How the parts compose into an operational trust system

One component, one job.

An AI model can reason. An agent runtime can execute. A blockchain can settle. None of them, alone, answers the question the agentic economy actually asks.

“How does another party know that this autonomous entity is authorized to act, within a defined scope, under a legally accountable principal, at this exact point in time?”

PRAXIS answers by composing a layered trust architecture in which each component does exactly one thing. AI agents perform actions. Knowledge graphs provide semantic understanding. Tezos anchors cryptographic commitments. PRAXIS identity objects provide machine-readable legal identity. Attestation and governance define authority. Transparency logs preserve accountability. The result is not a product feature — it is a trust operating system for autonomous software.

The honesty legend

This is an architecture exposition, not a module catalogue, and it holds itself to the reference implementation's own discipline. Every claim about what exists today carries a status label — so a reader can separate what is enforced now from what is scoped for a named roadmap phase. A box is SHIPPED only if the continuous-integration pipeline exercises it today (invariant I11).

Five planes: applications consume trust, the substrate supplies meaning and proof.

                  ┌───────────────────────────┐
                  │        APPLICATIONS        │
                  │  Enterprise · Finance · Web│
                  └──────────────┬────────────┘
                                 ▼
                  ┌───────────────────────────┐
                  │       AI AGENT LAYER       │
                  │  Reasoning · Planning ·    │
                  │  Execution · Negotiation   │
                  └──────────────┬────────────┘
                                 ▼
       ┌──────────────────────────────────────────────┐
       │             PRAXIS TRUST LAYER               │
       │  Identity · Authority · Attestation ·        │
       │  Governance · Provenance · Audit             │
       └──────────────┬───────────────────────────────┘
                      ▼
         ┌────────────┴────────────┐
         ▼                         ▼
 ┌─────────────────┐      ┌────────────────────┐
 │ KNOWLEDGE GRAPH │      │      TEZOS         │
 │ Semantic Layer  │      │  Settlement Layer  │
 │ Context Engine  │      │ Cryptographic Root │
 └─────────────────┘      └────────────────────┘

The two substrate layers are not peers in kind. The knowledge graph is a lens; the blockchain is the root of truth. That asymmetry — meaning on one side, proof on the other, with proof always able to overrule meaning — is the single most important property of the design, and Section VIII returns to it in full.

The model is not the identity.

The AI agent is the actor — reasoning, planning, calling APIs, negotiating, transacting. But the model itself is not the identity, and that distinction is the hinge of the entire architecture. A model is analogous to a human's cognitive capability. It is not the legal principal.

Because identity is separated from intelligence, an agent may change models without changing identity. The identity persists precisely because the accountable relationship persists.

Agent ID:          did:tz:mainnet:tz4xyz…  (agent.procurement.acme)
Current runtime:   GPT-based procurement engine
Previous runtime:  Claude-based procurement engine
Authority:         Purchase inventory up to $250k  (live CPoA)
Controller:        Acme Corporation  (Delaware C-corp)

The runtime beneath the identity may change; the did:tz name, the authority, and the accountable controller do not. This is why the AI agent is never the trust layer — it operates inside it.

Four questions a skeptical counterparty must resolve.

The Agentic Identity Document (AID) is the canonical identity artifact — not metadata, but a cryptographically verifiable legal identity record.

Who is this? · What can it do? · Under whose authority? · What evidence exists?

The AID carries a capabilities[] discovery surface — dotted namespaces such as payments.transfer — that registers what the agent may attempt, never a grant of authority. Actual authority is the live, scoped, revocable CPoA referenced by cpoaAnchors[]. The delegation chain must terminate in a depth-0 accountable root — the anti-“unaccountable void” rule, enforced by validateAid, not merely suggested.

Acme Corporation
     │  delegates to
     ▼
Procurement Department
     │  delegates to
     ▼
AI Procurement Agent      (delegation[] — depth-0 root enforced)

An identity that cannot name a legally answerable principal is rejected at validation. This is what makes attribution a property of construction rather than an exercise in forensic reconstruction.

Store proof on-chain, store complexity off-chain.

Tezos is the decentralized verification substrate. It stores only the commitments that matter and becomes the immutable referee answering one question: what identity artifact was authoritative at this point in time? The soulbound FA2 token carries a commitment; the document lives on Arweave; the graph is derived.

// Tezos — Agent ID NFT (soulbound, TZIP-12/16/21)
{
 aid_hash:     c2349d4…            // commits to the current document
 aid_uri:      ar://<txid>         // where to fetch it
 version:      3                   // which version is authoritative
 genesis_hash: 1fe73207…            // immutable identity root
 controller:   tz1ABC…              // who is accountable (the principal)
 status:       active              // is it live
}

The on-chain anchor holds a commitment, never identity data. Note the controller is a tz1 principal — the accountable legal person or wallet — while the agent is the tz4 BLS account. The two address classes are never interchanged: tz4 is reserved for the agent per TAP-1, and control is vested in the recorded controller, not in whoever holds the token.

