AID-D-005.006: Agent Registry & Resolution Telemetry Monitoring

Version 1.20261015 · Actionable sub-technique

Monitor registration, update, revocation, lookup, and resolution telemetry from applicable agent registries and name-resolution services to detect registry poisoning indicators, Sybil-style namespace abuse, directory reconnaissance, issuer or credential churn, and abnormal not-found or version-mismatch outcomes. Agent Name Service (ANS) is a named implementation driver and example, not the applicability boundary.

Pillars: infra, app

Lifecycle: operation, response

Scope boundary

Owns anomaly detection over the complete declared population of agent-registry and resolution events, including namespace churn, identity and issuer correlations, reconnaissance patterns, poisoning indicators, and outcome-rate changes. It does not authenticate the event contract, reconcile inter-agent ledger completeness, authorize registration or routing, or establish that a registry entry is trustworthy.

AID-D-011.002: AID-D-005.006 detects suspicious patterns in registry and resolution activity after events are available; AID-D-011.002 authenticates the inter-agent event contract and reconciles discovery and routing events against authoritative ledgers. A contract-valid event can still be anomalous, while a missing, forged, replayed, or misbound event is owned by AID-D-011.002 and must not be scored again as registry anomaly detection.

Implementation guidance

AID-D-005.006-G001

Emit bounded registration telemetry and detect namespace churn without high-cardinality identity labels.
Record validated outcomes without stubs
from __future__ import annotations

# File: ans_monitor/registration_telemetry.py
import hashlib, hmac, json, os
from dataclasses import dataclass
from datetime import datetime, timezone
from prometheus_client import Counter

CORRELATION_KEY = os.environ["ANS_TELEMETRY_HMAC_KEY"].encode()
PROVIDER_CLASSES = {"internal", "partner", "public", "unknown"}
ISSUER_CLASSES = {"enterprise_ca", "partner_ca", "public_ca", "untrusted"}
OUTCOMES = {"accepted", "failed_schema", "failed_identity", "failed_signature", "conflict"}

REGISTRATIONS = Counter(
    "ans_registration_results_total",
    "Authoritative ANS registration outcomes",
    ["provider_class", "issuer_class", "outcome"],
)

@dataclass(frozen=True)
class RegistrationResult:
    request_id: str
    authenticated_principal: str
    namespace: str
    provider_class: str
    issuer_id: str
    issuer_class: str
    outcome: str

def correlation_ref(value: str) -> str:
    return hmac.new(CORRELATION_KEY, value.encode(), hashlib.sha256).hexdigest()

def record_registration(result: RegistrationResult) -> dict:
    if result.provider_class not in PROVIDER_CLASSES or result.issuer_class not in ISSUER_CLASSES or result.outcome not in OUTCOMES:
        raise ValueError("registration telemetry contains an unbounded enum")
    if not all((result.request_id, result.authenticated_principal, result.namespace, result.issuer_id)):
        raise ValueError("registration telemetry is missing authoritative fields")
    REGISTRATIONS.labels(
        provider_class=result.provider_class,
        issuer_class=result.issuer_class,
        outcome=result.outcome,
    ).inc()
    event = {
        "schema_version": "aidefend.ans_registration.v1",
        "observed_at": datetime.now(timezone.utc).isoformat(),
        "request_id": result.request_id,
        "principal_ref": correlation_ref(result.authenticated_principal),
        "namespace_ref": correlation_ref(result.namespace),
        "issuer_ref": correlation_ref(result.issuer_id),
        "provider_class": result.provider_class,
        "issuer_class": result.issuer_class,
        "outcome": result.outcome,
    }
    print(json.dumps(event, sort_keys=True))
    return event
Render environment-specific rules from signed policy

The following is a CI template, not a universal threshold. A signed, versioned environment policy must supply window, accepted_rate_threshold, failure_rate_threshold, and for_duration. The renderer verifies the policy signature and schema, records its digest/version in the rule metadata, and fails rule publication if any value is missing or invalid.

groups:
  - name: ans_registration
    rules:
      - alert: ANSRegistrationChurn
        expr: |
          sum by (provider_class, issuer_class) (
            rate(ans_registration_results_total{outcome="accepted"}[{{ .window }}])
          ) > {{ .accepted_rate_threshold }}
        for: {{ .for_duration }}
        labels:
          severity: warning
      - alert: ANSRegistrationValidationFailures
        expr: |
          sum by (provider_class, issuer_class) (
            rate(ans_registration_results_total{outcome=~"failed_.*|conflict"}[{{ .window }}])
          ) > {{ .failure_rate_threshold }}
        for: {{ .for_duration }}
        labels:
          severity: warning

Evidence: forward exact structured events to the append-only pipeline in AID-D-005.001 and retain the rendered rule, signed policy and signature, policy digest/version, renderer version, and metric rule version. An independent analyst recomputes window counts from those events. Missing authentication context or unknown enums is an instrumentation error, not a successful registration.

