Geneva, Sydney, Brussels, Cambridge and Boston sit on the globe as rooms where interoperability — and the ethics of agents that move value — is written down. IETF SATP, ISO/TS 23516, MIT SERC and Hardjono’s delegation paper are documents, not campuses.
SATP · research method
Four documents, one method
Gateway-to-gateway, not a bridge. Taxonomy, then architecture, then the core state machine, then crash recovery. Two-phase commit lives inside stage 3 — it is not a substitute for the stages. Read architecture before core.
Layer 1TaxonomyModes × infrastructure. SATP lives in the gateway × asset-transfer cell.Open →
Layer 2ArchitectureTwo networks, two gateways, opaque interiors. Signed assertions, not a readable foreign ledger.Open →
From draft-ietf-satp-architecture: origin gateway G1, destination G2, networks opaque to each other. Stage-0 is preparatory and out of the core spec. The 2PC messages are the commitment subprotocol in stage 3.
0Pre-transfer verificationApplications share a context-ID. Originator and beneficiary identities may be checked (FATF travel rule). Out of SATP-core scope. Nothing is locked.Context-IDidentity / travel-rule checks
1Transfer initiationGateways G1 and G2 exchange claims: asset, originator, beneficiary, operators. They agree to commence. Still nothing locked.Transfer ProposalProposal ReceiptTransfer CommenceACK Commence
2Lock assertionOrigin gateway G1 signs that the asset is immobilised in NW1. Required because NW1 may be private — G2 cannot read it. G1’s operator takes liability for that assertion.Lock-AssertionAssertion Receipt
3Commitment (2PC)Classic two-phase commit inside the transfer. Prepare, then burn-and-mint. Atomic: both commit or both abort. Crash recovery is a separate Belchior draft.commit-prepareack-prepare (mint assertion)commit-final (burn)ack-commit-final
AtomicityThe transfer commits on both networks or fails with no state change.
ConsistencyWhen it ends, the asset lives in exactly one network.
IsolationOrigin state is not modified by anyone else while locked.
DurabilityOnce committed, a gateway crash does not undo it.
Secure Asset Transfer Protocol — and ODAP before it
Working group chartered 2023. Core draft authors include Hargreaves and Chiriac (Quant), Hardjono (MIT), Belchior (Técnico Lisboa), Ramakrishna (IBM). Claire Facer (Quant) co-chairs. The methodology is gateway-to-gateway, not a bridge: two endpoints, a secure channel, a 2-phase commit so the transfer is atomic (ACID). The 2020 individual draft was ODAP (Hargreaves, Hardjono). Read the HTML drafts; they are the primary source.
Four layers, four documents — that is the SAT research method. (1) Taxonomy — Belchior/Riley/Hardjono ACM DLT 2023: modes (data, asset transfer, asset exchange) × infrastructure (nodes, proxies, gateways). SATP occupies the gateway × asset-transfer cell. (2) Architecture — Hardjono, Hargreaves, Smith, Ramakrishna: two networks, two gateways, no assumption about the ledgers underneath; destination cannot read a private origin ledger, so the origin gateway must sign an assertion. (3) Protocol — SATP core (Hargreaves, Hardjono, Belchior, Ramakrishna, Chiriac): Stage-0 pre-transfer verification (out of core; FATF identity, context-ID); Stage-1 transfer initiation; Stage-2 lock-assertion; Stage-3 commitment preparation and finalisation using classic 2PC (commit-prepare → ack-prepare → commit-final/burn → ack-commit-final/mint). (4) Recovery and variants — Belchior’s crash-recovery draft (event logs, checkpoints, backup gateways); Marstein’s lock-and-assign exchange (SAE); the implementation guide for how a gateway talks to its own network. IETF process (charter, datatracker, last call) is the publication method. This is how you research a transfer standard without minting a twelfth chain.
How to use it · Read architecture before core. Read the ACM taxonomy before either. Treat implementation-guide and SAE as individual drafts, not WG consensus.
SERC, authenticated agents, and why Boston is on this map
MIT’s Social and Ethical Responsibilities of Computing (SERC), at the Schwarzman College of Computing, is a teaching–research–engagement programme led by associate deans Nikos Trichakis (operations management) and Brian Hedden (philosophy). Teaching: coordinated curriculum, 24.133 Experiential Ethics, open-access case studies on PubPub. Research: SERC Scholars (undergraduates, graduates, postdocs) and seed-grant projects. Engagement: policy task forces and the annual Ethics of Computing Research Symposium — 30 April 2026, keynote Jon Kleinberg (Cornell) on algorithm–human handoffs. Separately, Hardjono co-authored ‘Authenticated Delegation and Authorized AI Agents’ (arXiv 2501.09674, 16 Jan 2025) and the ICML 2025 position ‘AI Agents Need Authenticated Delegation’: extend OAuth 2.0 and OpenID Connect with agent-specific credentials; turn natural-language permissions into auditable access control. That paper is the documentary join to Flow/MCP and x402. The Algorithmic Justice League (Joy Buolamwini, MIT Media Lab origin) is the bias-and-accountability neighbour. None of this is a Quant–MIT ethics joint programme. It is why Boston sits on the globe next to SATP.