The storage layer is never trusted; it is verified.

Complete identity documents live off-chain, on Arweave, written once and immutably. Arweave buys survivability; the chain buys liveness and control; the pairing is deliberate. Verification is mechanical and runs on public artifacts alone:

1.  Fetch the AID from ar://<aid_uri>     (source is untrusted)
2.  Recompute aidContentHash over the fetched bytes
3.  Require equality with the on-chain aid_hash   → else STOP
4.  Walk the version chain back to genesis (verifyChain)
5.  Accept or reject

A database stores facts. A knowledge graph stores meaning.

Traditional identity asks a narrow question — “does this credential match?” PRAXIS asks a semantic one: what is the complete relationship between this agent, its authority, its organization, its policies, and its actions? The projection is deterministic and pure. documentToQuads maps a validated AID into RDF quads, each emitted into a named graph whose IRI embeds the asserting version's content hash — urn:praxis:sha256:<contentHash>. Because that is the very hash the NFT anchors, graph provenance is the on-chain commitment.

Verification is set containment, not a label check

A graph label only names a document; it does not enumerate its quads, so a malicious indexer could attach forged triples under a genuine label. verifyThenTrust therefore obtains the anchored document, requires it to re-hash to the label, re-projects it, and admits a presented quad only if it is a member of the canonical projection. strictVerify fails closed on the first rejection.

Every value above is emitted by the package's own pipeline and reproduces from a clean checkout — see the coda. That is the difference between a diagram and a claim you can check yourself.

The graph proposes; the anchors confirm.

It is tempting to say the knowledge graph “answers” authority queries. That phrasing is precise only with its second half attached: the graph is a lens, never a source of truth. It is how a verifier discovers a claimed authority chain in milliseconds; the claim is confirmed only by re-verification against the anchored AID — containment against re-projection — and, for live authority, the TAP-3 CPoA record. Without this rule, the architecture would quietly reintroduce “trust the registry” — the exact failure mode it exists to eliminate.

Evidence accumulates; trust is recomputed

Every decision is evaluated from scratch against anchored identity, live authority, and policy at an explicit instant. There is no balance that grows, no score, no endorsement count — and by standing invariant there never will be, because accrued trust can be farmed, purchased, or Sybil-inflated. What improves over time is the evidence base, never a trust number. The value that compounds is replayable evidence; the trust decision itself is stateless, recomputed on demand from artifacts anyone can independently check.

One action, end to end, labeled honestly.

An enterprise procurement agent is instructed to purchase $150,000 of equipment. Trust is established not by one check but by a sequence in which each layer contributes exactly what it is authoritative for.

Credible because every rung is labeled honestly.

10.1 · A note on “Tezos X”

Outward material brands the anchor layer Tezos X — the platform's forward roadmap. The normative surfaces bind to what is verifiable today: Tezos L1 semantics, the mainnet and ghostnet networks, and FA2/TZIP-12/16/21, with an FA2.1 (TZIP-26) migration note in the contract. “Tezos X” refers to this anchor layer as it evolves; the schemas name concrete networks so an auditor always knows exactly which chain a given contract lives on.

The intersection none of them occupies.

Most AI infrastructure competes on intelligence. Most blockchain infrastructure competes on settlement. PRAXIS operates where neither does.

       Intelligence
            +  Authorization
            +  Accountability
            +  Semantic Understanding
            +  Cryptographic Verification
            =  Agentic Trust Infrastructure

The agentic economy does not fail because machines cannot act. It fails if nobody can prove who acted, why they were allowed to, what constrained them, and who is responsible afterward. The layers are not interchangeable and not individually sufficient: AI can act but cannot prove its own legitimacy; a blockchain can verify records but cannot understand their meaning; a knowledge graph can represent relationships but cannot anchor them immutably. Composed, they produce something none yields alone — semantic, cryptographic, and institutional trust in a single architecture.

11.1 · The investment logic, precisely

For an investor, the thesis reduces to four properties of the architecture itself — each one checkable, none dependent on adoption narrative alone.

The current state is stated with the same discipline (invariant I11): the SDK, schemas, knowledge graph, golden vectors, and CI substrate are shipped and verified; the contract is an audit-gated draft; providers and the service layer are named phases with a Ghostnet existence-proof milestone. An investor is shown a verification discipline with a roadmap, not a demo with a story.

The future economy will not simply contain AI agents. It will contain verified AI agents. And the foundational primitive for that world is not another model — it is identity, authority, provenance, and accountability, composed into a trust operating system for autonomous software.

Every proof point in this document reproduces from a clean checkout.

Nothing above asks for trust it hasn't earned. The test counts, the quad counts, the graph commitment, the tamper-rejection results — all are emitted by the package's own pipeline, and the drift gate proves the committed artifacts are exactly what the code generates.

A reputation registry cannot make this offer. A system whose every claim is independently checkable from public artifacts can — and that is the whole argument.