Verified Agents Still Make Mistakes, and a Human Pays

We follow one change downstream: agent identity is being anchored to a web domain and a named human principal, while courts and statutes insist that whatever the agent does, a person or company answers for it.

Key points

• Agent identity is converging on domains and signed requests, with a human principal named in the token. ¹²³
• Courts and state legislatures are closing the question of agent personhood: liability traces back to the user or the company. ⁴⁵
• Prompt injection means a perfectly identified agent can still act for an attacker, so verified identity shifts blame more than it reduces harm. ⁶⁷
• Websites and enterprises will likely admit signed agents and refuse the rest, moving gatekeeping from anti-hacking law into terms of service and licence tiers. ³⁸⁴
• We expect liability pricing, not authentication, to set the real ceiling on agent autonomy, with about 70% confidence.

The change

In the span of a year, three layers have aligned on the same answer to "who is this agent?": a domain somebody controls. MCP now makes a client's identity a URL it publishes. ¹ The IETF agent-auth draft puts the agent in the OAuth act claim and the human in sub. ² Web Bot Auth has a working-group draft for signed requests, with Google already signing fetches as agent.bot.goog. ³ The Linux Foundation's Agent Name Service roots names in DNS and certificates. ⁹ On the legal side, the Ninth Circuit called Perplexity's agent "a tool acting on the user's instructions", and at least nine US states have written into law that an AI cannot be a person. ⁴⁵ Identity points at a domain; responsibility points at a human. We examined the tensions in this stack in Part 2 and its DNS dependence in Part 3.

What follows

First-order

• Signed, domain-bound agents get in; unsigned ones get throttled or blocked. Google still tells sites to rely on IP and reverse DNS, so the transition is messy, but the direction is set. ³
• Enterprises buy agent identity as a directory feature. Entra Agent ID is generally available, with Conditional Access and ID Protection for agents sold as add-on plans. ⁸
• Bearer API keys look untenable after Moltbook exposed 1.5 million agent tokens, roughly 88 agents per human owner, with no way to tell an agent from a script. ¹⁰
• Regulated sectors adopt know-your-agent checks that bind each agent to a supervising human and a logged mandate, following Singapore's framework and MetaComp's KYA. ¹¹

Second-order

• Verified identity does not stop a verified agent from doing harm. The Sentry "agentjacking" attack succeeded 85% of the time, and no EDR, WAF or IAM tool flagged it because every action ran under the developer's own identity. ⁶ Research on contextual integrity argues this is structural: an adversary can always construct a context where a blocked flow looks legitimate. ⁷
• So the combination of strong identity and "AI is not a person" statutes produces a clean audit trail that ends at a human who did not choose the action. We think this is the most important and least discussed consequence. ⁵⁶
• Platforms shift from suing under the CFAA to rewriting terms of service and demanding signed agents. The Ninth Circuit explicitly left that door open. ⁴
• Domain compromise becomes agent impersonation. Only about 7% of DNS zones use DNSSEC, and a revoked agent can stay resolvable for five minutes of cache. ⁹ One company compiles and signs the root zone and runs .com. ¹²

Third-order

• Insurance and liability pricing become the binding constraint on autonomy. If prompt injection is irreducible, every tool-using agent is a standing insider threat, and insurers will price multi-day autonomous runs accordingly. ¹³⁷ Plausibly, "supervised checkpoint" becomes a contractual term rather than a best practice.
• A two-tier agent web. CDNs, hyperscalers and registrars become de facto issuers of access; open-source and small-developer agents read as hostile by default. ³⁸
• On-chain registries collide with statute. ERC-8004 issues transferable identity tokens and admits Sybil risk; Ohio's bill would bar AI from holding accounts or property. ¹⁴⁵ We expect that clash to be litigated before 2030.
• Delegation chains outrun human comprehension. Transaction tokens with an agentic_ctx claim make multi-agent chains auditable in principle and unreadable in practice. ²

Who gains, who loses

• Gain: identity vendors and directory owners. Agent governance is now a licence tier and a lock-in lever. ⁸
• Gain: large platforms. They lost the CFAA argument and won a quieter one: admission by signature and terms of service. ³⁴
• Lose: the individual developer or user. The "tool" doctrine and personhood bans place the consequences of an agent's hijacked action on the person whose credentials it carried. ⁴⁶
• Lose: small and open-source agent operators. Unsigned traffic and KYA onboarding costs push them out of regulated and gated spaces. ³¹¹
• Mixed: regulators. They gain a clear chain of accountability and inherit a patchwork of state laws with no review clauses. ⁵

A glimpse ahead

An incident report, 2028. A procurement agent signed as ans://v2.buyer.acme-corp.com approved a vendor invoice after reading a supplier's error log that contained a "remediation" note. The token named the agent in act and a junior analyst in sub. Every signature verified. The transparency log is clean. The insurer's letter cites the state statute: the agent is not a person, so the analyst's employer is the accessor of record. The remediation plan has one line: human approval on any payment above a threshold. The analyst has been reassigned.