Data Facts: A Metadata Schema for Structured Data Exchange in the NANDini Multi-Agent Ecosystem Jin Gao, Maria Gorskikh, Pradyumna Chari, Brittany Box, Mukul Kemla, Pratik Behera, Abhishek Mehta, Ramesh Raskar
arXiv:2606.26211v1 [cs.CR] 24 Jun 2026
Abstract
Interconnected Nodal Intelligence) [18] envisions a planetary-scale ecosystem in which agents generate data, refine information, extract insights, and take action in response to human needs. Realizing this vision requires infrastructure that goes beyond agent identity and communication to include a structured data layer through which agents can exchange, interpret, and distill information across large-scale networks. Current agent infrastructure addresses discovery and messaging. The NANDA Index [15] provides a federated registry in which agents publish Agent Facts documents encoding identity, endpoints, and capabilities. Protocols such as Google A2A [6] and Anthropic MCP [2] standardize inter-agent messaging and tool invocation across vendors. Together, these mechanisms enable agents to discover each other and exchange tasks. However, they provide no mechanism for advertising, evaluating, or verifying the datasets held by participating agents. An agent seeking data from a peer must rely on hard-coded endpoint knowledge or ad-hoc probing; no machine-readable layer exists to describe what a dataset contains, when it was last refreshed, whether it has been tampered with, or what credentials are required. Prior work addresses data exchange at the organizational level. IDS-RAM [14], Gaia-X [4], and the Dataspace Protocol [8] define governance frameworks for enterprise-to-enterprise sharing; Ocean Protocol [12] introduces a blockchain-based marketplace for data NFTs. These systems assume human-in-theloop governance, heavyweight connector infrastructure, and negotiation cycles that do not compose with the lightweight, autonomous agent interactions that NANDini targets. W3C DCAT [1], PROV [9], and DID [17] provide vocabulary for cataloging, provenance, and identity but no runtime mechanism for agents to act on that vocabulary at query time. Table 1 positions Data Facts against this prior work. We propose Data Facts, a core concept within the NANDini framework: a JSON metadata schema that extends Agent Facts with a single new field, data_facts_url, pointing to an externally hosted document describing a dataset. The design main-
NANDini (Networked Agents Natural Distillation of Interconnected Nodal Intelligence) envisions an automated ecosystem where intelligent agents independently create, process, and exchange data to drive decisions at scale. Realizing this vision requires infrastructure beyond agent discovery and communication: agents must be able to advertise, evaluate, and verify the datasets they hold. Current protocols (NANDA for federated registry, A2A and MCP for inter-agent messaging) address identity and communication but provide no mechanism for structured data exchange. Existing Enterprise data-sharing frameworks (IDS-RAM, Gaia-X, Ocean Protocol) assume human-in-the-loop governance incompatible with autonomous, realtime agent interactions. We introduce Data Facts, a core NANDini concept: a lightweight JSON metadata schema that bridges agent discovery and data access via a single pointer (data_facts_url) added to an existing Agent Facts registry record. The linked document encodes dataset identity, access tier (public, semiprivate, or private), endpoint, a time-to-live for freshness validation, and a SHA-256 integrity checksum. For private and semi-private data, we implement a three-layer security pipeline: JWT authentication, capability-scoped gateway authorization, and an A2A credential delegation protocol. Across 840 decision-making evaluations, data-informed agents achieve 100% accuracy versus 35.2% without data access (p < 0.001); TTL enforcement reduces stale-data errors from 37.6% to 8.8%; checksum verification achieves 100% corruption detection at all injection rates; and the security pipeline blocks all 46 forgery attempts with zero data leakage.
1
Introduction
In a world of autonomous agents numbering in the hundreds of billions, the data-to-decision lifecycle must evolve into a continuous, distributed process. NANDini (Networked Agents Natural Distillation of 1
tains a strict separation of concerns. Agent Facts retain their existing lightweight registry role as a registry for agent identity, endpoints, and capabilities, while dataset metadata evolves independently and is resolved only when data is requested. For private data, access is protected through a three-layer security pipeline consisting of JWT-based authentication, capability-scoped authorization enforced through a mediating gateway, and an A2A negotiation protocol for scoped, time-bound credential delegation. By standardizing how agents describe and verify datasets, Data Facts operationalizes NANDini’s commitment to data accuracy within autonomous multi-agent ecosystems.
