DualTrust: Asymmetric Bayesian Reputation and Cryptographic Gating for Autonomous AI Agents

Abstract The proliferation of Ambient Wearable Intelligence (AWI) ecosystems, spanning augmented reality glasses, smartwatches, and pervasive edge IoT actuators, is fundamentally transitioning human-AI interaction from explicit tactile commands to continuous, implicit background tool delegation. In these ambient environments, autonomous Large Language Model (LLM) agents are granted operational authority to invoke external APIs, reserve financial micro-quotas, and control physical actuators. However, existing safety guardrails depend on secondary LLM-as-a-judge classifiers that introduce prohibitive runtime latencies (400–850 ms) and recurring token expenses, while static role-based access control fails against continuous behavioral drift, memory backdoors, and interleaved salami-slicing exploits. We present DualTrust, an asymmetric Bayesian reputation and cryptographic gating runtime engineered for autonomous multi-agent containment. DualTrust enforces a decoupled principal-agent architecture that strictly isolates Human Principal Accountable Credit from Bayesian Agent Operational Standing. Agent behavior is continuously modulated via an asymmetric power-law slashing engine (Δβ ∝ (sev · c^2) · v_a^1.8) with instantaneous clean-streak reset, deterministic SHA-256 64-bucket striped concurrency locks, atomically locked rollback refunds, and an O(1) RAM sliding-window RFC 6962 Merkle audit ledger with rolling epoch seals that bounds active memory consumption by committing historical roots to persistent storage. Evaluated across 176 automated invariant tests and 10,000-cycle Monte Carlo attack simulations, DualTrust makes deterministic authorization verdicts in a median latency of 47.10 µs in-memory (mean 63.16 µs, tail p99 287.10 µs) and 155.80 µs under persistent SQLite WAL disk transactions, with end-to-end Python decorator wrappers executing in median 60.70 µs (async) and 88.30 µs (sync) without external API calls. Compared against state-of-the-art LLM guardrails, DualTrust achieves over 6,600× lower latency (and over 32× to 50× lower latency than localized AST validators), by policy construction blocks Sybil defamation against collusive probation swarms, and provides tamper-evident, append-only audit durability with RFC 6962 inclusion verification, establishing a practical, foundational governance runtime for trustworthy ambient intelligence.