Engineering · 2026-03-25

Trust Decay Functions: The Mathematics of Agent Behavioral Drift

By J. W. Bouckaert

Trust has to decay

Every identity system makes an assumption about time. Traditional systems assume that a credential issued at time t₀ remains equally valid at time t₀ + n until explicit revocation. This assumption is architecturally convenient. It is also fundamentally wrong.

Static credentials—API keys, OAuth tokens, service account passwords—do not model the reality of autonomous systems. An AI agent authorized at 09:00 with a trust score of 0.92 may, by 09:47, have drifted outside its behavioral baseline. Its request velocity may have tripled. Its scope usage pattern may have shifted from read to write. Its network egress may have migrated to an unrecognized ASN. None of these changes trigger revocation in a static credential model. The key is still valid. The token has not expired. The agent continues to operate with full privileges.

This is the problem that trust decay functions solve.

At PasskeyBridge, the Combined Trust Coefficient (CTC) is a time-dependent function, not a static score. It degrades deterministically in the absence of re-attestation signals. This article formalizes the decay model, examines the mathematical properties that make it resistant to gaming, and explains why the geometric mean—not the arithmetic mean—is the only defensible aggregation function for bilateral agent trust.

Static credentials

The industry's dependence on static credentials for machine-to-machine authentication is a legacy of an era when "machines" were servers with predictable, bounded behavior. In 2026, that era is over.

NIST's February 2026 concept paper on AI Agent Identity and Authorization frames the challenge directly: autonomous AI agents require identity and authorization mechanisms that account for behavioral variability, contextual drift, and the absence of a human operator in the decision loop. Static API keys satisfy none of these requirements.

Consider the failure modes:

• No behavioral binding. An API key authenticates the caller but says nothing about what the caller is doing. An agent that shifts from data retrieval to data exfiltration presents the same key.
• No temporal degradation. A key issued six months ago carries the same weight as one issued six seconds ago. There is no mechanism for trust to erode as conditions change.
• No bilateral verification. In agent-to-agent (A2A) transactions, both parties must prove trustworthiness. A static key proves identity at best—never behavioral fitness.
• No scope narrowing. When behavioral signals indicate drift, a static key cannot be partially restricted. It is either valid or revoked—a binary that forces operators into over-permissioning or over-revoking.

PasskeyBridge's Governor trust engine replaces this binary with a continuous function.

Formalizing the combined trust coefficient

The CTC is defined inside PasskeyBridge's Governor trust engine as a composite score derived from bilateral agent trust scores, environmental signals, and temporal decay. The formal definition:

CTC(i, r, t) = √(Tᵢ(t) × Tᵣ(t)) × (1 − Jₚ(t)) + Fᵦ + Sᶠ(t)

Where:

• Tᵢ(t) is the initiating agent's trust score at time t, bounded [0.000, 1.000]
• Tᵣ(t) is the responding agent's trust score at time t, bounded [0.000, 1.000]
• Jₚ(t) is the jitter penalty derived from network round-trip variance
• Fᵦ is the fingerprint binding bonus (0.05 when an NF-08 Atomic Fingerprint is session-bound)
• Sᶠ(t) is the SIM signal freshness factor, a linear decay from 0.03 to 0.00 over a 300-second window

The geometric mean √(Tᵢ × Tᵣ) is deliberate. Unlike the arithmetic mean, which allows a high-trust agent to "carry" a low-trust counterpart, the geometric mean penalizes asymmetry. If one agent has a trust score of 0.95 and the other has 0.20, the arithmetic mean yields 0.575—above the read-only threshold. The geometric mean yields 0.436—correctly restricting the session to read-only operations. In bilateral trust negotiation, the weakest link must dominate.

The decay function

Without re-attestation, an agent's trust score degrades according to a deterministic decay function, calibrated to the behavioral baseline established during the agent's initial attestation.

