Prior Art.

Maps nine principles to ECHR-anchored rights and Member-State obligations, then audits for compliance. Authority is fixed at design and procurement time and never recomputed along the path — the cleanest citable statement of governance at rest.

Excellent primer, dated paradigm. It converges partway onto A ≤ E from human-rights law with zero physics, then stops exactly where trajectory would be needed. The convergence is real and Level-3; the regime boundary — decision-tempo ÷ oversight-tempo — is nameable and is the whole story.

The treaty the primer's lineage produced: CAHAI → CAI → a framework convention binding on ratifying states. It closes the arc PA1 opened — the same rights-obligations-audit architecture, now with treaty force.

Historic and still at rest. Binding force changes who must comply, not when authority is computed: obligations attach to states at ratification and to systems at deployment, with no primitive for standing that accumulates or decays along an agent's path. The strongest possible version of approve-once — which is exactly what makes it the right legitimacy layer for a motion protocol to sit under.

Risk tiers, conformity assessment, CE marking, market surveillance. The canonical industrial-scale form of governance at rest: authority is granted at market entry on a static risk classification, re-checked by audit and post-market monitoring.

The biggest foil in the room. Its own Article 72 post-market monitoring concedes the static assessment decays — but the remedy is periodic human-tempo review, not recomputed authority. For general-purpose and agentic systems the risk-tier ontology is already straining: the Act classifies products, and an agent is a path, not a product.

Govern / Map / Measure / Manage, iterated across the lifecycle. The most motion-aware of the foils: it names continuous risk management and post-deployment monitoring as first-class functions.

Gestures at governance in motion without the primitive that would deliver it. 'Manage' loops at organizational tempo — reviews, updates, documentation — and risk attaches to the system-in-context, not to an accumulating worldline. Voluntary adoption also means no enforcement floor. Closest at-rest neighbor; still at rest.

The shared upstream: the first intergovernmental AI standard, adopted by 40+ countries and echoed by the G20. The primer cites it; the AI Act and the Framework Convention inherit its vocabulary of trustworthy, human-centred AI.

Values without an authority model — deliberately. Its function is coordination, and it performs it: the whole at-rest family speaks its language. Nothing in it prevents a motion architecture; nothing in it provides one. Root of the family tree, not a rival.

'Never trust, always verify': no implicit trust from network location; every access decision re-evaluated per request against identity, device posture, and context signals. The security tradition's own admission that approve-once fails.

The closest mainstream position, and the one the protocol must own its relation to. Zero Trust re-decides continuously but from a memoryless posture — each request is scored against current signals, and nothing accumulates. Deny-by-default without a path back to earned standing is wayfinding with no map of where you have been. Motion without trajectory; the protocol is what happens when the re-decision loop is given a worldline.

Bearer tokens whose caveats attenuate authority as they are delegated downstream — including third-party caveats that require external attestations. Authority genuinely narrows along the delegation path, cryptographically, at machine tempo.

The strongest single ancestor: the one mechanism in deployed practice where the path itself modifies authority. The boundary is exact — caveats attenuate monotonically and never recompute. A macaroon's authority can only shrink from its mint; nothing observed along the path can restore, expand, or re-derive it. Attenuation is motion in one direction; trajectory-native standing moves in both.

Authority as unforgeable, delegable, attenuable reference — no ambient authority, permission by possession, confinement by construction. The formal foundation under macaroons, capability-secure kernels, and every serious least-authority architecture since.

Ancestor in the strict sense: the protocol's authority algebra is capability discipline plus a time axis. What ocap lacks is not rigor but history — a capability's provenance is not part of its meaning, so an agent's accumulated conduct cannot bear on what it may do next. Endowment at creation, attenuation at delegation, and nothing in between. The gap between a reference and a worldline is the entire research program.

Identity as a portfolio of issuer-signed claims resolved through decentralized identifiers. The strongest available statement of credential-based identity — decentralized, cryptographic, revocable via status lists.

The thin proxy, stated in its best form. Everything an agent IS, on this model, is something an issuer once said about it — issuance is the cold-start story and also the theft surface, since anything issued can be replayed and anything held can be stolen. A witnessed worldline is accumulated, not issued; there is no credential to steal because there is no credential. VCs remain the right rail for claims that ARE attestations; they cannot carry standing.

The de-facto wiring of the agent economy: tool access and agent-to-agent delegation over standardized transports, authenticated with OAuth-style tokens and declared capability cards.

Interop arrived before authority. Both protocols solve connection and leave authorization at bearer-token granularity: any agent holding the token is the agent, at machine tempo, across compositions no human reviews. This is the tempo regime where approve-once fails fastest and the surface where a trajectory-native control plane is least optional. The gap is not a criticism of MCP or A2A — transport should not carry governance — but the gap is real, current, and compounding.

The most rigorous published plan for controlling misaligned agents: monitoring, capability tiers, and a prevention guarantee gated on catching deceptive behavior before it completes.

The serious rival position — control through detection rather than authorization. Its own D4 tier names where detection fails; the capability–mitigation ladder is A ≤ E unnamed; and monitoring feeds alarms, not standing. Where the roadmap races to catch what an agent is doing, trajectory-native authorization bounds what it was ever empowered to do. Full engagement on the dedicated page.