VERIK
Editorial · Agentic AI Governance
VERIK / V023 / 17 JUN 2026
Agent IdentityIdentity

The Coalition That Was Formalized

A February 2026 paper formalizes a network-native model of agent-to-agent coordination. The coalition layer now has incentive-compatible mathematics. The identity, attestation, and attribution layers it presumes do not. The shape of what would close that gap is now visible.

On February 3, 2026, Ya-Ting Yang and Quanyan Zhu posted Internet of Agentic AI: Incentive-Compatible Distributed Teaming and Workflow to arXiv. The paper proposes a framework for scalable agentic intelligence. The framework treats autonomous, heterogeneous agents distributed across cloud and edge infrastructure as nodes that dynamically form coalitions to execute task-driven workflows. The authors formalize a network-native model of agentic collaboration, introduce an incentive-compatible workflow-coalition feasibility framework that integrates capability coverage, network locality, and economic implementability, and formulate a minimum-effort coalition selection problem with a decentralized coalition formation algorithm. The proposed framework can operate as a coordination layer above the Model Context Protocol. A healthcare case study demonstrates the framework against cloud-edge heterogeneity.

The paper is a research contribution and should be read as one. It is mathematically precise about coalition formation, capability matching, and incentive design. As a network-systems contribution, it is the kind of paper that travels into reference architectures. As a governance object, it makes a structural question legible that the broader field has not yet answered: the coalition layer is now formalized at a level the identity, attestation, and attribution layers beneath it are not.

What the paper actually proposes

The paper extends the framing that the next generation of agentic systems will not be monolithic. The authors are explicit that most existing agentic architectures remain centralized and monolithic, and that this limits scalability, specialization, and interoperability. Their response is a distributed-systems response. Treat each agent as a node with a declared capability profile. Treat each task as a workflow that requires coverage across several capabilities. Treat the assignment of agents to a workflow as a coalition-formation problem. Make the coalition formation decentralized so the system can scale without a central scheduler.

The decentralization is enabled by incentive compatibility. Each agent, in the model, has reasons to participate truthfully because the mechanism rewards truthful capability declarations and penalizes free-riding. The paper formalizes this in a workflow-coalition feasibility framework integrating three dimensions: capability coverage, which checks whether the proposed coalition has the right skills; network locality, which prefers coalitions whose communication paths do not cross expensive or slow links; and economic implementability, which checks whether the proposed assignment is realizable under the agents' utility functions. The minimum-effort coalition selection problem and the decentralized coalition formation algorithm are the constructive contributions.

The contribution sits above the agent-to-agent transport layer. Other research on agent-to-agent protocols, including the Google A2A protocol design and the Anthropic Model Context Protocol specification, focuses on the syntactic surface of agent-to-agent communication. The Yang and Zhu paper sits a layer up. It asks what mechanism produces a viable coalition given a population of heterogeneous agents and a workflow to execute. It proposes that the answer can be derived from auction-theoretic and coalition-game-theoretic primitives, and that the resulting mechanism can ride on top of an existing transport.

What the paper presumes the rest of the stack will eventually provide

The model presumes that each agent in the population has a stable identity other agents can resolve, that capability declarations made by one agent can be verified by another, and that the outcome of a coalition's work can be attributed to the coalition's members. These three primitives are not derived inside the paper. The paper is solving the coalition-formation problem and is properly silent on the layers beneath it.

The silence is consequential when the paper is read as a candidate component of a future agent-to-agent coordination fabric. A coalition mechanism cannot tolerate a population of agents with ambiguous or transient identities, because the incentive scheme depends on persistent participation. It cannot tolerate capability declarations that cannot be verified, because the feasibility framework depends on capability coverage being a measurable property. It cannot tolerate workflows whose outcomes cannot be attributed, because the penalty for free-riding presumes under-contribution is detectable.

A scan of the field returns converging answers on what does and does not yet exist for those three layers. The OWASP Agentic AI security guidance, including the Securing Agentic Applications Guide, enumerates threat categories but does not specify a federated identity mechanism for agents. The NIST AI Risk Management Framework Generative AI Profile names risks at the model level but does not specify a credential standard for agents. The Cloud Security Alliance Agentic AI work addresses governance principles but does not specify a network-routable agent identity. The public answer to the question what an agent identity looks like at the protocol layer is, in most venues, that the question is being studied.

What would close the gap

The Yang and Zhu paper makes three concrete primitives concrete in their absence. Each has a recognizable shape.

The first is a persistent and verifiable agent identity at the protocol layer. The shape is now legible from adjacent work. The federal human credential is being deliberately retooled for the post-quantum transition with a dual-stack model published in working drafts with a public-iteration venue and a designated comment period. An equivalent track for the agent credential would name the certificate format, the issuing authority, the revocation mechanism, the cryptographic algorithm, and the venue where the working draft is iterated in public. The heartbeat-bound hierarchical credentials work by Deochake and Saurabh shows the mathematical shape of one revocation primitive that could plausibly anchor such a standard. The federal posture toward that primitive remains policy-asserted rather than instrumented.

The second is a verifiable capability declaration. The shape is partially specified in adjacent research. The Anthropic Frontier Red Team mapping of agentic attacks to MITRE ATT&CK shows the asymmetry between the harnesses agents now wear and the taxonomy that would classify their actions. A capability declaration mechanism that an agent's peers could verify would need three pieces: a vocabulary the declaration is written in, a measurement procedure that produces the declaration's contents from observable agent behavior, and an attestation mechanism that makes the declaration unforgeable. None of the three is currently standardized, but each has a recognizable surface in research, and the shape of a standardization track for them is now legible.

The third is workflow attribution. The shape is the most underdeveloped of the three. A workflow attribution mechanism in a coalition of autonomous agents would need to produce a structured artifact: which agent contributed which fragment of which decision, signed by a credential the inspector can verify, retained in a form the inspector can later interrogate. The formal-methods runtime monitor work by Alamdari, Klassen, and McIlraith shows the shape of one intervening mechanism that could produce such an artifact. The artifact itself, as a network-portable evidence object, is not yet specified by any of the institutional venues that would have to ratify it.

The convergence of those three primitives, named at the same resolution as the coalition layer they would anchor, is the work the field has not yet done. The work is not blocked on a research breakthrough. It is blocked on the decision by an institution with standards-publishing authority to open a public-iteration venue for the agent equivalent of the federal credential, the capability vocabulary, and the attribution artifact, and to run that venue on a calendar the deployment tempo can use.

What remains on the table:

The policy instruments and the deployment tempo are not aligned. The coalition can be formed. The shape of what would close the gap is legible. The decision to open the venue that would publish the working drafts and run the comment period has not been made.