, made conservative by explicit uncertainty, and bound mechanically to autonomy tiers and delegated-credential scope. The worked example and the simulation agree on why each element is needed. Scores alone react too slowly to severe events; circuit breakers contained hijacks in hours and cut hijack-driven unsafe actions by 99.6% relative to static access. Enforcement at credential issuance limits damage before the score reacts, and regulatory ceilings must stay independent of trust. The simulation also showed that a weighted composite hides a single degrading dimension, which motivates per-dimension floors alongside gates. The OWASP analysis shows strong coverage of identity, supply-chain, inter-agent and rogue-agent risks and partial coverage of semantic and human-factor risks, positioning EAT as the authority layer beneath content-level defences. Future work will (i) validate the behaviour floor and attribution-quality effects on independent scenarios and, where permitted, on anonymised deployment evidence; (ii) learn context-specific weights and floors from incident data under monotonicity constraints so that the model stays interpretable; (iii) extend trust composition to multi-agent collectives with collusion-resistant aggregation; (iv) express EAT trust states as verifiable credentials [26] so that trust can cross organisational boundaries; and (v) investigate reasoning-time assurance, such as search-based planners that generate counterfactual evidence of plan safety before execution, building on prior work on reasoning-as-a-service [50].

1.     Model Context Protocol, “Authorization,” Specification revision 2025-11-25. [Online]. Available: https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization 2.     A2A Project, “Agent2Agent (A2A) Protocol Specification,” Linux Foundation, 2026. [Online]. Available: https://a2a-protocol.org/latest/specification/ 3.     OWASP GenAI Security Project – Agentic Security Initiative, “OWASP Top 10 for Agentic Applications for 2026,” OWASP Foundation, Dec. 2025. [Online]. Available: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ 4.     H. Booth, W. Fisher, R. Galluzzo, and J. Roberts, “Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization,” NIST National Cybersecurity Center of Excellence, Concept Paper, Feb. 2026. [Online]. Available: https://csrc.nist.gov/pubs/other/2026/02/05/accelerating-the-adoption-of-software-and-ai-agent/ipd 5.     K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection,” in Proc. ACM Workshop on Artificial Intelligence and Security (AISec), 2023, arXiv:2302.12173. 6.     National Institute of Standards and Technology, “Artificial Intelligence Risk Management Framework (AI RMF 1.0),” NIST AI 100-1, Jan. 2023, doi: 10.6028/NIST.AI.100-1. 7.     High-Level Expert Group on Artificial Intelligence, “Ethics Guidelines for Trustworthy AI,” European Commission, Brussels, Apr. 2019. 8.     National Institute of Standards and Technology, “Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile,” NIST AI 600-1, Jul. 2024, doi: 10.6028/NIST.AI.600-1. 9.     ISO/IEC TR 24028:2020, “Information technology — Artificial intelligence — Overview of trustworthiness in artificial intelligence,” International Organization for Standardization, 2020. 10.   ISO/IEC 42001:2023, “Information technology — Artificial intelligence — Management system,” International Organization for Standardization, 2023.