TeachingCoordinated curriculum across computing and the humanities. 24.133 Experiential Ethics. Open-access case studies on PubPub, twice a year.
EngagementPolicy task forces and the annual Ethics of Computing Research Symposium. 30 April 2026: keynote Jon Kleinberg (Cornell) on algorithm–human handoffs.
How to use it · Use SERC as landscape. Use the Hardjono/South paper as the agent-authority source (OAuth/OIDC, not a prompt with a key). Do not read a Quant mandate into Schwarzman College.
Verdian proposed a blockchain ISO committee in 2015 and convenes WG7 (interoperability). ISO/TS 23516:2026 — ISO project 82098 — is the DLT interoperability framework: DLT to DLT, and DLT to entities outside the ledger. ISO 22739 is the vocabulary companion. A decade of words so that ‘interoperability’ does not mean twelve proprietary bridges.
US11842335B2 (granted 2023; application US20200311718A1) — Blockchain communications and ordering — inventors Verdian, Paterson, Mondelli, Tasca, assignee Quant Network Ltd. A 2026 Japanese acceptance, Quant says, covers updating a ledger from instructions on two or more other ledgers — the Fusion rollup claim. Separately, Hargreaves holds Vocalink/Mastercard filings on payments data processing and international ACH — rails history, not Overledger claims. Patents are claims, not deployments.
Three LF-adjacent surfaces. Fabric (and Besu) are execution domains Overledger maps onto and that Oracle ships. Cacti is the LF interoperability project Belchior maintains — cousin to SATP, not a Quant SKU. x402 Foundation (2026) is the HTTP-native machine-payment protocol Quant joined as a general member. Open-source protocols, commercial gateway.
Belchior’s 2021 ACM Computing Surveys review is the literature map. The 2023 ACM DLT article with Riley and Hardjono is the gateway taxonomy. The 2024 IEEE S&P SoK is the security case against ad-hoc bridges. IETF SATP and Hyperledger Cacti are what you write after you have read those three.
INATBA is the International Association for Trusted Blockchain Applications. BSI DLT/1 is the UK mirror to ISO DLT work — Verdian has chaired UK standardisation delegation language on his public bio. Policy rooms, not product SKUs.
Did you know SATP’s 2-phase commit sits inside stage 3 — not instead of the stages?
Stage-0 is pre-transfer verification (context-ID, FATF identity) and is out of the core spec. Stage-1 is initiation. Stage-2 is lock-assertion: the origin gateway signs that a possibly-private ledger has immobilised the asset. Stage-3 is classic 2PC: commit-prepare, ack-prepare, commit-final (burn), ack-commit-final (mint). Crash recovery is a separate Belchior draft. Read the architecture before the core.
Did you know SATP is an IETF work item, not a Quant product?
Hargreaves and Chiriac are Quant authors; Facer co-chairs the working group. Hardjono (MIT), Belchior (Técnico Lisboa) and Ramakrishna (IBM Research) are listed authors who are not Quant staff. Overledger can implement a SATP-shaped gateway. That still does not make the protocol a SKU.
Did you know ISO’s DLT interoperability framework took a decade?
Verdian proposed ISO/TC 307 in 2015. ISO/TS 23516:2026 (project 82098) is the interoperability framework: DLT to DLT, and DLT to the world outside the ledger. Standards are slow on purpose. Quant’s product bet is that the gateway layer can ship while the vocabulary is still being written down in Geneva.
Did you know Quant patented ordering transactions across chains?
US11842335B2, inventors Verdian, Paterson, Mondelli, Tasca: a method for keeping a chronological record of transactions that appear on different blockchains. If money is going to hop ledgers, time has to mean the same thing on both sides. A 2026 Japanese patent extends the multi-DLT token / Fusion rollup idea.
Did you know a Quant engineer co-chairs the SATP working group?
Wesley Facer co-chairs IETF SATP. Hargreaves and Chiriac are Quant authors on the drafts. That still does not make SATP a Quant SKU: Hardjono (MIT), Belchior and Ramakrishna (IBM Research) are listed authors who are not Quant staff, and the work item is the IETF’s.