executors but as the primary source of data generation, curation, and consumption. NANDini builds upon MIT’s NANDA architecture [15], extending early registry and discovery frameworks into a comprehensive ecosystem for autonomous agent data exchange. While NANDA provides the foundational layer for federated agent discovery via AgentFacts, NANDini extends this foundation to address three interconnected research domains: knowledge distillation across agent networks, model context protocols for structured access to tools and data, and large-scale agentic systems of intelligence capable of operating autonomously at scale. Central to the NANDini vision is the principle that reliable decision-making in autonomous systems depends on accurate and verifiable data. This principle motivates the initiative’s core technical contributions, including Data Facts: a standardized mechanism through which agents can advertise, evaluate, and verify the datasets they hold. Data Facts bridges the gap between agent discovery (addressed by NANDA) and agent communication (addressed by A2A and MCP) by introducing a structured data exchange layer that enables agents to make informed, data-driven decisions autonomously. The initiative is committed to being open, transparent, and capable of operating at planetary scale, targeting an emerging landscape in which unprecedented investment in AI infrastructure intersects with the $1.3 trillion enterprise software market through autonomous agent ecosystems.
Evaluation scope. We report five experiments: discovery overhead, freshness enforcement, integrity verification, security pipeline evaluation, and datainformed decision quality. Decision-making experiments use counter-intuitive business queries designed to expose agents that reason from training priors rather than querying live data. The security evaluation examines 13 attack categories. We do not claim the schema is optimal for all agent architectures, nor that the security pipeline addresses every possible threat model. Contributions: 1. NANDini data layer: Data Facts, a core NANDini concept providing a lightweight JSON metadata schema for agent-held datasets, integrating with Agent Facts via a single URL pointer with threetier access semantics ("public", "semi_private", "private").
3
Related Work
2. Security pipeline: JWT authentication, capabilityAgent infrastructure. The NANDA Index [15], scoped gateway authorization, and an A2A crewhich serves as NANDini’s foundational discovery dential delegation protocol for multi-agent private layer, provides a federated registry where agents regdata access. ister with AgentFacts documents encoding identity, 3. Empirical validation: 840 decision-making evalua- endpoints, and capabilities, but no dataset state. A tions showing 100% data-informed accuracy versus survey of registry designs [16] confirms that NANDA 35.2% without data access; freshness and integrity AgentFacts, A2A Agent Cards, and MCP mcp.json experiments; and adversarial security evaluation descriptors all omit dataset-level metadata. Google blocking all 46 forgery attempts across 206 private- A2A [6] and Anthropic MCP [2] standardize interagent communication and tool invocation respectively; access trials. a survey of these protocols [7] notes that all address communication while leaving data description to appli2 The NANDini Initiative cation logic. Data Facts, as a NANDini core concept, NANDini (Networked Agents Natural Distillation of fills this gap with a single data_facts_url pointer Interconnected Nodal Intelligence) [18] is an open in AgentFacts, resolving dataset metadata externally research initiative addressing a fundamental question: without inflating the registry. in a future dominated by intelligent agents, what Data exchange and cataloging. Enterprise framewill happen to the data-to-decision life-cycle? The works define richer metadata but assume organiinitiative responds to the emergence of agentic systems zational governance. IDS-RAM [14], Gaia-X [4], of intelligence, where agents serve not only as task and DSP [8] target sovereign inter-organizational 2
Table 1: Comparison of related systems across four properties relevant to autonomous agent data exchange. ✓ = fully supported; ◦ = partial or vocabulary only; — = not addressed. Dataset discovery
Freshness signaling
Integrity verification
Tiered access control
NANDA AgentFacts [15] A2A Agent Cards [6] MCP mcp.json [2] IDS-RAM [14] Gaia-X / DSP [4, 8] Ocean Protocol [12] W3C DCAT [1] W3C PROV [9]
— — — ◦ ◦ ◦ ✓ —
— — — — — — ◦ ◦
— — — ◦ — ✓ — —
— — — ✓ ✓ ✓ — —
NANDini Data Facts (ours)
✓
✓
✓
✓
System
sharing via certified connectors and negotiation cycles; Ocean Protocol [12] introduces blockchain-based data NFTs with Compute-to-Data. None compose with lightweight, real-time agent interactions. W3C DCAT [1] provides RDF vocabulary for federated catalog discovery; W3C PROV [9] covers data lineage; W3C DID [17] underpins our JWT authentication pipeline. These standards supply rich catalog vocabulary but do not define machine-enforceable freshness or integrity fields actionable at agent query time. Data valuation and quality. Ghorbani and Zou [5] formalize Data Shapley for equitable attribution of training data value; extensions address federated settings [19] and market pricing [20]. Complementary lines of work develop task-agnostic valuation via statistical divergence between buyer and seller distributions [13, 10] and federated data acquisition without labeled validation sets [11]. All of this literature assumes data is already accessible and prices or selects contributions post-hoc. Batini et al. [3] survey data quality dimensions including timeliness and integrity as core axes. Data Facts externalizes two of these, freshness via ttl_seconds and integrity via checksum_sha256, as declarative fields agents verify before ingestion, instantiating data quality primitives at the discovery layer rather than in governance pipelines.
