Frequently Asked Questions

Understanding Loreth, the Registry and identity across change

Institutional Foundation Series · Companion publication White Book · Edition 1.0 · Prepared for institutional review

Publication record

Proposed publication identifier: LRF-WB-003 Publication type: White Book Series: Institutional Foundation Series Series position: Companion publication following LRF-WB-001 and LRF-WB-002 Owner and publisher: Loreth Registry Foundation Official publication date: To be assigned on approval Supersession history: Supersedes no prior publication; has not yet been superseded by a later edition. Canonical web destination: https://loreth.org/about-loreth/frequently-asked-questions

Contents

1. Executive summary 2. Understanding Loreth 3. Understanding the Registry 4. Understanding identity and continuity 5. Understanding governance 6. Understanding trust and limitations 7. Looking ahead 8. Continue exploring 9. About the publisher 10. Glossary 11. Colophon

Executive summary

A new framework is not understood merely because its terms have been defined. Readers also need to test it: against familiar systems, difficult transitions, disputed authority and the possibility that a record may be incomplete or wrong.

This publication is a bridge between understanding and confidence. It answers the questions that naturally follow the first two Loreth publications:

• Is Loreth replacing the identity and security systems already in use?
• Does registration mean endorsement?
• Can a record prove that an agent is trustworthy?
• Who decides what information is true?
• What happens when custody changes or an organization disappears?
• Why is a name not enough?
• How can a record remain useful without claiming certainty?

The answers keep several distinctions visible:

Registration is not endorsement.

Identity is not trust.

Authenticity is not authorization.

Continuity is not permanence.

Evidence is not certainty.

These are not slogans detached from the framework. They are safeguards against predictable misunderstandings. Loreth’s proposed Registry provides governed reference infrastructure for durable agent identity, accountable custody, planned continuity and verifiable governance. It does not replace existing controls, decide every dispute, guarantee conduct or remove the need for judgment.

The most useful answer is therefore often a boundary. Understanding what Loreth does not claim is part of understanding what it is for.

Understanding Loreth

Why does Identity Across Change matter?

Accountability becomes difficult when a subject changes faster than the records used to understand it. A name, credential, platform or custodian may change while the people who rely on the record still need to know which subject they are dealing with, who is responsible now and what happened before.

Identity Across Change exists to preserve understanding, governance, attribution, accountability, custody and continuity across legitimate change. It does not prevent change. It makes the basis for connecting the present to the past more visible and reviewable.

Is Loreth trying to replace existing identity systems?

No. Loreth complements existing identity, security and operational systems rather than replacing them.

Authentication can establish control of a credential. Authorization can determine what an agent may do under particular conditions. IAM, PKI, OAuth, policy engines, asset inventories, SIEM, observability, change management, incident response and business-continuity processes each answer important questions. Loreth’s proposed Registry provides a stable subject reference for those systems to use across change.

The distinction matters because a workload credential proves a current technical relationship, not necessarily the complete operational history of the same agent. A model name identifies a technology, not a particular deployment. A log may record an event without making clear whether the subject of that event remains identifiable after migration or re-keying.

Loreth adds a governed subject reference; it does not erase the controls around the subject.

Why isn’t a name enough?

A name can help people refer to an agent, but it does not by itself establish which subject the record describes, who is currently accountable, what happened before or why a later state should be connected to an earlier one.

Names can be reused. Deployments can be copied. Models can change. Organizations can reorganize. A familiar label may remain while the host, credential, custodian or purpose changes. The problem is not that the name is false; it is that the relationship between the name and the enduring subject may be unclear.

A durable identity requires a governed basis for connecting accepted changes to one subject. Similarity of name, code or purpose may be relevant evidence, but it does not settle the identity question by itself.

Does Loreth create a verdict about an agent?

No. Loreth is not intended to produce a single verdict that an agent is safe, lawful, accurate, ethical, secure, intelligent or worthy of reliance.

A Registry record can make identity, custody, lifecycle state, evidence and verification information more resolvable. Those facts can inform judgment. They do not replace the relying party’s own policy, risk assessment, technical controls, legal duties or decision about whether a particular agent is appropriate for a particular use.

The Registry informs judgment. It does not replace it.

Is Loreth a marketplace or an AI model provider?

No. Loreth is proposed as registry and governance infrastructure for the conditions under which intelligent agents can remain identifiable, accountable and governable across time.

It is not an AI model provider, an agent marketplace or a directory of promotional profiles. Its purpose is not to make an agent attractive to buyers. Its purpose is to make defined identity and governance claims more resolvable, with their evidence, authority, status and limits visible under applicable rules.

