Trust Scoring and Receipts

How Ovara quantifies agent risk and proves every decision cryptographically.

The trust formula

trust_score = base_score
  * isolation_multiplier
  * patch_freshness
  * drift_penalty
  * degradation_penalty
  + trust_score_hint * 0.1

• base_score = 0.5
• Isolation multipliers: none = 1.0, docker = 1.05, gvisor = 1.15, firecracker = 1.2
• Patch freshness decays from 1.0 to 0.5 at 90 days
• Levels: high (0.8-1.0), medium, low, none

Sliding-window action pattern analysis detects drift; trust degrades exponentially with streak acceleration.

Trust-gated policy

Rules can require a minimum trust posture:

{ "min_trust_score": 0.7 }

If the agent's current trust score is below 0.7, the action escalates for human review - the same action from a healthy agent proceeds untouched.

Chain detection

Delegation abuse is caught structurally:

• Self-delegation - an agent delegates to itself
• Excessive depth - delegation chain too deep
• Issuer concentration - too many leases from a single issuer
• Rapid re-delegation - frequent re-delegation suggesting laundering

Suspicious chains are escalated regardless of policy.

Execution receipts

Gateway-domain receipts use HMAC-SHA256 with a deterministic action digest (sig_v1:<hex>). Modifying any field of a receipt invalidates its signature - verification returns {"valid": false, "reason": "signature_mismatch"}.

For federated deployments, cross-org receipts use ed25519 signatures instead: the format includes the issuing organization's public key and is independently verifiable without access to the issuing gateway.

Trust state can be exported and imported for backup or migration between gateways. The federated trust graph computes multi-organization trust paths across the network.