4
Agentic Data Infrastructure
Figure 1: NANDini Data Facts architecture: agent layer (discovery, communication) and data-owner layer Figure 1 shows the NANDini Data Facts architecture (gateway enforcement, capability delegation). as two coordinated layers: an agent layer and a dataowner layer. User requests are interpreted by the LLM and executed through skills/tools. Agents expose identity and endpoint metadata through AgentFacts (via the NANDA registry), while dataset access metadata is exposed through a DataFacts pointer (the NANDini data exchange layer). On the data-owner side, each provider runs a gateway service in front of its database, together 3
Integrity Verification. The evidence.checksum_sha256 field contains the SHA-256 digest of the dataset at the time of the last update. After fetching data from endpoint, the consumer recomputes the digest and compares it against the stored value. A mismatch indicates either corruption in transit or a stale checksum resulting from an update cycle that has not yet refreshed the Data Facts document. In both cases the consumer can reject the data or re-fetch. Access Control. Semi-private capabilities are discoverable; private are not. When access_type is "public", the consumer accesses endpoint directly. When access_type is "semi_private" or "private", access follows a three-layer pipeline: (i) the consumer presents credentials to obtain a JWT scoped to the requested dataset capability, (ii) the JWT is forwarded to a capability-scoped gateway that enforces per-dataset ACLs, and (iii) the gateway proxies requests; endpoint always points to the gateway.
with control-plane tables for confidential access state, including grants, delegations, agent_keys, and audit_log. The gateway is the trust boundary: it verifies tokens, checks delegated scope and trust conditions, validates inputs, and only then allows access to actual data. Overall, the architecture realizes the NANDini vision of minimal, decentralized infrastructure for agentdriven data access by separating discovery, authorization, and execution, thereby enabling secure access to data and reliable exchange across multi-agent systems.
4.1
Data Facts Schema Design
Integration with AgentFacts. Data Facts extends the NANDA AgentFacts record with a single optional field, data_facts_url, which points to an externally hosted JSON document describing the agent’s dataset. The registry stores only a pointer, while the metadata document is resolved on demand. This design preserves the registry’s lightweight structure: the existing /register and /list endpoints require no structural changes, and agents that do not expose datasets incur no additional overhead. A consumer agent’s discovery workflow therefore proceeds as follows: (1) query the registry (GET /list), (2) extract data_facts_url from the returned AgentFacts record, (3) fetch the Data Facts document over HTTP(S), (4) validate freshness and integrity locally, and (5) access the dataset endpoint. Steps 3–5 are performed by the consumer without further interaction with the registry. Schema. The Data Facts document is a lightweight JSON object with a small evidence subobject. Table 2 lists all fields. Required fields cover the four properties identified in Section 3: dataset identity (dataset_id, dataset_description), access tier (access_type), the resolvable dataset endpoint (endpoint), freshness (ttl_seconds, evidence.last_updated), and integrity (evidence.checksum_sha256). Optional fields (evidence.source, update_frequency, data_owner) carry provenance and human-readable cadence information. Freshness Enforcement. A consumer agent computes staleness as:
4.2
Gateway and Database-Side Infrastructure
The Data Layer Gateway serves as the enforcement boundary between agents and heterogeneous storage engines. Rather than exposing database-native protocols directly, each backend is fronted by a gateway service as an adapter layer. This separation keeps agent-to-agent negotiation and capability semantics stable even when execution targets differ across relational, document, object, vector, cache, search, graph, or time-series systems. Gateway behavior and trust enforcement. A request entering the gateway is processed through a single verification path before any data operation is executed. The gateway validates JWT signatures against registered public keys, extracts capability and operation claims, and checks expiry and revocation state. For delegated credentials, it also verifies delegation lineage, confirms that the underlying grant remains active, and enforces scope consistency so delegated operations cannot exceed delegated rights. In credential-pass mode, token binding is enforced by matching caller identity to the credential binding claim, preventing credential reuse by unintended agents. After identity and delegation checks, the gateway applies replay protection through JTI tracking, optional per-agent rate limiting, and operation-level authorization against active capability grants. Request arguments are then validated against traversal and injection patterns and constrained by backend-specific scope guards such as bucket or collection allow-lists.
