Who Vouches for an AI Agent? Three Questions Still Open

Agent identity standards are moving fast, but proving who an agent is does not prove the agent is doing what its principal wants. The law also treats the agent as part of its user, while the infrastructure is giving the agent an identity of its own.

Key points

• Strong authentication is arriving across MCP, the IETF and Microsoft, yet the most effective attacks now run under a fully authenticated identity.
• DNS-rooted naming and on-chain registries both claim to anchor agent identity, and each inherits a known weakness: DNS concentration and slow revocation on one side, cheap Sybil reputation on the other.
• Courts and state legislatures treat agents as tools of their users, while enterprise and web platforms treat them as separate entities with their own risk scores.
• We think the gap between authenticated identity and authorized intent is the question most likely to decide where liability lands.

The tensions

Our signal scan found agents getting keys and names faster than anyone can vouch for them. Three tensions in that evidence remain unresolved.

Does verified identity make an agent trustworthy?

The case for: the plumbing is converging on agents that can be identified and held to scope. MCP's July 2026 spec makes a client's identity a URL it publishes and requires issuer validation and audience-bound tokens¹. IETF drafts put both the acting agent and the human principal into OAuth tokens². Google has started signing agent requests under Web Bot Auth³, and Microsoft now sells Conditional Access for agents⁴.

The case against: in the "agentjacking" attack, coding agents ran attacker commands in 85% of tests, and EDR, WAF and IAM tools missed it because every action ran under the developer's own identity⁵. Theoretical work argues that prompt injection cannot be fully solved, and adaptive attacks beat state-of-the-art defenses more than 85% of the time⁶. OpenClaw showed a compromised agent acting with its user's full authority⁷.

What would settle it: evidence that mandate-scoped tokens plus human approval on consequential actions actually limit damage in real incidents. Better authentication alone will not settle it.

Who should anchor an agent's name?

The case for DNS: the Linux Foundation's Agent Name Service ties agents to domains, certificates and a transparency log⁸, and MCP's client identity also rests on domain control¹. These are mature systems with neutral governance.

The case against: only about 7% of DNS zones are signed with DNSSEC, and a revoked agent can stay resolvable for five minutes⁸. Root-zone signing, root server operation and .com all sit with one US firm⁹. On-chain registries such as ERC-8004 offer portable, auditable identity, but the spec itself warns of Sybil-inflated reputation¹⁰. Moltbook's ratio of about 88 agents per human shows how cheap such identities are¹¹. Ohio's pending bill would also bar AI from holding financial accounts or property¹², which could clash with agent wallets.

What would settle it: whichever system first ties reputation to a costly, revocable identity and shows revocation working within seconds.

Is the agent its user's tool or an actor in its own right?

The case for "tool": the Ninth Circuit held that Perplexity's shopping agent acts on the user's instructions, so the user is the one accessing the site¹³. At least nine states are writing "AI is not a person" into law¹². Liability traces back to a human.

The case for "actor": Singapore's framework gives each agent its own identity and a named human supervisor¹⁴. Entra makes agents directory objects with their own risk scores⁴, and the IETF drafts give the agent its own claim, separate from the principal's². Platforms are likely to gatekeep agents as distinct entrants through signatures and terms of service³¹³.

What would settle it: the remand in Amazon v. Perplexity, and the first case where a user disputes liability for an action an injected agent took under their credentials⁵. We put about 60% on courts keeping the tool framing through 2027 while contracts treat agents separately.

Why these questions matter

While these questions stay open, treat agent authentication as necessary but not sufficient. Bind every agent to a named supervisor and a logged mandate. Put human gates on irreversible actions. Assume that identity built on domains or tokens can be taken over. In contracts, set out who pays when a correctly identified agent follows the wrong instructions, because under the current legal framing that bill likely goes to your users.