- The paper introduces a lightweight JSON schema linked through NANDA’s AgentFacts registry, enabling agents to discover datasets, verify freshness and SHA-256 integrity, and manage tiered access without registry redesign.
- Experiments show that TTL checks reduce stale-data errors from 37.6% to 8.8%, checksum validation detects 100% of injected corruption, and gateway security blocks all 206 unauthorized attempts.
- Data-informed agents achieve 100% decision accuracy versus 35.2% for self-deciding agents across 840 evaluations, while multi-agent relay depth adds no accuracy loss and can reduce tail latency.
Motivation and problem statement
The paper addresses a structural gap in the current agent infrastructure stack. Discovery and communication layers are well served by existing mechanisms: the NANDA Index provides a federated registry of AgentFacts documents encoding agent identity, endpoints, and capabilities, while Google A2A and Anthropic MCP standardize inter-agent messaging and tool invocation. None of these, however, provide a machine-readable mechanism for advertising, evaluating, or verifying datasets held by agents. A consumer agent seeking data from a peer must rely on hard-coded endpoint knowledge or ad-hoc probing; there is no standardized way to determine what a dataset contains, when it was last refreshed, whether it has been tampered with, or what credentials are required.
Enterprise data-sharing frameworks — IDS-RAM, Gaia-X/DSP, Ocean Protocol — define governance for inter-organizational sharing but assume human-in-the-loop negotiation cycles and heavyweight connector infrastructure that do not compose with lightweight, autonomous agent interactions. W3C DCAT, PROV, and DID supply cataloging, provenance, and identity vocabulary but no runtime mechanism agents can act on at query time. The paper's positioning table shows that no prior system simultaneously supports dataset discovery, freshness signaling, integrity verification, and tiered access control; Data Facts is designed to cover all four.
Schema design
Data Facts is a lightweight JSON metadata document integrated into the NANDA registry via a single optional field, data_facts_url, added to an existing AgentFacts record. The registry stores only the pointer; the metadata document is resolved on demand over HTTP(S). This preserves the registry's structure — /register and /list require no changes, and agents without datasets incur no overhead. The consumer workflow is: registry lookup, pointer resolution, document fetch, local freshness/integrity validation, then dataset access, all without further registry interaction.
Required fields cover dataset identity (dataset_id, dataset_description), access tier (access_type ∈ {public, semi_private, private}), a resolvable gateway endpoint (never the producer's raw endpoint), freshness (ttl_seconds, evidence.last_updated), and integrity (evidence.checksum_sha256). Optional fields carry provenance (evidence.source), update cadence, and data-owner identity.
Freshness is enforced client-side: a consumer computes Δt=tnow​−tlast_updated​ and rejects data exceeding ttl_seconds, requiring neither a round-trip to the producer nor a registry query. Integrity is verified by recomputing the SHA-256 digest after fetch and comparing against the stored checksum; SHA-256 was chosen over CRC32 or BLAKE3 for its established collision-resistance properties at negligible computational cost relative to network round-trips.
Security pipeline
For semi-private and private tiers, access follows a three-layer pipeline: JWT authentication scoped to a requested dataset capability, capability-scoped authorization enforced through a mediating gateway, and an A2A credential delegation protocol for multi-agent access. The gateway is the trust boundary: it validates JWT signatures against registered public keys, extracts capability and operation claims, checks expiry and revocation state, verifies delegation lineage and scope consistency, applies replay protection via JTI tracking, rate limiting, injection-pattern validation, and backend-specific scope guards (bucket/collection allow-lists), before dispatching to backend adapters and persisting audit records. Control-plane state (grants, delegations, agent keys, revocations, audit log) is separated from data payloads in backend-native stores across relational, document, object, vector, cache, search, graph, and time-series engines.
Two execution paths share this enforcement model: A2A proxy mode (owner executes locally and returns results) and credential-pass mode (requester presents a delegated credential directly to the owner gateway). Negotiation proceeds through negotiation.* messages: public capabilities are discoverable without credentials; semi-private capabilities are discoverable but credential-gated (auto-approval for trusted requesters, pending manual approval otherwise); private capabilities are not discoverable and issue short-lived credentials only to trusted agents.
Empirical results
Five experiments validate the schema primitives and downstream decision quality.