∆t = tnow − tlast_updated and rejects the dataset if ∆t > ttl_seconds. The TTL is set by the producing agent to reflect its actual update cadence; a finance feed agent updating every ten minutes would set ttl_seconds = 600. This check is performed client-side from the Data Facts document, requiring neither a round-trip to the producer nor a query to the registry. 4
Table 2: Data Facts schema fields. Field
Semantics and constraints
Required dataset_id dataset_description access_type endpoint
Stable identifier for the dataset Human-readable description "public" | "semi_private" | "private" HTTP(S) gateway URL where data is served (never the producer’s raw endpoint) evidence.last_updated ISO 8601 timestamp of last data update evidence.checksum_sha256 SHA-256 hex digest of the dataset (64 chars) ttl_seconds Cache validity window; must be > 0 Optional evidence.source update_frequency data_owner
Provenance label (e.g. API name) Human-readable update cadence Agent identifier of the data provider
Only after these controls have been satisfied does the gateway dispatch the request to the backend adapter and persist an audit record containing principal, capability, action, success state, and result cardinality. Execution paths. The architecture supports two operational paths with the same enforcement model. In A2A proxy mode, a requester sends a negotiated query to the data owner, and the owner executes locally before returning results over A2A. In credential-pass mode, the requester presents a delegated credential directly to the owner gateway at /query. Although the transport differs, authorization, validation, and auditing are enforced in the same gateway pipeline. Database-side control plane. Security state is materialized in control-plane tables, including grants for capability authorization, agent_keys for signature verification, token_revocations for invalidated credentials, delegations for credential lineage and revocation, and audit_log for access evidence. Data payloads remain in backend-native stores and are accessed through adapter-specific query handlers. This control-plane/data-plane separation keeps governance introspectable and auditable without coupling policy state to application data schemas.
and receives public capability entries. If Agent B calls negotiate_request_access for a public capability, Agent A returns a public-access acknowledgment (no credential) together with available query names. Semi-Private: Capabilities are discoverable but credential-gated. After discovery, Agent B sends negotiate_request_access. Agent A either (i) auto-approves and issues a delegated credential (trusted requester) or (ii) returns a pending request for manual approval. Agent B then queries data using negotiate_use_credential (A2A proxy), or optionally negotiate_use_credential_direct (direct gateway mode). Private: Capabilities are not discoverable via inquiry. Agent B requests a private credential via negotiate_request_private_credential (with a known capability ID). Agent A issues a short- lived credential only to trusted agents; untrusted requests are denied. After credential issuance, Agent B uses negotiate_use_credential to execute queries.
