NANDA Index Architecture

• NANDA Index Architecture is a decentralized agent registry that uses cryptographic verification to enable secure and privacy-preserving discovery of autonomous AI agents.
• It employs a three-layer design—the Lean Index, AgentFacts verifiable credentials, and dynamic resolution layer—to achieve rapid publishing, sub-second updates, and context-aware endpoint selection.
• The system integrates robust cryptographic guarantees, privacy-focused query methods, and zero-trust access controls to ensure secure interoperability across distributed environments.

The NANDA Index Architecture is a decentralized, cryptographically verifiable agent registry and resolution system designed for scalable, secure, and privacy-preserving discovery and dynamic endpoint selection in ecosystems of autonomous AI agents. Distinct from static web naming systems (e.g., DNS), NANDA enables context-aware, real-time selection and authentication of agent endpoints, supporting both agent-centric and federated deployment across enterprise, public, and distributed domains. Its layered design—comprising a Lean Index, AgentFacts verifiable credentials, and adaptive resolvers—enables rapid agent publishing, sub-second updates, and integrability with heterogeneous protocols while enforcing robust trust, capability attestation, and access governance (Zinky et al., 5 Aug 2025, Singh et al., 5 Aug 2025, Wang et al., 5 Aug 2025, Raskar et al., 18 Jul 2025).

1. Architectural Principles and Layered Components

The NANDA Index is structured in three principal layers to provide global agent discoverability, cryptographically bound dynamic metadata, and context-dependent endpoint resolution:

Layer	Role	Core Artifact
Lean Index	Cacheable, signed mapping from AgentID to metadata URLs; federated quilt	AgentAddr: {agent_id, facts_url, ..., signature}
AgentFacts Layer	Hosts self-describing, verifiable capability credentials; updatable independently	W3C Verifiable Credentials (VCs)
Dynamic Resolution Layer	Selects endpoints in real time (static, rotating, adaptive)	Adaptive resolver endpoints, ephemeral tokens

The Lean Index, implemented as a globally federated quilt of index shards, only stores minimal Ed25519-signed AgentAddr records (≤120B) with a TTL, identifying the agent and referencing verifiable metadata (facts URLs) and dynamic resolution services. This ensures that index writes are infrequent, minimizes update overhead (O(10⁴) improvement over DNS), and enables elastic horizontal scaling (Raskar et al., 18 Jul 2025, Singh et al., 5 Aug 2025).

AgentFacts are JSON-LD documents conforming to the NANDA schema and the W3C Verifiable Credential standard, each cryptographically signed and independently revocable. The facts document encodes endpoint lists (static, rotating, or adaptive), capability assertions, trust certifications, telemetry, and compliance. AgentFacts can be hosted at public or access-controlled (privacy-preserving) URLs.

The Dynamic Resolution Layer is driven by adaptive resolvers—programmable microservices (e.g., Envoy, serverless Go) that determine the optimal endpoint(s) for agent interaction based on current system context, agent requirements, load, threat posture, and privacy constraints (Zinky et al., 5 Aug 2025, Raskar et al., 18 Jul 2025).

2. Formal Metadata and Resolution Models

Agent Registry records, AgentFacts, and request context are formalized to facilitate secure, automated discovery and trust negotiation:

• AgentFact Card Schema (LaTeX excerpt (Zinky et al., 5 Aug 2025)):

$$\texttt{AgentFact} = \{ \mathit{name}:\texttt{String},\, \mathit{functions}:\mathcal{P}(\texttt{String}),\, \mathit{capabilities}:\mathcal{P}(\texttt{String}),\, \mathit{location}:\texttt{GeoCoord},\, \mathit{trustReq}:\texttt{TrustReq},\, \mathit{qosReq}:\texttt{QoSReq},\, \mathit{contextReq}:\texttt{ContextReq},\, \mathit{resourceConst}:\texttt{ResourceConst} \}$$

Key agent capabilities and requirements are thus formally discoverable and directly amenable to logic-based filter or constraint queries.

• Cryptographically Verifiable Assertion: Each AgentFacts credential is a W3C VC, represented as the tuple

$$F = (\text{id}, \text{AgentID}, \text{IssuerID}, \text{Context}, \text{Attrs}, \text{IssuanceDate}, \text{Expiry}, \sigma)$$

where $\sigma$ is an Ed25519 signature over the canonicalized credential. Revocation and short-lived credentials enforce freshness and security (Singh et al., 5 Aug 2025, Raskar et al., 18 Jul 2025).

• Contextual Resolution Function: Dynamic endpoint selection is based on a scoring function

$$S(a,c) = \alpha_1\,f_{\mathrm{loc}}(a,c) + \alpha_2\,f_{\mathrm{load}}(a) + \alpha_3\,f_{\mathrm{trust}}(a,c) + \alpha_4\,f_{\mathrm{cap}}(a,c) + \alpha_5\,f_{\mathrm{qos}}(a,c)$$

where each $f_i(a,c)$ quantifies compatibility relative to the request context $(c)$ (e.g., physical proximity, resource load, trust level, required capabilities, QoS guarantees). Endpoint selection may yield a NegotiationInvitation if constraints are not statically satisfied (Zinky et al., 5 Aug 2025).

