ARD Federated Agent Catalog: Trust and Ranking Guide
On this page
Quick answer
ARD lets registries expose a common discovery interface across public, private, cloud, on-premises, and SaaS resource collections. The specification leaves collection scope and ranking to implementations. Enterprises should start with a curated approved collection, treat semantic relevance as one selection signal, verify publisher trust independently, and keep authentication and action controls at the resource’s enforcement point.
Federation reduces bespoke discovery connectors. It does not create one global trust policy or make every advertised resource interoperable.
Four different decisions
| Decision | Question | Evidence |
|---|---|---|
| Ingestion | Should this entry enter the index? | Source resolution, schema validation, publisher policy, malware/secrets checks |
| Discovery | Is this entry relevant to the query? | Text, filters, representative queries, capabilities, relevance evaluation |
| Admission | May this organization install or connect it? | Verified identity, provenance, attestations, review, version, risk tier |
| Invocation | May this user or agent perform this action now? | Runtime authentication, data scope, action authorization, approval, budget |
Do not allow a high score in one decision to answer another.
Collection scope
The ARD project says a collection may be open-web, tightly curated, or anywhere between, and that most enterprises will prefer a governed approved set. Define the policy before indexing:
- Allowed resource and media types.
- Public, partner, internal, experimental, and deprecated sources.
- Publisher ownership and namespace rules.
- Required metadata, representative queries, versions, and update times.
- Trust framework and verification requirements.
- Security, privacy, licensing, regional, and procurement gates.
- Review cadence, expiry, deprecation, and revocation.
Federated search can find resources outside the local registry. Decide whether remote results are shown as unapproved candidates, automatically ingested, or excluded.
Relevance ranking
ARD requires POST /search results to be ranked by relevance but does not prescribe the ranking model. The returned 0–100 score is informational semantic relevance, not a portable universal grade.
Evaluate ranking with representative tasks and labeled judgments. Track:
- Precision among the top results.
- Recall of known suitable resources.
- Exact-name and capability filters.
- Ambiguous, adversarial, multilingual, and rare queries.
- Publisher or description keyword stuffing.
- Duplicate or near-duplicate entries across registries.
- Stale, deprecated, or unreachable resources.
A registry can blend other policy signals into admission or reranking, but it must not relabel semantic relevance as trust or safety.
Publisher identity and trust manifests
The v0.91 proposal allows an optional trustManifest. When present, its identity must align with the publisher domain in the resource’s urn:air: identifier. This is designed to resist namespace squatting.
ARD does not define one signing scheme. The trust manifest declares a framework, and the registry is expected to run that framework’s verification. Capture the verified principal, trust schema, keys, signature, canonical payload, attestations, provenance, result, time, and expiry.
An unverified manifest is metadata, not trust. A valid signature proves control of a key under a framework; it does not prove code quality, absence of vulnerabilities, legal approval, or safe runtime behavior.
Federation and referrals
The search request can specify federation behavior, and registries may return referrals. Define:
- Which registries are trusted federation peers.
- How referral endpoints are authenticated and constrained.
- How loops, timeouts, partial results, duplicates, and conflicting entries are handled.
- Which registry supplies the authoritative full entry.
- How freshness, provenance, and revocation travel across caches.
- Whether remote entries require local review before they become usable.
Do not copy an entry into a local approved collection without preserving origin and revalidation.
Ranking-to-runtime handoff
Discovery should end in a candidate record, not an automatic action. A safe handoff includes:
- Full authoritative entry and artifact retrieval.
- Conformance and media-type validation.
- Publisher and trust-framework verification.
- Version, checksum, source, license, and vulnerability review.
- Owner and risk-tier assignment.
- Explicit install/connect approval.
- Resource-specific authentication and least privilege.
- Data and action policy, human confirmation, cost cap, logs, and revocation.
The ARD comparison guide maps these responsibilities across registries, MCP, and A2A.
Monitor drift
Track entry additions, changes, deletions, publisher keys, trust status, artifact versions, endpoint health, relevance quality, approval state, runtime incidents, and revocations. Re-run validation when any material field changes.
A stale discovery index can advertise a removed resource; a fresh entry can point to an artifact that changed after review. Bind approval to an immutable version or digest where the artifact ecosystem supports it.
Use the ARD agent catalog readiness check before enabling federated runtime lookup.
Frequently asked questions
Does ARD define a universal ranking algorithm?
No. Collection construction and ranking are implementation choices. The REST search interface and entry model are shared; relevance quality must be evaluated per registry.
Can trust be included in ranking?
A registry may use verified trust outcomes in filtering or admission according to its policy. Keep the ARD semantic relevance score conceptually separate from trust, compliance, and safety.
Does federation mean automatic interoperability?
No. Registries can share discovery descriptions and search, while the underlying artifact type, authentication, invocation protocol, client compatibility, and policy still vary.
Should enterprises crawl the whole public web?
The ARD project allows open collections but says enterprises will generally want governed approved sets. Start curated and expand only with measured ingestion, trust, and runtime controls.
Official sources
Source check: August 27, 2026. Recheck version, federation modes, trust rules, ranking fields, referrals, conformance, and implementation status.