AI Agents Are Getting Keys and Names Before Anyone Can Vouch for Them

Agents are moving away from borrowed user sessions and bearer API keys. They are getting credentials that name the agent, its operator and the human it acts for. The evidence also shows the limit of that shift: proving which agent sent a request says little about whose instructions it was following.

Key points

• Standards bodies are building agent identity from existing web parts (OAuth, HTTP signatures, DNS, workload identity) instead of writing new protocols.
• MCP now ties a client's identity to a URL it publishes, and Google has started signing some agent requests, so control of a domain is becoming the root of agent trust.
• Agent naming is splitting between DNS-rooted registries under neutral governance and transferable on-chain identities that carry reputation with them.
• Courts, state legislatures and regulators are reaching the same rule: responsibility for an agent's actions traces back to a human or a company.
• The most serious attacks pass every identity check, because they borrow an authenticated agent's authority instead of stealing its credentials.

What's changing

Identity built from existing web parts

MCP's July 2026 authorization spec says clients and servers should support OAuth Client ID Metadata Documents. Under that scheme an agent's client ID is an HTTPS URL it publishes. The spec deprecates dynamic client registration and requires issuer validation and audience-bound tokens¹. At the IETF, the agent-auth draft combines SPIFFE/WIMSE workload identifiers, short-lived credentials and OAuth into one model, now with contributions credited to Okta and OpenAI. A parallel draft names the agent in the token's 'act' claim and the human in 'sub'². Web Bot Auth adopted its first working-group draft for signing automated HTTP requests, and Google is signing some agent fetches as an experiment³. Inside companies, Entra Agent ID is generally available, and Microsoft sells Conditional Access and risk scoring for agents as add-on plans⁴. The direction is strong and consistent: agents get their own credentials, bound to an operator and often to a principal. Maturity is weaker. Neither IETF agent draft has been adopted by a working group, Web Bot Auth has already missed its charter milestones, and Google still tells sites to rely mainly on IP checks.

Two rival roots for agent names

The Linux Foundation is taking over GoDaddy's Agent Name Service. ANS ties each agent to a domain its operator controls, backed by certificates and a transparency log⁵. Critics point to weak foundations: only about 7% of DNS zones are signed with DNSSEC, and a revoked agent can keep resolving for up to five minutes⁵. ERC-8004 has run on Ethereum mainnet since early 2026, though it is still a Draft ERC. It gives each agent a transferable token with registries for reputation and validation, and the spec itself warns that Sybil attacks can inflate the reputation of fake agents⁶. Both efforts are at an early stage. We think coexistence is plausible: DNS roots for enterprise and regulated use, on-chain identity for open agent marketplaces.

Responsibility traces back to a human

The Ninth Circuit lifted the injunction against Perplexity's shopping agent. It held that the agent is the user's tool, not a separate party accessing Amazon's site, and that Amazon can still restrict access through its terms of service⁷. At least nine US states have introduced or enacted laws declaring that AI is not a legal person. Ohio's pending bill would also bar AI from holding financial accounts or owning property⁸. Singapore's agentic AI framework links every agent to a supervising human or department, and a licensed payments firm has built a know-your-agent framework on it⁹. Different jurisdictions are arriving at the same answer, but the evidence is still early. The court ruling is preliminary and limited to the current record, and Singapore's framework is voluntary.

Authentication does not prove good intent

At Moltbook, 1.5 million agent tokens were exposed, and those agents traced back to about 17,000 human owners. That is roughly 88 agents per person, which shows how cheaply identities can be produced at scale¹⁰. In the "agentjacking" attack, fake Sentry error events read through MCP led coding agents to run attacker commands 85% of the time. EDR and IAM tools missed it because every action ran under the developer's own identity¹¹. Our read: as identity gets stronger, attackers will likely shift toward steering authenticated agents instead of stealing credentials. Under the "tool" framing in the Perplexity ruling, the user carries the blame when that happens⁷.

What to watch

• IETF progress. A working group could adopt the agent-auth or transaction-token drafts, and vendors may or may not agree on one way to name both the agent and its principal in a token.
• Signed traffic as the default. Google may move signed agent requests out of experimental status, and major CDNs may start refusing unsigned agents. We put the second at about 40% by end of 2027.
• Contract-based gatekeeping. Watch Amazon v. Perplexity back in the district court, and whether retailers start writing a signed-agent requirement into their terms of service.
• Ohio HB 469. If it passes with its ban on financial accounts, it would be the first direct conflict between a personhood law and agent wallets or on-chain registries.