5
Experiments
We evaluate Data Facts across five experiments targeting the four schema primitives and overall deci4.3 Multi-Agent Data Exchange and sion quality. Experiments 5.1–5.3 validate the publicaccess path; Experiment 5.4 validates the privateNegotiation access pipeline; Experiment 5.5 measures the downData Facts uses a capability-based A2A negotiation stream effect on agent decision accuracy. protocol (negotiation.* messages/tools). Agents first discover shareable capabilities, then request au- 5.1 Discovery Overhead thorization, and finally query data through delegated Setup. We compare two retrieval conditions at access. N ∈ {50, 200} simulated agent queries. The baseline Public: Capabilities are discoverable and do not re- condition is a single-step direct GET to a known dataset quire credentials. Agent B calls negotiate_discover endpoint, representing hard-coded endpoint coupling. 5
run per corruption level. Baseline agents ingest payTable 3: Discovery overhead: baseline (direct, 1 step) loads without validation; treatment agents recomvs. Data Facts treatment (3 steps). pute the SHA-256 digest and compare it against Condition N Mean TTD (s) evidence.checksum_sha256, rejecting on mismatch. Results. Treatment agents detect 100% of corrupted Baseline 50 0.120 payloads at every non-zero corruption level, with zero Treatment 50 0.380 Baseline 200 0.130 silent failures. Baseline agents detect 0% of corrupted Treatment 200 0.400 payloads regardless of severity. The result holds at 1% corruption: even minimal byte-level modification is reliably caught. The checksum field provides all-orThe treatment condition executes the full Data Facts nothing detection, not probabilistic detection. path: registry lookup, data_facts_url resolution, and dataset fetch (three steps). The primary met- 5.4 Security Pipeline rics are time-to-first-data (TTD) and retrieval success Setup. A semi-private dataset is stored in Postrate. greSQL behind a JWT-gated capability gateway Results. Both conditions achieve 100% retrieval (HS256 signing). Access requires a credential negotiasuccess at all scales (Table 3). The treatment path tion step that issues a scoped token. We evaluate four incurs a fixed overhead of approximately 260–270 ms, authentication scenarios (valid credentials; missing, corresponding to two additional HTTP round-trips. empty, and bare-bearer headers), three TTL boundLatency remains stable as N scales from 50 to 200, ary conditions (immediate use; post-expiry; boundary confirming that overhead is bounded and does not precision at t = TTL±ϵ), and 46 adversarial attempts across six categories: wrong signing key; six syntactic grow with query volume. garbage-token variants; altered dataset_id claims 5.2 Freshness Enforcement with valid signatures; impersonation; privilege escaSetup. A periodically updated dataset is queried lation; and replay (206 total authentication trials; 29 under TTL windows of 60 s, 300 s, and 600 s. Baseline infrastructure-only tests, all n = 20). agents apply no staleness check; treatment agents Results. Valid-credential access succeeds in 20/20 reject data when tnow − tlast_updated > ttl_seconds. trials with mean fetch latency 2,372 ms and 100% SHAThe outcome metric is decision error rate: the fraction 256 checksum verification. All unauthorized access atof queries producing an incorrect downstream decision tempts return HTTP 401 with no unauthorized reads observed in our tests across all authentication scenarattributable to stale data consumption. Results. We label a request positive if the dataset is ios. TTL enforcement is exact: 45/45 trials classify stale (∆t > ttl_seconds). A detection is correct if tokens correctly on both sides of the expiry boundary, stale data is rejected. Decision error rate counts cases with 10/10 correct boundary-precision decisions. All where stale data is accepted (false negatives). Without 46 adversarial attempts are blocked (100% block rate, Data Facts, the decision error rate is 37.6% uniformly 0 data leaks), including altered-claim tokens carrying across all three TTL values: the agent has no mecha- a valid signature but a modified dataset_id. This nism to detect staleness regardless of the configured last result confirms that claim validation is required window. With Data Facts, the error rate drops to in addition to signature verification; signature-only 8.8% and stale-data detection reaches 76.6% (confu- JWT validation would pass these tokens. Gateway sion matrix: TP = 312, TN = 144, FP = 0, FN = 44). JWT verification incurs 48.6 ms per request, against TTL window size (60–600 s) has no differential effect; 259.2 ms for OAuth2 and 110.5 ms for SPIFFE mTLS, the staleness pattern is independent of window mag- while enforcing per-dataset capability scoping that nitude, and the results are identical across all three API-key schemes cannot provide. Two behaviors are documented as v1 limitations: TTL conditions. The binary presence of ttl_seconds determines whether detection occurs at all. The resid- token reuse within the validity window is permitted ual 8.8% error represents cases where data is fresh by design in stateless JWT, and tokens are not bound by TTL but has changed within the validity window, to caller identity. Both are structural properties of an irreducible bound set by the producer’s update stateless JWT and are addressable via a revocation registry and audience binding in a subsequent revision. cadence rather than the schema.
