Michael P Andersen, Sam Kumar, Moustafa AbdelBaky, Gabe Fierro, John Kolb, Hyung-Sin Kim, David E. Culler, and Raluca Ada Popa, University of California, Berkeley
UCAN - User Controlled Authorization Network
A trustless, secure, local-first, user-originated, distributed authorization scheme.
UCAN Working Group
Decentralized Auth — User Controlled Authorization Networks - UCAN Working Group
Decentralization Trade Offs in AT Protocol and ActivityPub DWeb Camp 2026
Christine Lemmer Webber is lead author and co-editor of the W3C ActivityPub specification. Daniel Holmgren is Head of Protocol at Bluesky, working on the AT Protocol specification at the IETF. Join us for a discussion on decentralization trade-offs and other design decisions in the two protocols, and what that means for different architectures, structures, and even future points of convergence. Moderated by Boris Mann
Solving AT Protocol's Centralized Identity - blog.boscolo.co
I spent the weekend building a proof of concept for a truly decentralized DID method using Farcaster's battle-tested identity system. Here's why AT Protocol needs this third DID option.
The Matrix Autumn Special!
Matrix, the open protocol for secure decentralised communications
AT Protocol, OAuth, and well, decentralization
I've been very happy with how Bluesky and AT Protocol as a whole is going, except for one thing: OAuth.
A Call to Arms: Supporting Matrix!
Matrix, the open protocol for secure decentralised communications
Protocol: How Control Exists after Decentralization by …
How Control Exists after Decentralization by Galloway, …
Holographic consensus—part 1
Decentralized governance is the field of protocols that coordinate large number of agents into a collective action, implemented with smart…
Decentralised Identity 🤝 Mesh Networking - Thinking with portals
How you can invite your Bluesky friends into your Tailscale network using an OIDC shim
a practical guide to decentralization (for my friends) - tim's tinkerings
AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A
AI agents increasingly call tools via the Model Context Protocol (MCP) and delegate to other agents via Agent-to-Agent (A2A), yet neither protocol verifies agent identity. A scan of approximately 2,000 MCP servers found all lacked authentication. In our survey, we did not identify a prior implemented protocol that jointly combines public-key verifiable delegation, holder-side attenuation, expressive chained policy, transport bindings across MCP/A2A/HTTP, and provenance-oriented completion records. We introduce Invocation-Bound Capability Tokens (IBCTs), a primitive that fuses identity, attenuated authorization, and provenance binding into a single append-only token chain. IBCTs operate in two wire formats: compact mode (a signed JWT for single-hop cases) and chained mode (a Biscuit token with Datalog policies for multi-hop delegation). We provide reference implementations in Python and Rust with full cross-language interoperability. Compact mode verification takes 0.049ms (Rust) and 0.189ms (Python), with 0.22ms overhead over no-auth in real MCP-over-HTTP deployment. In a real multi-agent deployment with Gemini 2.5 Flash, AIP adds 2.35ms of overhead (0.086% of total end-to-end latency). Adversarial evaluation across 600 attack attempts shows 100% rejection rate, with two attack categories (delegation depth violation and audit evasion through empty context) uniquely caught by AIP's chained delegation model that neither unsigned nor plain JWT deployments detect.
An equitable company - Roomy
decentralized networking is best realized with decentralized ownership