What Loreth Is Not

Loreth is not a certification authority, model provider, trust score, risk-rating service, marketplace or regulatory authority. It does not guarantee safety, truthfulness, legality or suitability. It does not replace existing identity, IAM, authorization, security, governance, compliance or operational-control systems.

These boundaries are part of the framework’s purpose. Loreth provides governed reference infrastructure for identity, custody, continuity and verifiable records. It does not turn a Registry entry into a verdict, replace the judgment of a relying party or decide every question that may arise around an agent.

Why does Loreth focus on agents with material consequences?

Not every script or temporary task requires the same level of durable public reference. The need for governance infrastructure is proportionate to consequence.

The concern is strongest where an agent has meaningful authority, access to sensitive information, persistence, external reliance, participation in multi-agent workflows or continuity value. In those settings, broken handover or ambiguous responsibility can make later accountability difficult.

This is not an argument that every agent must be publicly registered. It is an argument for controls proportionate to the consequences of ambiguity.

Understanding the Registry

Does registration mean endorsement?

No.

Registration or issuance means that a record has passed the applicable creation and acceptance process and has received its identifiers under the Registry’s rules. It does not mean that Loreth endorses the agent’s behavior, safety, legality, truthfulness, intelligence or suitability for a transaction.

A Registry may verify required fields, evidence, signatures, custody assertions, classifications and continuity provisions. That verification is bounded by the applicable profile and evidence. It is not a universal approval of everything the agent may do.

Registration is not endorsement.

What does a Registry record contain?

The exact profile is governed by the applicable Registry arrangements. The proposed core profile may include an agent profile; public and canonical identifiers; creation date; version history; trust and risk classifications; operational status; primary custodian; emergency contact; successor hierarchy; transfer conditions; and cryptographic verification information.

A public view should disclose only what is necessary to resolve identity, status, classifications, custody state, current digest, operator and verification method. Secrets, private keys, recovery phrases, confidential payloads and unnecessary personal data should not become public Registry content.

The record is therefore not simply a profile page. It is a governed reference with current assertions, lifecycle rules and history.

What is the difference between a Loreth ID and a canonical identifier?

The proposed framework uses two identifiers that point to one governed agent record.

A Loreth ID is a human-readable public identifier, such as LTH-AG-000001. A canonical identifier is machine-oriented, such as loreth:agent:<uuid>. The public identifier helps people communicate and search. The canonical identifier supports signing, interfaces, history chains and interoperability.

The identifiers are intended to be non-reassignable and not to encode mutable personal, employment, platform or organizational details. A change in cloud, model provider, host, custodian, operating status or lifecycle status does not by itself create a new identity.

Is a submission the same as a public record?

No. A submission is not an issuance.

Registration begins with a submission of the proposed record and supporting evidence. A Request Reference may acknowledge that a submission exists, but it does not create a Loreth ID and does not make the submission a public record.

Issuance occurs when the Registry accepts the initial record and assigns the public and canonical identifiers together. It is a record-creation event, not an endorsement of behavior.

What happens when a record changes?

A material change should produce a new record version, a new digest, an attributable history entry and a Registry receipt while preserving earlier accepted versions under the applicable retention policy.

The purpose is to distinguish current information from historical information. A relying party should not have to assume that a record is timeless or that its present state describes every earlier state.

Lifecycle actions may include maintenance, transfer, recovery, suspension, retirement and revocation. Each has a different purpose and status. A retired record may retain historical resolution. A revoked identifier is not recycled.

Understanding identity and continuity

Can identity persist when ownership changes?

Identity can persist when accountable custody changes, but the change must be governed rather than inferred.

The incoming custodian must accept the defined scope. The authorization basis, eligibility, evidence, restrictions, conflicts and approval must be reviewed. The prior custodian remains visible in history. Naming a successor does not automatically transfer custody.

The question is not whether the same organization remains involved. The question is whether the record provides a reviewable basis for connecting the later subject to the earlier one while making current responsibility clear.

Continuity is not permanence.

What is the difference between identity and trust?

Identity asks which subject this record represents and how that subject can be resolved. Trust asks what evidence supports identity and custody assertions and how much reliance may be appropriate under the circumstances.

A stable identity can make trust reviewable, but it does not make the agent trustworthy. A record may be identifiable while its evidence is weak, stale or disputed. Conversely, strong evidence about a current deployment is difficult to interpret if the enduring subject is unclear.

Identity is not trust. It makes trust reviewable.

What is the difference between authenticity and authorization?