5.3
5.5
Integrity Verification
Data-Informed Decision Quality
Setup. Payload corruption is injected at rates span- Setup. We measure whether the Data Facts access ning 1%–50%. Two hundred independent trials are pipeline produces a statistically significant improve6
and 36.4% for 1-, 2-, and 3-agent topologies respecTable 4: Decision scenarios ranked by self-decide diffitively; the overlapping confidence intervals confirm culty (pooled n = 60 per scenario). near_parity is that topology has no effect on baseline LLM reasoning. not reliably answerable from priors without database The data-informed access chain succeeds in 420/420 access. tool-call executions with zero authentication failures, Scenario Self-decide (% correct) protocol errors, or integrity violations across all three upgrade_pool 91.7% topologies. tier_majority 76.7% The near_parity scenario achieves 0/60 self-decide tier_gap 50.0% accuracy: the question requires |5 − 6| = 1, which is premium_combined 18.3% inaccessible from training priors regardless of model bronze_dominance 6.7% capability. It functions as a discriminative control smallest_tier 3.3% confirming that certain query types are not reliably near_parity 0.0% answerable from priors without database access. A secondary latency finding (Table 5) shows that data-informed p95 latency is lower than self-decide p95 in all topologies, with the gap widening with infrastructure depth (3-agent: 29.8 s vs. 75.4 s). Without ground truth, the LLM incurs deliberation cost on counter-intuitive queries, producing verbose completions that dominate tail latency. The structured prompt constraining the agent to lead with its answer reduces completion length; the resulting output-token saving outweighs the database round-trip at the p95 tail.
6
Discussion
Figure 2: Decision quality on data-driven questions The five experiments collectively validate each rewith increasing difficulty. quired field in the Data Facts schema (and by extension the NANDini data exchange layer) and quantify the conditions under which these fields provide ment in agent decision accuracy on queries not an- measurable benefits for the NANDini data exchange swerable from LLM training priors. Seven binary layer. decision scenarios are drawn from a PostgreSQL ta- Schema field necessity. The discovery experiment ble with ground-truth distribution Gold : 5, Silver : 6, establishes that the external-pointer design imposes Bronze : 9. Each scenario requires exact counts the bounded, predictable overhead (260 ms, two HTTP LLM cannot reliably estimate from priors; the suite round-trips) independent of query volume and recovspans the full difficulty range from near-certain self- erable through TTL-aware caching. The freshness decide success to 0% (Table 4). Agents operate in experiment demonstrates that ttl_seconds is a nectwo modes: self-decide (LLM answers from priors essary field: without it, agents cannot distinguish alone) and data-informed (LLM queries the database stale from current data regardless of the window convia the Data Facts pipeline before answering). Three figured, because the check itself cannot be performed. topologies vary infrastructure depth: 1-agent (direct The residual 8.8% post-TTL error is irreducible at JWT gateway), 2-agent (one A2A credential delega- the schema layer and is set by the producer’s update tion hop), and 3-agent (two-hop A2A relay chain). cadence. The integrity experiment establishes that The factorial design yields 7 × 2 × 3 × 20 = 840 evalu- evidence.checksum_sha256 is not an optional audit ations; all LLM calls use gpt-5-nano. aid: silent corruption is a property of the unchecked Results. Data-informed agents achieve 100% ac- baseline at every corruption rate, and even 1% bytecuracy (420/420) across all scenarios and all three level corruption propagates undetected without the topologies, with a pooled 95% Wilson CI lower bound field. We chose SHA-256 over lighter alternatives such ≈ 99% (p < 0.001 against the null hypothesis that as CRC32 or BLAKE3 because its collision resistance data access does not improve accuracy). Self-decide properties are well-established in security contexts accuracy is 35.2% (148/420), 95% CI [30.9%, 39.8%]. and its computational cost is negligible relative to the Per-topology self-decide accuracy is 34.3%, 35.0%, network round-trips already required by the pipeline. 7