Verify complete coverage

The population is every registration attempt and terminal state for every applicable namespace, registrant identity, agent record, version and signed window, including denied, duplicate, expired, churned, and processing-error records.

AID-D-005.006-G002

Emit bounded resolution telemetry and detect identity-correlated reconnaissance in the event stream.
Emit low-cardinality metrics and identity-correlatable events
from __future__ import annotations

# File: ans_monitor/resolution_telemetry.py
import hashlib, hmac, json, os
from dataclasses import dataclass
from datetime import datetime, timezone
from prometheus_client import Counter

CORRELATION_KEY = os.environ["ANS_TELEMETRY_HMAC_KEY"].encode()
CLIENT_CLASSES = {"workload", "human", "partner", "anonymous"}
RESOLVER_ZONES = {"internal", "partner", "public"}
OUTCOMES = {"success", "agent_not_found", "version_mismatch", "signature_invalid", "policy_denied"}

RESOLUTIONS = Counter(
    "ans_resolution_results_total",
    "Authoritative ANS resolution outcomes",
    ["client_class", "resolver_zone", "outcome"],
)

@dataclass(frozen=True)
class ResolutionResult:
    request_id: str
    authenticated_client_id: str
    client_class: str
    resolver_zone: str
    query_name: str
    requested_version_range: str
    outcome: str

def ref(value: str) -> str:
    return hmac.new(CORRELATION_KEY, value.encode(), hashlib.sha256).hexdigest()

def record_resolution(result: ResolutionResult) -> dict:
    if result.client_class not in CLIENT_CLASSES or result.resolver_zone not in RESOLVER_ZONES or result.outcome not in OUTCOMES:
        raise ValueError("resolution telemetry contains an unbounded enum")
    if not all((result.request_id, result.authenticated_client_id, result.query_name)):
        raise ValueError("resolution telemetry is missing authoritative fields")
    RESOLUTIONS.labels(
        client_class=result.client_class,
        resolver_zone=result.resolver_zone,
        outcome=result.outcome,
    ).inc()
    event = {
        "schema_version": "aidefend.ans_resolution.v1",
        "observed_at": datetime.now(timezone.utc).isoformat(),
        "request_id": result.request_id,
        "client_ref": ref(result.authenticated_client_id),
        "query_ref": ref(result.query_name),
        "requested_version_range": result.requested_version_range,
        "client_class": result.client_class,
        "resolver_zone": result.resolver_zone,
        "outcome": result.outcome,
    }
    print(json.dumps(event, sort_keys=True))
    return event

In the SIEM, compute per-client_ref failure-to-success ratio and distinct query_ref count over fixed windows; emit ANS_RESOLUTION_RECONNAISSANCE only when the minimum query count and preregistered ratio are both met. Route response to AID-I-003; this detector does not rate-limit.

Evidence: retain the authenticated resolution event, HMAC key version, window definition, rule version, counts, ratio, and finding in append-only storage. An independent analyst replays the same query over raw events. Empty windows are INSUFFICIENT_DATA, and missing identity or invalid outcome is ERROR.

Open-source tools

Commercial / hosted tools

Threat mappings

MITRE ATLAS

MAESTRO

OWASP LLM Top 10 2026

OWASP ML Top 10 2023

OWASP Top 10 for Agentic Applications 2026

NIST Adversarial Machine Learning 2025

Cisco Integrated AI Security and Safety Framework

Google Secure AI Framework 2.0 - Risks

Databricks AI Security Framework 3.0

AID-D-005.006: Agent Registry & Resolution Telemetry Monitoring | AIDEFEND

Loading interactive view…

AIDEFEND™

A Practical Knowledge Base for AI Security Defenses

Version

GitHub MCP Service