DROS-WebMCP: A Cryptographically Attributable Execution Governance Layer for the Agentic Web / DROS-WebMCP:面向Agentic Web的密碼學可歸因執行治理層

The emerging Agentic Web transitions the Internet from human-interactive visual browsing to autonomous agentic tool invocation. Emerging specifications, notably WebMCP, standardize machine-readable capability discovery and exposure across browsers and web endpoints. While recent WebMCP drafts analyze interaction-layer risks such as prompt injection and tool poisoning, capability exposure does not inherently establish an independently enforceable, cryptographically attributable authorization-to-execution control plane (Capability Exposure ̸=⇒ Execution Governance). Consequently, when an autonomous agent suffers cognitive compromise, unconstrained actions directly propagate to downstream APIs and operating systems, creating a severe Agent-to-Execution Attribution Gap. This paper introduces DROS-WebMCP, an executiongovernance substrate positioned directly beneath capability exposure: Capability Plane (WebMCP) + Governance Plane (DROS) = Governable Agentic Web DROS-WebMCP establishes an Authentication-Authorization- Execution Separation model and enforces Post-Compromise Execution Containment:Compromise(A, SKA) ̸=⇒ UnrestrictedExecution Even when an agent’s reasoning substrate and signing keys are fully subverted, policy invariants resolved independently from principal delegation deterministically contain execution at a privilege-separated boundary. Evaluated across a 2,000-trial benchmark (1,000 benign workflows and 1,000 adversarial trials across 8 threat vectors), no unauthorized execution was observed in the evaluated 1,000-trial corpus (UER = 0/1000 = 0, single-tailed 95% upper bound ≈ 0.3%). Micro-benchmarks demonstrate that precompiled policy evaluation achieves O(1) constant-time lookup with sub-microsecond overhead (1.8 μs), confirming the practicality of decoupled execution governance for the Agentic Web.新興的Agentic Web 正在推動網際網路發生深層典範轉移:從傳統人類驅動的「視覺瀏覽」,演進為自主AI Agent主導的「機器可讀工具調用」。在此演進趨勢中,以WebMCP為代表的新興規範,標準化了瀏覽器與Web 應用中的機器可讀能力發現與介面暴露。雖然WebMCP 最新規範草案已在其安全考量中涵蓋提示注入、工具投毒與同源邊界等互動層風險,但其設計範疇主要定錨於能力暴露與瀏覽器交互層,本身尚未提供一套獨立於大模型推理之外、可密碼學歸因且具備硬性強制力的執行治理控制平面 (Capability Exposure ̸=⇒Execution Governance)。 因此,當自主Agent 遭遇認知妥協時,未受約束的動作會直接穿透至下游API 與作業系統,形成嚴重的Agent 到執行歸因鴻溝(Agent-to-Execution AttributionGap)。為此,本文提出DROS-WebMCP 執行治理架構,確立核心抽象:Capability Plane (WebMCP)+ Governance Plane (DROS) = Governable Agentic Web DROS-WebMCP 建立「認證-授權-執行分離」模型,並形式化「背叛後執行遏制」保證:Compromise(A, SKA) ̸=⇒ UnrestrictedExecution 即使Agent 認知大腦與私鑰在極端威脅模型下同時遭攻擊者控制,治理平面依託主體原始委託獨立解析策略不變量,仍能確保非授權動作在特權隔離的執行邊界被確定性阻斷。在包含2,000組高擬真調用(1,000 組良性工作流、1,000 組對抗測試)的基準評測中,DROS-WebMCP 在評測的1,000 次對抗測試樣本中,未觀測到任何未授權執行穿透邊界(UER = 0/1000 = 0,95%信心水準單尾上限約為0.3%)。微基準評測顯示預編譯策略評估達到O(1) 常數時間查表與次微秒級開銷(1.8 μs),實證證明了執行治理與能力暴露解耦架構的實用性。