Table 5: Latency by topology and mode (seconds). ∆mean is data-informed minus self-decide mean latency (negative indicates data-informed is faster). p50 (s)
p95 (s)
Topology
Self
Data
Self
Data
1-Agent 2-Agent 3-Agent
14.8 25.3 34.9
18.2 17.8 20.9
46.8 52.7 75.4
27.7 23.3 29.8
∆mean
−1.2 s −8.5 s −11.6 s
Together, these results confirm the design choice to 7 Conclusion require freshness and integrity fields rather than mark Data Facts, a core concept of the NANDini initiative, them optional. addresses a structural gap in current agent infrastrucSecurity design. The security results demonstrate ture. While agents can discover one another through that the three-layer pipeline (JWT issuance, gateNANDA and communicate via A2A and MCP, no way claim enforcement, A2A delegation) functions machine-readable mechanism currently exists for adas a strict binary gate. The salient finding is that vertising, evaluating, or verifying the datasets held by claim validation is necessary in addition to signature participating agents. Data Facts resolves this gap by validation: tokens carrying a valid signature but an introducing a lightweight pointer—added to an existaltered dataset_id are correctly rejected, a property ing AgentFacts record—that allows dataset identity, that signature-only JWT verification does not provide. freshness, integrity, and access tier to be resolved on The two v1 limitations (stateless token reuse, absent demand. This approach avoids modifications to regidentity binding) are structural properties of stateless istry protocols and prevents inflation of registration JWT and are independent of the Data Facts schema; payloads, thereby operationalizing NANDini’s vision both have established mitigations available in the next of autonomous, data-driven agent ecosystems. Across revision. 840 decision-making evaluations, data-informed agents Decision quality and topology independence. achieve 100% accuracy on counter-intuitive queries The 0/60 result on near_parity isolates a class of where self-deciding agents achieve 35.2%; TTL enquery that is not reliably answerable from priors with- forcement reduces stale-data errors from 38% to 9%; out database access, independent of model capability. SHA-256 checksums detect 100% of corruption events The consistency of data-informed accuracy (100%) across all injection rates; and the security pipeline and self-decide accuracy (34–36%) across all three blocks all 46 forgery attempts with zero data leakage. topologies confirms that the A2A credential delega- Limitations. All decision-making evaluations use tion chain, including the two-hop relay, introduces a single model (gpt-5-nano) and a binary classificano information loss and no accuracy penalty relative tion format; therefore, the results may not generalto direct gateway access. The latency inversion at ize to open-ended queries or other model families. p95 suggests a broader principle: on counter-intuitive The ground-truth database is static; dynamic enviqueries, data access does not merely improve accu- ronments with high update rates may erode TTL racy but also reduces latency by eliminating the LLM enforcement effectiveness beyond the 8.8% residual deliberation that hard questions induce. error observed in this study. Additionally, the v1 seImplications for NANDini. These results validate curity pipeline does not bind tokens to caller identity, a key premise of the NANDini initiative: that au- allowing intercepted tokens to be reused within their tonomous agents require a structured data layer to TTL window. make reliable decisions. The observed accuracy gap Future work. Immediate protocol extensions include (100% vs. 35.2%) demonstrates that agent identity token revocation, audience binding, and short-lived and communication protocols alone are insufficient. credential exchange to address the identity-binding Without a mechanism to discover, verify, and access limitation. The current schema supports only singledatasets, agents default to reasoning from training pri- dataset documents; introducing a catalog endpoint ors, leading to unreliable outcomes on data-dependent that lists multiple datasets per agent would reduce queries. Data Facts provides the missing link between round-trips in data-rich deployments. Within the NANDini’s discovery infrastructure (NANDA) and its broader NANDini roadmap, we plan to extend Data vision of autonomous, data-driven agent ecosystems Facts along two axes. First, integration with knowloperating at planet scale. edge distillation pipelines, another NANDini research 8