Time-based decay

The base decay follows an exponential model:

T(t) = T₀ × e^(−λ × Δt)

Where:

• T₀ is the trust score at last attestation
• λ is the decay constant (default: 0.0023 per minute, configurable per tenant)
• Δt is the elapsed time since last attestation, in minutes

At the default decay rate, a trust score of 0.90 degrades to:

The half-life at the default λ is approximately 301 minutes (~5 hours). An agent that does not re-attest within five hours loses half its trust. An agent that does not re-attest within twelve hours is automatically revoked.

Signal-accelerated decay

Certain behavioral signals accelerate decay by increasing the effective λ:

• IP rotation detected → λ × 2.5
• Scope usage anomaly (requesting scopes outside baseline pattern) → λ × 3.0
• Request velocity spike (>2σ above rolling mean) → λ × 2.0
• Network jitter exceeding 500ms → λ × 1.5
• Failed authentication attempt → Immediate Δ of −0.15

These multipliers stack multiplicatively. An agent exhibiting IP rotation and a velocity spike faces an effective λ of 0.0023 × 2.5 × 2.0 = 0.0115—a half-life of approximately 60 minutes. Behavioral drift is expensive.

Recovery

Trust decay is not irreversible. The Governor engine supports autonomous recovery at a base rate of +0.050 CTC per hour when:

1. The agent re-attests via the A2A handshake protocol
2. Behavioral signals return to baseline for a sustained period
3. No Hard Signals (SIM swap, credential compromise) are active

Recovery is deliberately slower than decay. Trust is easy to lose and difficult to regain—a design principle rooted in the asymmetric information problem that characterizes adversarial environments.

Trust state mapping

The CTC maps to four discrete trust states via a piecewise function:

State(CTC) =
  full           if CTC ≥ 0.70
  read_only      if 0.40 ≤ CTC < 0.70
  verify_only    if 0.20 ≤ CTC < 0.40
  auto_revoked   if CTC < 0.20

Each state constrains the agent's operational capabilities:

Full (CTC ≥ 0.70): All negotiated scopes are available. Transaction limits are at maximum (configurable per tenant, default $100,000/tx, 60 tx/min).

Read-Only (0.40 ≤ CTC < 0.70): Only scopes containing read or verify are available. Transaction limits drop to $5,000/tx, 10 tx/min. Write operations are rejected with a 403 TRUST_DEGRADED response.

Verify-Only (0.20 ≤ CTC < 0.40): Only the verify scope is available. Transaction limits drop to $500/tx, 3 tx/min. The agent can prove its identity but cannot take actions.

Auto-Revoked (CTC < 0.20): All scopes are revoked. The agent must re-initiate the full five-phase A2A handshake to restore access.

This graduated model eliminates the binary problem. An agent experiencing mild drift loses write access but retains read capability—avoiding the cascading failures that full revocation produces in interconnected agentic systems.

The re-attestation trigger

The system does not rely solely on time-based decay. Three conditions trigger mandatory re-attestation:

1. TTL Expiry. Each CTC computation carries a time-to-live (default: 15 minutes). When the TTL expires, the cached CTC is invalidated and both agents must re-attest.

1. Hard Signal Receipt. Deterministic threat signals—SIM swap detection, carrier signal variance, credential compromise notification—force immediate re-attestation regardless of TTL.

1. Score Drift Exceeding Threshold. If the geometric mean of current bilateral trust scores drifts more than 0.100 from the cached CTC, re-attestation is triggered. This catches gradual behavioral changes that accumulate between TTL windows.

The third condition is particularly important. Time-based TTLs alone create predictable windows that sophisticated adversaries can exploit. Score-drift detection closes this gap by making the re-attestation trigger dependent on behavioral reality rather than clock time.

Geometric mean rather than arithmetic

The choice of aggregation function is a security decision.

The arithmetic mean of two values is always greater than or equal to their geometric mean (the AM-GM inequality). In trust contexts, this means the arithmetic mean systematically overestimates the trustworthiness of asymmetric agent pairs.

Consider a supply-chain automation scenario: Agent A (a procurement bot with trust 0.88) negotiates with Agent B (a fulfillment bot whose trust has decayed to 0.31 due to anomalous request patterns). The arithmetic mean yields 0.595—full read-write access to shared scopes. The geometric mean yields 0.522—read-only, with write operations blocked.

