The Agility Question

TL;DR

• The spine. An agent carries its cryptography in three places, and each has to survive the same transition: the identity it presents, the channel it speaks over, and the receipts it leaves behind. Paper 1 took the channel. This paper takes all three, and the discipline that keeps them changeable.

• Agility, not migration. Post-quantum readiness is not a one-time swap. The binding obligation in regulated finance, the DORA technical standard, is a duty to keep cryptography changeable, not to deploy a named algorithm. You migrate continuously, or you fall behind the deprecation clock.

• The ladder. Crypto-agility is measurable, per surface, on six axes and five levels, from inherited-and-unseen to a scheme swap you have rehearsed. An agent is only as agile as its weakest surface.

• The instrument. Agent-CBOM extends the ratified Cryptographic Bill of Materials (CycloneDX, ECMA-424) with the one thing it lacks, the agent and its three surfaces, so the inventory round-trips into the supply-chain tooling an organization already runs.

• The preliminary finding. Across current agent-governance and audit-receipt implementations, one pattern recurs: receipt signatures are classical, often fixed at the framework or library layer, and absent from the cryptographic inventory. Agent-CBOM is built to expose and measure that gap. Under harvest-now-forge-later, the exposure is accruing now.

• The frame. The regulators now require crypto inventories and say nothing about agents. The agent layer is the gap, and unlike most gaps in this field, it is measurable.

A migration with a hole in it, 2026

A European bank finishes the first phase of its post-quantum migration. It inventories its cryptographic estate, moves its public web PKI and its internal TLS to hybrid key exchange, schedules its code-signing roots for rotation, and signs the program off to the supervisor. The cryptographic bill of materials is clean. Every line is accounted for.

The same bank runs a fleet of AI agents. They reconcile transactions, draft client correspondence, and file regulatory reports, and each one signs a receipt of what it did, on a fixed classical signature, so the record can be audited years later. None of those signatures appears in the bill of materials. The inventory tool has no concept of an agent, so the agent’s cryptography was never a line anyone could miss. The migration was real. The agent was invisible to it.

This is the agility question. Post-quantum readiness is not something an organization finishes. It is a capability it has to hold across three surfaces of every agent, for as long as the agents run, and the first surface most programs cannot even see is the one the agent leaves behind.

Post-quantum migration is sold as a project with an end date. For AI agents it is not. An agent carries cryptography in three durable surfaces, its identity, its channel, and its receipts, and each must stay changeable across a transition that will outlast any single algorithm. What an organization cannot inventory, it cannot migrate, and the agent layer is the part the standard inventories still cannot see.

From one surface to three

Paper 1 took the channel, the surface the agent protocols left to whatever TLS sits beneath them. It was the surface no one was assigned to own. It is not the only one.

An agent carries its cryptography in three places, and a migration has to reach all three. The identity it presents: the keys, certificates, and decentralized identifiers it authenticates with. The channel it speaks over: the MCP and A2A transport Paper 1 addressed. The receipt it leaves behind: the signature on every action and audit record, the evidence a regulator reads after the fact. Authorization sits on top of identity as a policy layer; it is not a fourth place where long-lived cryptography lives.

An agent’s posture is the weakest of the three surfaces, not the average.

The three do not migrate together, and they do not fail together. An organization can move its channel to hybrid key exchange and leave its receipts on a classical signature for another five years, because different teams own them and no single inventory holds all three. The posture that matters is the weakest of the three, not the average, and the weakest is usually the one no one is looking at.

Why agility, not migration

The instinct is to treat post-quantum as a migration: a project, with a start, a cutover, and an end. For a fixed estate that instinct is wrong by a little. For agents it is wrong by a lot.

The binding language already says so. In regulated finance, the DORA technical standard requires that the policy on cryptographic controls provide for updating or changing the cryptographic technology “on the basis of developments in cryptanalysis,” so that it stays resilient. (Article 6(4) of the DORA technical standard, Commission Delegated Regulation (EU) 2024/1774.) Read it closely: the duty is not to deploy a named algorithm. It is to keep the capability to change one. The arrival of a cryptographically relevant quantum computer is, by construction, a development in cryptanalysis, and so is whatever supersedes the first post-quantum standard. The obligation is agility, and it does not expire.