Authenticity concerns whether a statement, record, signature or identifier can be connected to its claimed source or subject. Authorization concerns whether an action is permitted under particular conditions.

An authenticated agent may still be unauthorized to perform a particular action. An authorized action may still require a clear identity and attributable record to establish which subject performed it. The two questions support one another but should not be collapsed.

Authenticity is not authorization.

Can continuity exist without keeping a system unchanged?

Yes. Continuity does not require the same model, host, credential, platform or technical implementation to remain unchanged.

It requires the relationship between the earlier and later states to be governed and intelligible. A migration can be recorded as a version event for the same subject while technical aliases and evidence change. A copy, fork or independently operated reimplementation may require a separate record linked by provenance.

The goal is not to freeze a system. It is to prevent change from silently erasing the basis for accountability.

What if an organization disappears?

The answer depends on the applicable custody, recovery, succession and dispute arrangements. The record should not silently invent a new custodian merely because the previous organization is unavailable.

A continuity plan may identify who can initiate recovery, what evidence is required, which successor is eligible and whether a waiting period or restriction applies. If authority cannot be resolved, the appropriate outcome may be suspension or an indeterminate verification result while the dispute route is followed.

A record can retain historical resolution even when active governance cannot continue. Preserving the history does not pretend that current authority has been settled.

Understanding governance

Who decides what information is true?

Loreth does not turn every Registry statement into universal truth. Authority is bounded by the applicable Registry arrangements, evidence, review process, source designation and scope of the assertion.

Governance defines who may assert custody, how an incoming custodian accepts it, what causes downgrade or suspension, how an authority conflict is treated, how records are retained and how a verifier can determine which operator’s statement is being reviewed.

Where a needed authority, evidence item, dependency or conflict cannot be resolved, the result may be indeterminate. That is not a hidden pass.

Can a Loreth record be wrong?

Yes. A governed record can contain an incorrect, incomplete, stale or disputed assertion. Governance and verification reduce ambiguity; they do not create omniscience.

That is why the framework separates current information from history, preserves attributable versions, records evidence and exposes limits. A record may also be suspended, marked invalid, marked indeterminate or valid with notice under applicable rules.

Evidence is not certainty.

Who is accountable for a Registry record?

The current primary custodian is the party authorized and obligated to govern the agent’s record in its deployment context. That does not automatically make the custodian the developer, host, purchaser, model provider or sole party with legal responsibility.

The Registry’s purpose is to avoid operational ambiguity about who maintains the record and responds to lifecycle events. Legal responsibility may be shared or determined under applicable law. Registry custody is an important governance relationship, not a universal liability ruling.

What happens when two organizations claim control?

A credible Registry should not silently select a winner. The conflict should remain visible and be handled through the applicable dispute route.

The record may be suspended or placed in an indeterminate verification state while authority, evidence and acceptance are reviewed. Quarantining a conflict is different from agreeing with both parties or pretending that one statement is already authoritative.

Quarantine a conflict. Do not invent agreement.

Does federation mean one global operator decides every dispute?

No. Federation is a coordination discipline for making independent records understandable together.

A federated exchange should preserve operator attribution, authoritative-source designation, signed receipts, identifier mappings, provenance, history, classifications, status and unknown extensions. Its credibility depends on transparent allocation authority, conformance scope, cryptographic practices, retention rules, dispute handling and operator responsibilities.

Federation does not eliminate independent authority. It makes the relationship between authorities more legible.

Understanding trust and limitations

Does a record prove that an agent is trustworthy?

No. A record can provide evidence about identity, custody, status, history and verification. It cannot prove that an agent will behave well, remain safe, be truthful, be lawful or be suitable for every use.

Trust classification describes the strength of evidence and operating controls. Risk classification describes consequence and context. Registry status describes whether a Registry assertion may be relied upon under its rules. Operational status describes the reported or observed condition of the deployed agent.

These dimensions should not be averaged into false confidence. A high-risk context and a high assurance level are not the same claim.

What does the Registry prove?

Under its applicable rules, the Registry may establish that a defined record exists, that identifiers point to that record, that specified assertions and evidence were accepted, that a current status applies, that a custodian is recorded and that versions or changes can be examined.

The exact claim depends on the profile, evidence, authority and verification result. The Registry proves only what the applicable process and record support.

What does the Registry not prove?

It does not prove that an agent is safe, lawful, accurate, secure, ethical, intelligent, compliant, unbiased, commercially suitable or worthy of reliance in every context.

