We noticed three separate institutions, a standards body, a US government lab, and an academic research team, converging in the same week on the same unsolved problem: how an autonomous AI agent proves who it is and what it is allowed to do. Agent identity is moving from an afterthought in API design to a named workstream with drafts, project charters, and a literature.
The signals
- IETF drafts an AI-agent authentication and authorization spec
sig-2026-09-19-002· From ad hoc API keys → To standardized, scoped, revocable agent credentials · strength: emerging · source - NIST NCCoE opens an AI-agent identity and authorization project
sig-2026-09-19-003· From voluntary experimentation → To formal governance of autonomous systems · strength: emerging · source - Research surveys the gaps in AI-agent identity standards
sig-2026-09-19-004· From fragmented identity practices → To a converging research agenda · strength: early · source
Why it matters
The driver underneath this cluster is delegation at scale. Agents now act on behalf of people and organizations across systems they were never explicitly provisioned for, and the credential they carry is usually a static API key issued to a human or a service account. That key says nothing about which principal delegated the task, what scope was intended, or how to revoke a single agent without breaking everything else. The IETF draft (sig-2026-09-19-002) is the clearest statement of the fix: credentials that are scoped, attributable to a delegating party, and revocable on their own. It is a first-round individual draft, so we treat its specifics as provisional, but the fact that the problem has reached the IETF at all signals that the plumbing is being taken seriously.
The NIST NCCoE project (sig-2026-09-19-003) matters for a different reason. NCCoE builds reference implementations with vendors, and its outputs tend to become the de facto baseline that US federal procurement and regulated industries adopt. The survey paper (sig-2026-09-19-004) adds the evidence that current practice is fragmented: every agent framework has invented its own notion of identity, and none of them interoperate. Taken together, these three point toward a likely outcome over the next two to three years: agents will carry identifiers that resolve to a verifiable principal, a permission scope, and a revocation path. We are less certain about which layer wins, whether identity lives in OAuth extensions, in decentralized identifiers, or in something new, and the early strength ratings reflect that.
What it could mean for digital assets
If agents need identifiers that resolve to a responsible party, naming becomes infrastructure rather than branding. A domain already provides a globally resolvable, ownership-verifiable, revocable name, and it is plausible that agent credential schemes anchor to domains the same way email, TLS, and DNS-based verification already do. That would create demand for names that function as the root of an organization's agent identity tree, and for the tooling to bind agent keys to them. We track this possibility, and the naming implications of the broader agent stack, at foresight.domains.
Sources
- IETF drafts an AI-agent authentication and authorization spec · institutional
- NIST NCCoE opens an AI-agent identity and authorization project · institutional
- Research surveys the gaps in AI-agent identity standards · peer-reviewed