The clock makes the same point from the other side. NIST’s draft transition timeline expects quantum-vulnerable public-key algorithms to be phased out, deprecated after 2030 and disallowed after 2035 at the lower security strengths, with the rest disallowed after 2035. The standardized post-quantum signatures are themselves young, and the schemes that would aggregate them at machine scale are not settled at all, the aggregation cliff from Paper 1. An organization that migrates once, to one algorithm, has not finished. It has taken the first step of a program that has no last step. Agility is the capability to take the next step cleanly, again, without re-architecting to do it.

The ladder: six axes, five levels

If agility is the capability, it has to be measurable, or it is just a posture. It is measurable, per surface, on six axes.

Inventory: is the surface’s cryptography known and detected, or inherited unseen? Abstraction: does it sit behind an interface, or is it hardcoded? Replaceability: can the algorithm be replaced as a configuration or module change, without re-architecting? Ownership: does a named person own its posture, or did it arrive by default? Horizon: is it classified by how long its data must stay confidential or its record valid, against the deprecation clock? Drill: has a scheme swap actually been performed and measured, or only assumed?

Replaceability is the crux, and it is worth stating precisely. Crypto-agility is the modular capacity to replace a cryptographic component, which the EU’s coordinated roadmap is careful to distinguish from negotiating a cipher suite at runtime; runtime negotiation, done carelessly, invites downgrade attacks rather than agility. For a channel, replacement may run through a negotiated handshake. For identity and receipts, it is a rotation and replacement path, not a negotiation. The axis measures whether the path exists, not whether the algorithm is chosen live.

The six axes resolve into five levels, each a precondition for the one above it.

Crypto-agility is measurable: five levels, six axes, scored per surface.

Level 0, Blind: the cryptography is inherited and unseen. Level 1, Inventoried: every surface’s cryptography is known and detected. Level 2, Abstracted: it sits behind an interface, so a swap is a configuration change and not a code change. Level 3, Replaceable and owned: a replacement path is in place, a named owner is accountable for it, and the surface is classified by horizon. Level 4, Drilled: the organization has swapped a scheme in earnest and measured what it cost. The distance from Level 2 to Level 3 is the distance from “could be changed” to “has an owner, a horizon, and a path to change it”; the distance to Level 4 is from “has a path” to “has used it.” An agent’s level is the lowest of its three surfaces, because an adversary attacks the weakest one, not the average one.

There are general crypto-agility maturity models already, and this is not another one. The established models score an enterprise’s whole cryptographic estate and stop at the edge of it; neither of the two best-known has a concept of an agent, and the academic one has been criticized in the literature for staying a questionnaire rather than something an inventory tool can produce. The ladder here is narrower and harder: scoped to the agent’s three surfaces, and driven by detection rather than self-assessment. The point of a level is not a score to report to a committee. It is to find the weakest surface before an adversary does. The per-surface rubric is in the appendix.

The three surfaces, in depth

The channel. Paper 1 is the long version. In short: agent traffic terminates somewhere, and whoever terminates the TLS handshake chooses the key exchange. Terminate at a CDN and the provider’s roadmap sets the posture; at a gateway, the platform team; at the origin, the deploying organization. Hybrid key exchange (X25519MLKEM768) is deployable today, which makes the channel the surface where agility is cheapest to buy. It is also the one most often inherited by accident.

The identity. An agent authenticates with keys and certificates, and at fleet scale it does so constantly. This is where the post-quantum signature sizes bite. The standardized workhorse, ML-DSA-65, runs to roughly 3.3 kilobytes per signature and does not aggregate the way classical schemes let a million machine identities collapse to the size of one. An identity surface that rotates cleanly and sits behind an interface can absorb a larger signature when it has to. One with keys pinned into agent binaries, attesting every few seconds, cannot. Agility here is rotation and a replacement path, bought before the swap is forced.

