GSMA Greater China reposted this
GSMA Greater China: AI agents are beginning to act across enterprise boundaries. From ZTA to M-Trust. Most Zero Trust implementations are still organised around one enterprise. ZTA remains essential. But it does not, by itself, establish whether an external AI agent is authorised to act for a company, and whether another organisation can independently verify that authority. Our new Spherity Research paper examines "GSMA Greater China’s M-Trust proposal" as a draft research direction. It asks what is required to extend the model to legally attributable B2B and B2G actions. Contributing entities to the M-Trust Proposal: China Aerospace Science & Industry Academy of Information Technology, GSMA Greater China, Huawei, China Telecom Corporation Limited, China Unicom, Beijing University of Posts and Telecommunications. FINDINGS An important finding is the "convergence of architecture patterns" emerging in different regions and ecosystems: (1) GSMA M-Trust introduces multi-party, intent-aware and cross-domain trust. (2) Anthropic’s Zero Trust for AI Agents emphasises strong agent identity, least privilege, external policy enforcement and continuous evaluation. (3) WE BUILD Consortium contributes Business Wallets, legal-person identity, mandates and provable intent. (4) Manufacturing-X, energy data-X meets DataFleX contributes federated industrial governance, data sovereignty, connectors and cross-company trust frameworks. ARCHITECTURE These initiatives have different scopes and point towards a similar architecture: Strong agent identity. Bounded authority. Independently verifiable evidence. Continuous status evaluation. Policy enforcement outside the AI model. Auditable actions. The paper connects these patterns with Business and Agent Wallets, W3C Verifiable Credentials and DIDs, AI Service Passports, governed registries, post-quantum migration and signed action receipts. IPCEI AI could provide a European route for implementing this convergence at scale. Its projects could connect a control plane for identity, mandates, policy and accountability with a data plane of verifiable evidence graphs. These graphs would make provenance, conformity, TEVV, runtime state and action evidence traceable to their authoritative sources. This would support "reusable trust infrastructure" across industrial sectors while preserving sector-specific governance and verifier sovereignty. Europe needs to move quickly from architectural alignment to reference implementations, common profiles and cross-sector testing. The paper also distinguishes B2C verifiable intent from B2B verifiable authority and applies the model to Manufacturing-X, Energy Data-X, data spaces, Digital Product Passports, supply chains and Trusted AI. Open access paper under CC BY 4.0: https://lnkd.in/eaC2bq5Z Are we seeing the foundations of a common trust architecture for cross-company AI agents?