Discovery overhead is bounded and volume-independent: the three-step Data Facts path adds approximately 260–270 ms (two HTTP round-trips) over direct endpoint access, with mean time-to-first-data of 0.380 s versus 0.120 s baseline at N=50, stable at N=200. Retrieval success is 100% in both conditions.
Freshness enforcement establishes ttl_seconds as a necessary field rather than an optional aid. Without it, decision error attributable to stale data is 37.6% uniformly across TTL windows of 60 s, 300 s, and 600 s — the check simply cannot be performed. With TTL enforcement, error drops to 8.8% and stale-data detection reaches 76.6% (TP = 312, TN = 144, FP = 0, FN = 44). Window magnitude has no differential effect; the residual 8.8% represents data changed within its validity window, an irreducible bound set by the producer's update cadence rather than the schema.
Integrity verification yields all-or-nothing detection: treatment agents detect 100% of corrupted payloads at every injection rate from 1% to 50%, with zero silent failures, while baselines detect 0% regardless of severity. Even minimal byte-level modification is reliably caught.
Security evaluation covers four authentication scenarios, three TTL boundary conditions, and 46 adversarial attempts across six categories (wrong signing key, garbage tokens, altered claims with valid signatures, impersonation, privilege escalation, replay) over 206 authentication trials. All unauthorized attempts return HTTP 401 with zero data leakage; TTL classification is exact (45/45, including 10/10 boundary-precision decisions at t=TTL±ϵ). The salient finding is that claim validation is required in addition to signature verification: tokens carrying valid signatures but modified dataset_id claims are correctly rejected, which signature-only JWT validation would pass. Gateway JWT verification costs 48.6 ms per request versus 259.2 ms for OAuth2 and 110.5 ms for SPIFFE mTLS, while providing per-dataset capability scoping that API-key schemes cannot.
Decision quality uses seven binary scenarios drawn from a PostgreSQL table with ground truth Gold:5, Silver:6, Bronze:9, spanning self-decide difficulty from 91.7% down to 0%. In a factorial design (7×2×3×20=840 evaluations using gpt-5-nano across 1-, 2-, and 3-agent topologies), data-informed agents achieve 100% accuracy (420/420) versus 35.2% for self-deciding agents (95% CI [30.9%, 39.8%]; p<0.001). Self-decide accuracy is statistically indistinguishable across topologies (34.3%, 35.0%, 36.4%), confirming that the two-hop A2A relay chain introduces no information loss or accuracy penalty. The near_parity scenario achieves 0/60 self-decide accuracy, functioning as a discriminative control for queries inaccessible from training priors. Notably, data-informed p95 latency is lower than self-decide p95 in all topologies, with the gap widening with depth (3-agent: 29.8 s vs. 75.4 s): on counter-intuitive queries, eliminating LLM deliberation saves more tail latency than the database round-trip costs.
Limitations and open questions
The paper concedes several constraints explicitly. All decision-making evaluations use a single model (gpt-5-nano) and a binary classification format, so generalization to open-ended queries or other model families remains untested. The ground-truth database is static; dynamic environments with high update rates may erode TTL effectiveness beyond the observed 8.8% residual error. Two v1 security limitations are structural properties of stateless JWT: token reuse within the validity window is permitted, and tokens are not bound to caller identity, so intercepted tokens can be replayed until expiry — mitigable via a revocation registry and audience binding but unaddressed here. The schema supports only single-dataset documents, motivating a multi-dataset catalog endpoint. The authors also disclaim optimality for all agent architectures and completeness against every threat model.
Conclusion
Data Facts fills a concrete gap between agent discovery (NANDA) and agent communication (A2A, MCP) with a minimal, externally resolved metadata layer covering identity, freshness, integrity, and tiered access. The empirical results support each required schema field as necessary rather than optional: bounded discovery overhead, a 37.6% → 8.8% reduction in stale-data errors, 100% corruption detection, complete blocking of forgery attempts including signature-valid claim tampering, and a 100%-versus-35.2% accuracy gap demonstrating that identity and communication protocols alone leave agents defaulting to unreliable prior-based reasoning on data-dependent queries. The main open questions concern generalization beyond a single model family and static data, and closing the stateless-JWT identity-binding gap in a subsequent revision.