The receipt. This is the surface the inventories miss, and the one accruing risk fastest. An agent signs a receipt of what it did so the action can be audited later. Across current agent-governance and audit-receipt implementations a pattern recurs: those signatures are classical, Ed25519 in practice, often fixed at the framework or library layer, and absent from the cryptographic inventory. The threat is not that someone reads the receipt. It is that someone forges it. Once the signature scheme is broken, receipts written under it can be forged, and an audit trail that was supposed to prove what an agent did proves less than it appears to. This is harvest-now-forge-later, the signature analogue of harvest-now-decrypt-later. Under the draft NIST timeline, EdDSA remains classical and is expected to be disallowed after 2035; any receipt that must carry evidential weight beyond that horizon is in scope now.

A classical signature is not the only evidentiary control, and the honest version of this argument says so. Timestamping, hash-chained and transparency logs, hardware-backed signing, periodic re-signing, and preserved validation evidence all extend the life of a record beyond the one signature on it. The point is narrower and harder to escape: where the receipt layer has no inventory, no replacement path, and no preservation strategy, the evidentiary posture rests on a single classical signature with no plan to change it. That is the common case today, and it is the gap the inventory is built to surface.

A receipt is durable evidence only while its signature outlives the retention horizon.

The math is the channel’s, moved from confidentiality to evidence. DORA-scoped incident records must stay non-repudiable for years. NIS2 audit evidence and EU AI Act high-risk records carry multi-year retention. A receipt signed today on a fixed classical scheme, that has to remain valid past the early 2030s, is already exposed, because its evidential value expires the day the scheme does. Signing the log is not enough if the signature cannot outlive the log.

Agent-CBOM: the instrument

You cannot manage what you cannot inventory, and the inventory standard does not see the agent. The format question is settled, and it is worth saying so plainly rather than inventing a competitor: the Cryptographic Bill of Materials, CycloneDX, ratified as ECMA-424 and used in the post-quantum migration guidance from NIST’s national cybersecurity center, is the accepted way to enumerate an organization’s cryptographic assets. What it lacks is the agent. Its schema has no asset type for an agent, and no concept of the channel, identity, or receipt surfaces an agent carries.

The fix is not a new format. It is a profile. Agent-CBOM is an agent-channel profile of the CBOM: it adds the agent and its three surfaces as first-class cryptographic assets, each carrying a per-surface agility score, expressed over the standard’s existing descriptors so the result round-trips into the supply-chain tooling an organization already runs.

Agent-CBOM extends a ratified standard rather than inventing a format.

There is precedent for exactly this move. The telecom industry built a CBOM profile for 5G; domain-specific profiles of the standard are an accepted pattern, not a fork of it. The agent profile is the one that had not been written. The contribution here is the profile and its schema, proposed to extend the standard rather than to compete with it, with a reference detector to prove it runs. It is defensive prior art for a category, in the same spirit as the architecture work earlier in this body, not a product. A sample of a conforming document is in the appendix.

The reference implementation

A model is only as credible as a tool that produces it. A reference implementation discovers the three surfaces on a sample agent stack, scores each on the six axes, and emits a conforming Agent-CBOM document. It is live at agentcbom.mahasbini.org .

It is honest about what it can and cannot see, on the same principle as the rest of this work. Classical cryptography is detected and verified live: it parses the certificates, reads the signature schemes, and probes the live TLS. Post-quantum posture is declared by parameter set rather than asserted, because a local stack cannot always offer a hybrid group to probe against; where the probe is inconclusive, it says inconclusive rather than claiming absence. The tool is a reference implementation of the profile, not a maturity certificate. The profile is the contribution; the tool only proves the profile runs.

The regulatory and sovereignty frame

The deadline is real, and as in Paper 1 the precise shape of it matters, because the field overstates it.

For financial entities the duty is binding and in force. The DORA technical standard’s crypto-agility obligation, Article 6(4), is a duty to keep cryptography changeable as cryptanalysis develops, and it reaches an agent’s surfaces inside a regulated workflow exactly as it reaches anything else. The receipt that a regulated agent signs is ICT, and a receipt that cannot change scheme is the precise condition the article is written about.