domain, which would enable agents to advertise not [10] Charles Lu, Mohammad Mohammadi Amiri, and only raw datasets but also distilled knowledge artifacts Ramesh Raskar. Private data measurements for with associated provenance and quality guarantees. decentralized data markets. In ICLR 2024 WorkSecond, integration with W3C DCAT federation and shop on Data-centric Machine Learning Research PROV lineage fields would enable Data Facts docu(DMLR): Harnessing Momentum for Science, ments to participate in broader data governance work2024. flows without requiring schema changes, advancing NANDini’s goal of open, transparent, and planet-scale [11] Charles Lu, Baihe Huang, Sai Praneeth Karimireddy, Praneeth Vepakomma, Michael Jordan, agent data infrastructure. and Ramesh Raskar. DAVED: Data acquisition via experimental design for data markets. In AdReferences vances in Neural Information Processing Systems, [1] Riccardo Albertoni, David Browning, Simon volume 37, 2024. Cox, Alejandra Gonzalez Beltran, Andrea Perego, and Peter Winstanley. Data catalog vocabulary [12] Trent McConaghy. Ocean protocol: Tools for the Web3 data economy. In Handbook on Blockchain, (DCAT) — version 2. W3C recommendation, volume 194 of Springer Optimization and Its ApWorld Wide Web Consortium, February 2020. plications. Springer, 2022. [2] Anthropic. Introducing the model context proto[13] Mohammad Mohammadi Amiri, Frederic Berdoz, col. Anthropic Blog, November 2024. and Ramesh Raskar. Fundamentals of task[3] Carlo Batini, Cinzia Cappiello, Chiara Franagnostic data valuation. In Proceedings of the calanci, and Andrea Maurino. Methodologies for AAAI Conference on Artificial Intelligence, voldata quality assessment and improvement. ACM ume 37, pages 9226–9234, 2023. Computing Surveys, 41(3):16:1–16:52, 2009. [14] Boris Otto, Sebastian Steinbuß, Andreas [4] Gaia-X AISBL. Gaia-X: Technical architecture. Teuscher, and Steffen Lohmann. International Technical report, Gaia-X European Association data spaces: Reference architecture for the digifor Data and Cloud, 2021. tization of industries. In Designing Data Spaces: The Ecosystem Approach to Competitive Advan[5] Amirata Ghorbani and James Zou. Data shapley: tage. Springer, 2019. Equitable valuation of data for machine learning. In Proceedings of the 36th International [15] Ramesh Raskar, Pradyumna Chari, John Zinky, Conference on Machine Learning, volume 97 of Mahesh Lambe, Jared James Grogan, Sichao Proceedings of Machine Learning Research, pages Wang, Rajesh Ranjan, Rekha Singhal, Shailja 2242–2251. PMLR, 2019. Gupta, et al. Beyond DNS: Unlocking the internet of AI agents via the NANDA in[6] Google. Announcing the Agent2Agent (A2A) dex and verified AgentFacts. arXiv preprint protocol. Google Developers Blog, April 2025. arXiv:2507.14263, 2025. [7] Aafaq Hussain, Junaid Qadir, et al. A survey of agent interoperability protocols: Model Context [16] Aditi Singh, Abul Ehtesham, Ramesh Raskar, Mahesh Lambe, Pradyumna Chari, Jared James Protocol (MCP), Agent Communication ProtoGrogan, Abhishek Singh, and Saket Kumar. Evocol (ACP), Agent-to-Agent Protocol (A2A), and lution of AI agent registry solutions: Centralized, Agent Network Protocol (ANP). arXiv preprint enterprise, and distributed approaches. arXiv arXiv:2505.02279, 2025. preprint arXiv:2508.03095, 2025. [8] International Data Spaces Association. Dataspace protocol specification. Technical report, [17] Manu Sporny, Dave Longley, Markus Sabadello, Drummond Reed, Orie Steele, and Christopher IDSA, 2023. Allen. Decentralized identifiers (DIDs) v1.0. W3C [9] Timothy Lebo, Satya Sahoo, Deborah McGuinrecommendation, World Wide Web Consortium, ness, Khalid Belhajjame, James Cheney, David July 2022. Corsar, Daniel Garijo, Stian Soiland-Reyes, Stephan Zednik, and Jun Zhao. PROV-O: The [18] Tresata. NANDini: Networked agents natural PROV ontology. W3C recommendation, World distillation of interconnected nodal intelligence. Wide Web Consortium, April 2013. Tresata AI Blog, 2025. 9
[19] Suyi Wei, Yongxin Tong, Zimu Zhou, and Tianshu Song. Efficient and fair data valuation for horizontal federated learning. In Federated Learning: Privacy and Incentive, pages 139–152. Springer, 2020. [20] Jiayao Zhang, Yunshu Bi, Meng Cheng, Ji Liu, Kui Ren, Qiang Sun, Yuncheng Wu, Yang Cao, Raul Castro Fernandez, and Haifeng Xu. A survey on data markets. arXiv preprint arXiv:2411.07267, 2024.
10