3. Registry Operations, Discovery, and Access Control

The NANDA end-to-end agent lifecycle comprises registration, dynamic discovery, verifiable attestation, and context negotiation:

• Registration: Agent publishers generate a DID, emit AgentFacts (signed VCs), and register an AgentAddr in the Lean Index, which signs and propagates the entry across shards. Peer discovery is then enabled globally within ≤1s (Singh et al., 5 Aug 2025, Raskar et al., 18 Jul 2025, Wang et al., 5 Aug 2025).
• Discovery and Verification: A client agent queries the index with the target AgentID; fetches, verifies, and parses AgentFacts; and, if required, uses privacy-preserving fetches (PrivateFactsURL) to conceal the query. Verification checks Ed25519 signatures, credential validity intervals, and revocation status, using VC-Status Lists (Raskar et al., 18 Jul 2025, Singh et al., 5 Aug 2025).
• Zero Trust Agentic Access (ZTAA): Every inter-agent call undergoes mutual authentication (DID and VC exchange), followed by attribute-based access control (ABAC) policy evaluation:

$$\pi(s,a,o,c) = \begin{cases} \text{Permit}, & \text{if authorized by subject, object, action, context} \ \text{Deny}, & \text{otherwise} \end{cases}$$

Governance is enforced through audit logs, runtime orchestration, and real-time policy engines (e.g., for compliance screening) (Wang et al., 5 Aug 2025).

4. Dynamic Name Resolution and Adaptive Routing

NANDA departs from DNS-style static mappings by enabling dynamic, context-sensitive endpoint selection and routing:

• Recursive Resolution Protocol: Requesters construct a ResolverQuery $\{ual, ctx\}$ and initiate DNS-like recursion through Namespace servers, culminating at an Authoritative NS which computes $S(a,c)$ across candidate instances and awards the optimal endpoint. If necessary, negotiation modules mediate for trust, QoS, or resource constraints with final endpoint instantiation or selection mediated by Connector modules (Zinky et al., 5 Aug 2025).
• Adaptive Resolver Functions: Programmable microservices (WASM filters, serverless handlers) enforce routing and resource policies, returning ephemeral endpoints with short TTL (typically ≤60s). CRDT-based protocols synchronize endpoint sets and capability assertions without centralized coordination, ensuring eventual consistency and rapid convergence (Raskar et al., 18 Jul 2025).
• Concurrent, Decentralized Updates: State-based CRDTs over AgentFacts document hosts enable high concurrency for endpoint and skill updates, resilient to partition or split-brain conditions (Raskar et al., 18 Jul 2025).

5. Security, Privacy, and Governance

Security, privacy, and governance are anchored by cryptography and hardened protocol workflow:

• Cryptographic Guarantees: Ed25519 signatures are used for all index, credential, and endpoint artifacts. AgentFacts are short-lived and support sub-second revocation/key-rotation (enforced via VC-Status-List or DIDDoc fetch). Index and resolver keying are consistent with DID registries (Singh et al., 5 Aug 2025, Raskar et al., 18 Jul 2025).
• Least-Disclosure Queries and Dual-path Privacy: For discovery, clients may fetch AgentFacts directly (public pathway) or via PrivateFactsURL (privacy pathway over mixnets, IPFS), ensuring requestor–agent unlinkability; privacy is quantified by negligible adversarial inferability ($$|\Pr[A(V \mid q_1)] - \Pr[A(V \mid q_2)]| < \epsilon$$) (Raskar et al., 18 Jul 2025).
• Compliance and Auditability: The control plane (AVC) maintains governance APIs, policy enforcement, immutable audit logs, and runtime control for enterprise and regulatory integration (Wang et al., 5 Aug 2025).

6. Deployment, Scalability, and Trade-Offs

The NANDA Index achieves performance and scale through architectural minimization, distributed edge synchronization, and privacy-driven design choices:

Property	Feature	Reference
Index Scalability	Federation/sharding across ≥50 PoPs, push-pull gossip, ≥10k ops/s/shard	(Raskar et al., 18 Jul 2025)
AgentFacts Hosting	CDN/IPFS-backed, median fetch <10ms, high cacheability; 1–3 KB size	(Singh et al., 5 Aug 2025)
Dynamic Resolution	~2,000 QPS per resolver instance (median <5ms)	(Raskar et al., 18 Jul 2025)
Privacy Overheads	Mixnet/privacy path adds 30–60ms, vs. public path (~23ms total cold lookup)	(Raskar et al., 18 Jul 2025)
Consistency	CRDT merges: commutative, associative, idempotent (strong eventual consistency)	(Raskar et al., 18 Jul 2025)
Governance Model	Trade-off between decentralized resilience and central policy/federated trust management	(Singh et al., 5 Aug 2025)

Short TTLs (e.g., 300s on AgentAddr, ≤15min on AgentFacts) enable rapid churn handling but trade off cache hit rate for freshness. Adaptive routing and zero-trust access may introduce marginal overhead but yield substantial gains in security and privacy.

7. Interoperability, Protocol Translation, and Future Extensions

NANDA is designed as an inter-protocol substrate for multi-agent ecosystems:

• Cross-Protocol Adaptation: Adapter layers translate between Anthropic Modal Context Protocol (MCP), Google’s A2A, Microsoft NLWeb, and HTTPS, homogenizing capability invocation and message semantics via canonical JSON representations and per-protocol mapping functions (Wang et al., 5 Aug 2025).
• Extensibility via Federated Quilts: Index shards can reference external/enterprise/Web3 registries, supporting quilt-like compositional discovery across heterogeneous agent populations (Raskar et al., 18 Jul 2025).
• Future-proofing: Privacy-preserving credential query (e.g., ZK-based) and further protocol adapters are anticipated extensions. The architecture's commutative update protocol and verifiable credential backbone are expected to support future identity, compliance, and governance requirements at Internet scale.

• NANDA Adaptive Resolver: Architecture for Dynamic Resolution of AI Agent Names
• Evolution of AI Agent Registry Solutions: Centralized, Enterprise, and Distributed Approaches
• Using the NANDA Index Architecture in Practice: An Enterprise Perspective
• Beyond DNS: Unlocking the Internet of AI Agents via the NANDA Index and Verified AgentFacts