It does not replace authorization, least privilege, secure tool design, monitoring, incident response, model evaluation, human approval or the relying party’s own judgment. A verifiable history can coexist with an unsuitable agent.

Can public resolution expose sensitive information?

It should not. Public resolution exists so a relying party can determine whether an identifier maps to an authoritative record, what status applies, who operates the record and how to verify its integrity.

It should not expose private keys, private recovery materials, sensitive personal information, confidential agent memory or protected authority evidence. Public disclosure should be minimized and access-controlled where sensitivity requires it.

Why preserve uncertainty instead of choosing the most likely answer?

Because a confident but unsupported answer can make accountability harder to recover later. If authority, evidence or continuity is disputed, marking the result indeterminate or suspending reliance preserves the fact that the question remains unresolved.

Uncertainty is not a design failure when the evidence cannot support a stronger claim. Making uncertainty visible is part of keeping the record honest and governable.

Looking ahead

Is the framework already a final standard?

The Registry Handbook and associated standards materials describe a proposed framework and identify areas requiring further examination. This publication does not make a separate conformance claim or convert proposed guidance into an adopted standard.

Future standards roadmaps, research roadmaps and publication decisions should remain distinguishable from current institutional commitments and from the records of any operating Registry environment.

Why publish companion documents instead of one complete handbook?

Different readers need different entry points. About Loreth: Identity Across Change explains why the problem matters. Core Principles explains the four governing obligations. This FAQ answers the questions and objections that arise after those ideas have been introduced. The Registry Handbook provides the more detailed proposed record and governance arrangements.

The sequence allows readers to move from purpose, to principles, to clarification, to framework detail without forcing every reader into technical or procedural material at the beginning.

Continue exploring

About Loreth: Identity Across Change explains the Agent Identity Gap and why identity, continuity, governance and accountability become necessary as intelligent agents change.

Core Principles explains Identity Persists, Custody Remains Accountable, Continuity Is Planned and Integrity Is Verifiable.

Registry Handbook examines proposed records, identifiers, issuance, lifecycle events, custody, verification, privacy, evidence handling, governance and federation in greater detail.

This FAQ is intended to sit between those works: a place to test assumptions, clarify boundaries and continue informed exploration.

The next step need not be agreement. It can be a more precise question. Readers can return to About Loreth: Identity Across Change, revisit Core Principles, examine the Registry Handbook, or continue toward future Loreth publications and community participation routes when available. The useful contribution may begin with a case the framework does not yet explain well.

About the publisher

The Loreth Registry Foundation develops public-interest registry and governance infrastructure for durable agent identity, accountable custody, planned continuity and verifiable governance. This publication explains the boundaries and implications of that work. It does not replace the Registry Handbook, a technical specification or the judgment of a relying party.

Published by the Loreth Registry Foundation Founded by J. Christopher Holmes

Glossary

Accountability. The ability to identify responsibility and examine the basis for relevant actions or claims. It is not a universal allocation of legal liability.

Authenticity. The relationship between a statement, record, signature or identifier and its claimed source or subject. Authenticity does not establish authorization.

Continuity. Planned arrangements for transfer, recovery, suspension and retirement. Continuity does not require indefinite operation or an unchanged system.

Custodian. The current primary party authorized and obligated to govern an active Registry record in its deployment context. Custody does not settle every ownership or liability question.

Identity across change. The governing idea that legitimate changes can remain connected to an identifiable subject through a governed and reviewable history.

Integrity. The record properties and relationships that allow accepted information and its history to be checked. Integrity alone does not prove every underlying assertion true.

Registry. Governed infrastructure that makes authoritative identifiers, current assertions, lifecycle rules and history resolvable within applicable arrangements.

Verification. Checking defined properties, evidence, integrity and authority under applicable rules. It is not certification of an agent’s conduct.

Closing Reflection

The purpose of identity, accountability, continuity, evidence and governance is not to prevent change. It is to preserve understanding despite change. Good governance does not eliminate uncertainty; it makes uncertainty visible and reviewable, so that important questions remain answerable over time.

Identity should remain discoverable. Responsibility should remain visible. Transitions should remain governable. History should remain reviewable.

Colophon

Frequently Asked Questions is a companion White Book in the Institutional Foundation Series. Proposed publication identifier LRF-WB-003. Edition 1.0. Prepared for institutional review under the Loreth Publication System.

The publication is designed as the bridge between understanding and confidence. Its answers clarify distinctions, correct predictable misunderstandings and preserve the limits of what a governed Registry record can support. Its examples are illustrative, not empirical evidence or customer references. Its claims do not introduce new principles, standards, classifications or institutional commitments.