The broader instruments point the same way with less force, and saying so accurately is part of being useful to the people who answer to a supervisor. The EU’s coordinated roadmap for the post-quantum transition asks member states to begin with cryptographic inventories by the end of 2026; it mandates the inventory and says nothing about agents, which is why an inventory that cannot see the agent layer can satisfy the letter while missing the substance. NIS2, the directive for essential and important entities, requires them to govern their cryptography without carrying DORA’s explicit duty to keep it changeable. The EU AI Act’s Article 15, the high-risk obligation to be accurate, robust, and cyber-secure, names no cryptographic algorithm at all; a claim that the AI Act requires quantum-safe cryptography is an overclaim and is not supportable from the text. The honest argument is the conservative one: Article 15 sets a state-of-the-art resilience bar, and a forgeable audit trail under harvest-now-forge-later is the kind of weakness a diligent provider has to weigh against it. Post-quantum readiness is a defensible means of meeting that standard, never a named requirement of it.

The sovereignty frame, stated carefully. The agent layer of the post-quantum transition is, at the time of writing, largely unowned. The commercial tools that come closest secure the credentials an agent uses, rather than the cryptography inside its channels and receipts, which leaves the three-surface inventory itself as open ground. An open, downloadable, agent-scoped profile of a ratified standard is a sovereignty asset for the same reason the channel was in Paper 1: it lets an organization, or a continent, see and own a layer that is otherwise inherited from whatever vendor happened to ship it. The inventory is how a board closes a gap it cannot currently see.

Five things to do Monday

The five-step starting point, for the week the next agent fleet ships.

1. Inventory all three surfaces. For every agent, list the cryptography of its identity, its channel, and its receipts, not only the one you already migrated.

2. Classify each by horizon. Tag every surface by how long its data must stay confidential or its record stay valid. Anything past the early 2030s is in scope now.

3. Score each surface on the six axes. Find the weakest link. The agent’s posture is that surface, not the average.

4. Assign a named owner per surface. A posture no one owns is a posture no one will change when the algorithm does.

5. Drill one scheme swap, and measure it. Swap a signature or a key-exchange group on one agent, in a test, and record what it cost. Agility you have not rehearsed is agility you do not have.

What you cannot inventory, you will not migrate. Three surfaces, one clock. That is the model to apply before the next agent fleet scales.

Paper 2 of the PQC for AI Agents series. It draws an agent’s three cryptographic surfaces, identity, channel, and receipt, into one model an organization can inventory and score. Next: regulated agents under DORA and NIS2, where the model meets the supervisor.

Appendix, for technical and cryptographic reviewers

The inventory standard. CycloneDX Cryptographic Bill of Materials, ratified as ECMA-424; CBOM was introduced in CycloneDX 1.6 (April 2024) and is referenced by the NIST NCCoE post-quantum migration project (SP 1800-38B). The schema enumerates cryptographic assets, algorithms, certificates, protocols, and related material, but defines no agent asset type and no channel, identity, or receipt surface. Agent-CBOM is proposed as a domain profile, on the precedent of the ATIS telecom (5G) CBOM profile (ATIS, 2025).

The six axes and five levels. Axes: inventory, abstraction, replaceability, ownership, horizon, drill. Levels: 0 Blind, 1 Inventoried, 2 Abstracted, 3 Replaceable and owned, 4 Drilled. Overall posture per agent is the minimum across its three surfaces. The “replaceability” axis is the modular capacity to replace a component (EU coordinated roadmap), explicitly not a requirement to negotiate the cipher suite at runtime.

Scoring rubric (per surface). The levels are cumulative: each is the gate below it plus one more axis. The ladder is meant to answer, for any surface, what observable evidence moves it up a rung.

