A trust coefficient is a continuously maintained numeric score of an agent's trustworthiness, derived from its behavioral history, scope usage, and environmental signals, that maps to concrete authority: what it may do, how much it may move, how fast. Unlike binary allow/deny, coefficients enable graduated authority that degrades under anomaly and recovers slowly.
A coefficient is only meaningful if something consumes it. Mapped to concrete ceilings, a transaction limit, a request rate, an allowed scope set, it changes behaviour continuously; reported on a dashboard and nowhere else, it is a number that describes a system rather than governing one.
The design decision worth making explicitly is what a coefficient may do on its own and what requires a hard signal. A score that can revoke is a score that can be gamed into revoking.
A coefficient earns its keep only where something consumes it. Mapped to concrete ceilings, a transaction limit, a request rate, an allowed scope set, it changes behaviour continuously and its effect is observable; rendered on a dashboard and nowhere else, it is a number that describes the system rather than governing it, and nobody notices when it stops being computed correctly.
The inputs deserve the same scrutiny as the output. A score assembled from behavioural history is a model, and like any model it can drift, be gamed, or encode an accident of its training window. Recording which inputs moved a coefficient, and being able to restate that at review time, is what keeps it from becoming the kind of unreviewable score that a trust signal is defined against.
The decision worth making explicitly is what a score may do alone. A coefficient that can revoke is a coefficient an attacker can push toward revoking, which turns a security control into a denial-of-service lever; reserving irreversible actions for hard evidence, and letting the score govern graduated limits, keeps both properties.
Where two agents negotiate limits from their current standing, the coefficient is what an A2A trust attestation carries.
Related terms
PasskeyBridge verifies identity signals like these inside the request, with zero PII stored. See how the platform works or test the live API.