ANCR WG 20260701

05m

Administrative / Kantara update

• LC. Kantara liaison access — ISO liaison registration requires Kantara membership

ANCR announcement appeared at the end of the Kantara newsletter (sent Tue Jun 30).

New Kantara Operating Procedures are out for vote/comment: membership now required to serve as officer, trustee, ISO liaison, or Leadership Council member; prior corporate-email restriction on membership removed.

 send an email to staff (for those interested to apply)

 Kantara newsletter - Sal forwarded it to the WG list

Members encouraged to review and comment.

30m

Application note 1.0 - TPI assessment initial findings

• Review the write-up of the initial site-assessment findings (notice deficiencies, TPI 1–3, certificate/PKI review). Further explore findings; possibly begin constructing the controller identification record.

Output from the previous session's working exercise is ready to be written up and sent to Kantara as a first position ("stake in the ground").

By Tim L.

Sal + Tim to draft the write-up before the call

Write-up delayed; a Google Doc will be set up to continue the work.

20m

Liaison updates

• Plenary readout. If public by then, Mark to brief the group on the NWIP / "27560-1 ANCR profile" work for WG5.

ISO/IEC TS 27560:2023 (consent record information structure) is being replaced by a revision that shifts from a receipt record for the PII principal to a PII controller record of processing activity (audit file) the WG has a fundamental issue with this, and with the record including identification of the PII principal.

Mark Lizar's New Work Item Proposal (NWIP) will take this on; project call Thu Jul 2 with Sal attending as Kantara liaison. Possible topic at the next plenary. Sal continues posting his ISO liaison reports to the Signal channel (reports are shareable; working drafts are not).

By Sal / Mark - tentative, pending plenary

Sal: attend NWIP call Jul 2 and report back.

05m

AoB

• ISOPE (IEEE Int'l Symposium on Privacy Expectations) - submission deadline June 30, abstract to be shared in the signal channel.

• Bar association update

TPI 3: expand with the moral/ethical dimensions (11 vectors) of the recent papal encyclical; Sal submitted an abstract on this to the symposium on privacy expectations (Jun 30, outcome pending). Tim Lloyd forwarded the encyclical and a House of Lords AI-ethics debate (initiated by the Archbishop of Canterbury) to the Kantara list as citable resources. TPI 4: add a cryptographic bill of materials / cryptographic trust chain. TPI 2 (future): expand controller record schema with attributes of agentic processors, agents are processors and must be identified in notice; leverage the IETF SCIM 00-draft on agent attributes (link shared in chat) and related OpenID AI identity-management work.

Tim Reiniger's ABA Autonomous Systems Governance WG (with the Business Law Section) is developing minimum competencies for governing autonomous/agentic AI systems. Group agreed the WG could submit a transparency/TPI-based minimum competency, since notice of risk requires identifying agentic processors.

Extension of the project: achieving a higher TPI via a clean web deployment, notice.txt presented before any fingerprinting or identifier creation. Sal has a prior best-practices white paper (WordPress clean-site setup, possibly ID Machines-branded) to locate. Tim Lloyd to research suitable deployment stacks.

Wide-ranging discussion on agent identity: authority vs. identity attributes, evolving/self-modifying agents outrunning static identity models, S-BOM-style provenance with cryptographic proof in a registry, exploratory, no decisions.

By Sal and Tim R.

Open

Tim Reiniger: pursue TPI-based transparency competency submission to ABA.

Tim Lloyd: follow up with Sal on the white paper; explore implementation options