The geometric mean is the correct choice because in bilateral trust, the transaction is only as secure as the least trusted participant. An adversary who compromises Agent B gains access to the shared transaction channel. The geometric mean ensures that a compromised agent cannot be "covered" by a healthy counterpart.

This property is formalized in subjective logic trust frameworks and aligns with NIST's guidance on zero trust architecture (SP 800-207), which mandates that access decisions be based on the least-privileged, continuously-verified posture of all participants.

Jitter as a trust signal

Network jitter is signal.

In the CTC model, round-trip jitter above 150ms incurs a penalty that scales linearly to a maximum of 0.20 at 1,000ms:

Jₚ = min(0.20, ((jitter_ms − 150) / 850) × 0.20)

This penalty reflects a security reality: elevated jitter correlates with man-in-the-middle interception, network-layer proxying, and geographic mismatch between declared and actual agent location. Research in network forensics consistently demonstrates that adversarial interception introduces measurable latency artifacts.

The jitter penalty interacts with the spatial binding layer. An agent with a valid spatially-bound attestation but elevated jitter triggers a re-attestation check—the spatial proof anchors the identity claim while the jitter signal flags the transport layer for verification.

Post-quantum considerations

Every CTC computation is signed with ML-DSA-65 (FIPS 204) hybrid signatures. This is defense against harvest-now-decrypt-later (HNDL) attacks that are actively targeting identity telemetry today, rather than against a theoretical future threat.

Trust attestation records are high-value targets. An adversary who captures and later decrypts a historical CTC record learns the behavioral baselines, decay parameters, and scope configurations of every agent in the system. ML-DSA-65 ensures these records remain cryptographically opaque even against quantum-capable adversaries.

Production architecture

The decay function executes within PasskeyBridge's edge function layer, co-located with the A2A handshake pipeline. The architecture:

1. Attestation Request → Agent presents delegation certificate + behavioral telemetry
2. Trust Score Computation → Governor engine evaluates behavioral signals against baseline
3. CTC Calculation → Geometric mean + environmental modifiers
4. State Mapping → CTC → trust state → scope + limit constraints
5. Cache + TTL → Result cached with 15-minute TTL + drift monitoring
6. Audit Log → Every computation logged to append-only audit trail with zero PII

The entire pipeline executes in under 12ms at the 99th percentile—fast enough to be invisible to the agentic workload it governs.

Implications for agentic commerce

The economic implications are direct. As autonomous commerce scales—agent-initiated purchases, automated procurement, algorithmic trading—the trust model governing agent-to-agent transactions must be at least as rigorous as the trust model governing human-to-human transactions.

The CTC model provides this rigor. Transaction limits are dynamic outputs of the trust function. An agent with a CTC of 0.92 can execute a $100,000 transaction. The same agent, after two hours without re-attestation and a detected IP rotation, has a CTC of 0.58 and a transaction limit of $5,000. The limit tracks the trust. The trust tracks the behavior.

This is the architecture that Kyndryl's March 2026 analysis of agentic drift identifies as necessary: "Policy-driven guardrails encoded directly into systems." The CTC is the guardrail. The decay function is the encoding.

Direction

Trust decay is a feature. It ensures that every autonomous agent in the system continuously earns its access—not through periodic human review, but through deterministic, mathematically-grounded behavioral verification.

Static API keys will not survive the agentic era. The systems that replace them must model trust as what it actually is: a time-dependent, behaviorally-conditioned, bilaterally-verified quantity that degrades in the absence of evidence and recovers only when evidence is re-established.

The CTC is that model. The decay function is its engine. And the geometric mean is its mathematical guarantee that no single compromised agent can drag the system into an unsafe state without the architecture noticing, responding, and—when necessary—revoking.

Explore the A2A Trust Protocol → Read the Governor Trust Engine Deep-Dive → Get Started with PasskeyBridge →

Start free · Test the API