What it does: A central registry maps each agent's identifier to its cryptographic public key, authorized message types, and permitted communication relationships. When an agent presents a credential, the receiver consults the registry to verify: is this credential valid? is this agent authorized to send this type of message to me?

Why a registry is necessary: Without a registry, every agent must independently maintain a list of who it trusts and what credentials are valid. As the pipeline grows, this becomes unmanageable and inconsistent. A central registry is the single source of truth — it also provides a place to revoke credentials immediately when an agent is compromised.

Analogy: A certificate authority (CA) for inter-agent communication. An agent's credential is only valid if it's signed by the registry CA and hasn't been revoked. Revocation propagates to all agents immediately.

What it does: Every inter-agent message — sent, received, rejected, and failed — is logged to an immutable, append-only store. Log entries include: sender identity, recipient identity, message type, message content hash (not the full content unless needed for compliance), timestamp, authentication result, and validation result.

Detection value: Forged messages that pass authentication checks still appear in logs with accurate sender attribution. An attacker who compromised a legitimate agent's credentials will show unusual behavior in that agent's logged activity — sending messages at unusual times, to unusual recipients, or at unusual volumes — detectable by anomaly detection.

Investigation value: When an incident occurs, logs provide the complete reconstruction of what messages were sent by whom and in what order — enabling precise scoping of the breach and identification of exactly which agent credentials were compromised.

What it does: Establishes behavioral baselines for each agent's normal communication patterns (message volume, recipient set, message types, time-of-day distribution) and alerts when observed behavior deviates significantly from the baseline.

Examples of detectable anomalies: An orchestrator suddenly sending 10× its normal number of messages. A data agent sending messages directly to a payment agent (which it normally never communicates with). A deployment agent receiving messages from a recipient it has never communicated with before. A burst of identical messages from the same sender within seconds of each other (replay pattern).