Week ending August 28, 2026 — Sector Watch

The IETF STIR working group’s proposed recharter would have the group define a means to associate a PASSporT with an identifier representing the entity holding the right to use a telephone number. The charter text does not say what that identifier discloses. STIR’s outgoing charter carried a dedicated privacy analysis milestone, and the base protocol supports anonymous calls. The questions now on the record at the IESG are who gets to see the identifier, whether there is an opt-out, and whether it applies the same way to an individual and to an enterprise. They are being asked of the charter rather than of the drafts that would be written under it.

Standards in motion

STIR’s recharter is held at the IESG over what the text leaves unstated. The proposed STIR charter has not cleared review, and the objections are about things the charter does not say. The blocking one is that no deliverable carries an intended publication status. That matters for two of the proposed work items in particular, which define protocol-visible identifiers and audit mechanisms other parties have to interoperate on: whether they come out as Standards Track or Informational decides whether a verifier can be held to them.

The proposed text adds three things to the working group’s scope: an identifier associating a PASSporT with the entity holding the right to use a number; certificate transparency for telephone identity credentials, for auditability and detection of mis-issuance; and an extension of out-of-band mechanisms to cover discovery of STIR credentials and services, connected identity where SIP signalling is not end-to-end, and use of authenticated telephone identity in messaging.

The out-of-scope section rules out revisiting the trust model for the core first-party assertion — the binding that says the calling number is not spoofed — and states that this assertion relies on the existing certificate-based, administratively governed model regardless of certificate profile, that alternative trust anchors and non-certificate identifier mechanisms for that binding are out of scope, and that changing it would require a future recharter. Separate signers of auxiliary information are permitted, provided what they sign stays bound to and subordinate to a first-party assertion inside that model. That classifies the number-to-call binding for the life of this charter: open and multi-vendor at the specification layer, administratively governed at the trust-anchor layer.

Two further questions have been put to the charter and are not answered in it. Whether post-quantum algorithm migration is in scope for a trust model the same charter fixes as certificate-based. And who owns the governance the charter excludes: dropping governance requirements for numbering authorities, certificate authorities, and transparency services leaves unnamed the body that holds them, which in US practice is the ATIS/SIP Forum framework operationalising STIR/SHAKEN. An entity identifier scheme and a certificate transparency service both sit against that layer. Adoption read: nothing here is settled, and the review in which other standards bodies get to comment on the scope has not opened.

DAWN has a charter, a date, and stable identifiers out of scope. The agent-discovery work that has been running as a non-WG list became a proposed charter on August 24 — Discovery of Agents With Names — and goes to the IESG on September 3 with no outstanding objection.

What the group would build is a discovery mechanism that returns an AI resource’s minimum discovery information — type, reachability, communication protocol, services — within a local network, within an organisation, or between organisations, with mDNS and DNS named as candidate substrates. A line committing the work items to consider confidentiality and integrity of everything exchanged between DAWN parties was added during review. Out of scope: stable identifiers of AI agents, tools and skills; indexing AI resources across the wider Internet; interoperable information schemas beyond discovering a transfer protocol; and trust management and trust evaluation methods beyond securing the content exchanged.

Discovery and identity are separable, and DAWN is being chartered as the first without the second, which leaves the identifier and credential formats in SPICE, WIMSE, and JOSE where they already are. One question raised in review and still open determines what a discovery query exposes: whether discovery always starts from a name the client already holds, or whether a client can ask what agents are available. In the first case the query reveals an intent about a known party. In the second, the responding side learns it is being surveyed, and by whom. Adoption read: a proposed charter with a first Standards Track protocol milestone in December 2027, and no protocol yet.

The IAB is asking why post-quantum authentication has not deployed. The IAB has called for position papers for a workshop in Prague on 11 and 12 October, with submissions due September 4. The premise stated in the call is that post-quantum key establishment has moved from standards into deployment and post-quantum authentication has not, and that specification work is no longer the binding constraint. Authentication requires certificate authorities, relying parties, trust stores, cryptographic modules, and applications to make compatible changes, and the organisers are asking for evidence about what delays production systems rather than benchmarks of individual operations. It is the same question being put to the STIR charter above, in a telephone identity system whose trust model that recharter keeps certificate-based. Adoption read: the output is a workshop report, and the deadline that binds anyone with deployment evidence is September 4.

Capital & motivation

$156 million into the layer after the alert. Socure announced on August 26 a $156 million strategic growth investment at a $5.2 billion valuation, led by Summit Partners with Goldman Sachs Alternatives, Wells Fargo, Capital One and Docusign participating, combining primary capital with an employee tender offer. In the same announcement it acquired Fravity, an agentic investigation platform, on undisclosed terms, to be delivered through its RiskOS platform. Socure reports closing Q2 2026 with $364 million in annual recurring revenue, up 63 percent year over year, with 133 percent net dollar retention. The company was valued at $4.5 billion at its Series E in 2021.

What Fravity does is the work after a system raises an alert: collecting evidence across systems, sanctions and adverse-media research, assembling a case for a human to decide. That follows Berbix at $70 million in 2023 for document verification, Effectiv at $136 million in 2024 for decisioning and orchestration, and Qlarifi in 2025 for credit intelligence. None of it is specification work, and the announcement claims none. There is no interoperability standard for a fraud case file, which leaves proprietary as the only classification available for this layer.

Socure and Xcelerate Solutions won a five-year, $163 million call order on May 1 under GSA’s Next Generation Identity Proofing blanket purchase agreement, supplying remote unsupervised identity proofing for Login.gov. The question to put to any vendor holding a contract of that shape is what a member of the public gets to keep when the proofing succeeds: whether the result is a credential the person can present somewhere else, or a record that stays inside the platform that produced it.