Agent-CBOM sample (one agent). A conforming document inventories each agent’s three surfaces as CycloneDX-aligned cryptographic assets, with a per-surface agility level; the summary rolls up the weakest agent and the harvest- and forge-exposure counts. Abbreviated, from the reference detector:

{
  "agentCbomVersion": "0.1",
  "profile": "agent-cbom",
  "basedOn": "CycloneDX 1.6 / ECMA-424",
  "agents": [
    {
      "bom-ref": "agent:buyer-01",
      "name": "Procurement Buyer Agent",
      "framework": "MCP client",
      "surfaces": {
        "channel": {
          "protocol": "MCP", "termination": "origin",
          "cryptoAsset": { "assetType": "protocol", "primitive": "key-agreement",
                           "algorithm": "X25519", "nistQuantumSecurityLevel": 0 },
          "verdict": { "pqc": "classical-only", "harvestExposure": true },
          "agility": { "level": 3 }
        },
        "identity": {
          "cryptoAsset": { "assetType": "algorithm", "primitive": "signature",
                           "algorithm": "ECDSA-secp256r1", "nistQuantumSecurityLevel": 0 },
          "verdict": { "pqcReady": false },
          "agility": { "level": 2 }
        },
        "receipt": {
          "signatureAlgorithm": "Ed25519", "retentionYears": 7,
          "cryptoAsset": { "assetType": "algorithm", "primitive": "signature",
                           "algorithm": "Ed25519", "nistQuantumSecurityLevel": 0 },
          "verdict": { "pqcReady": false, "forgeExposure": true },
          "agility": { "level": 1 }
        }
      },
      "agilityOverall": 1
    }
  ],
  "summary": { "agents": 3, "weakestAgent": "Legacy Ledger Agent", "weakestLevel": 0,
               "channelsHarvestExposed": 2, "receiptsForgeExposed": 2 }
}

The receipt is the agent’s weakest surface (level 1: inventoried, but hardcoded, unowned, never drilled), so the agent’s overall level is 1. The full document, JSON schema, and reference detector are in the companion repository; the live demonstrator emits conforming documents at agentcbom.mahasbini.org.

Adjacent maturity models. Two general crypto-agility maturity models are in circulation: CAMM (academic; Hochschule Darmstadt, ATHENE; five levels) and QRAMM (CyberSecurity NonProfit; five levels across four dimensions; open-source). Both score the enterprise cryptographic estate, and neither models the agent. CAMM has drawn a published critique for weak operationalization (Practical Evaluation of the Crypto-Agility Maturity Model, arXiv:2604.12428, April 2026).

Signature sizes. FIPS 204 ML-DSA-65 signatures are 3,309 bytes and do not aggregate; ML-DSA-44, 2,420 bytes. FIPS 205 SLH-DSA, 7,856 to 49,856 bytes. Classical Ed25519 signatures are 64 bytes; BLS12-381, 96 bytes and aggregating.

Regulatory. DORA RTS, Commission Delegated Regulation (EU) 2024/1774, Article 6(4) (crypto-agility), with the resilience cross-reference at Article 10(2)(a). NIS2, Directive (EU) 2022/2555, Article 21(2)(h). EU AI Act, Regulation (EU) 2024/1689, Article 15. NIST IR 8547 (initial public draft): quantum-vulnerable public-key algorithms at 112-bit strength deprecated after 2030 and disallowed after 2035; EdDSA and the other 128-bit-strength signatures listed as disallowed after 2035 (cite as expected, not final). EU coordinated implementation roadmap for the post-quantum transition (cryptographic-inventory milestone by end 2026; crypto-agility defined as modular replacement, not runtime cipher-suite negotiation).

Reference implementation. Agent-CBOM profile, schema, and reference detector; live demonstrator at agentcbom.mahasbini.org. Companions in this body of work: the PQC Scanner (public-endpoint readiness), AgentTrustLab (agent-to-agent authentication under post-quantum and zero-knowledge constraints), and Meetade (TLS 1.3 with X25519MLKEM768 on operator-controlled infrastructure).

About the author

Amin Hasbini is an AI and cybersecurity executive based in Paris. Former director of Kaspersky’s Global Research & Analysis Team (GReAT) for the Middle East, Turkey, and Africa. Twelve years, seventy countries of threat coverage. Invited contributor to the French Senate’s OPECST report on AI risks (2024). Current focus: post-quantum cryptography maturity and AI agent security inside regulated enterprises. mahasbini.org .