Agent identity, or “know your agent”, is the layer of cryptographic identifiers, credentials and audit trails that lets one autonomous agent prove who it is, what it is allowed to do and on whose behalf it acts; the primitives are real and arriving fast, but almost every monetisable piece has already been donated to a standards body, so the layer is likely to be ubiquitous and unownable.
Summary
Agent-to-agent protocols such as MCP, A2A, ANP and AG-UI define how LLM-powered agents exchange messages, discover peers and delegate work. They largely do not define how an agent proves its identity, its authorisation, its advertised capabilities, or who is accountable once a task has been delegated onward. Agent identity is the attempt to fill that gap. The reference architecture in the literature is a four-layer stack: persistent identity, discovery, trust negotiation and accountability, with primitives that include “Agent Identity Cards” binding developer, code package, operator and deployment context; capability-aware discovery using DID-bound verifiable-credential manifests; monotonic capability attenuation on delegation combined with two-tier access control; and kernel-mediated cryptographic audit trails that bind usage, delegation and execution traces to an identity without needing a consensus ledger.
The hard technical question underneath is what the identity is actually bound to. Binding a key to an operator or a wrapper means trusting that operator. One line of work pushes the trust root down to cryptography by making an agent’s neural-network weights a deterministic function of its private key, committing that binding in zero knowledge at genesis, re-checking it at every state transition, and signing the result into an unforkable on-chain history; a deployed proof of concept on Solana devnet completed a 2.36-day run with two host-side resumptions and no rejected transition, at bounded per-transition verification cost, while explicitly leaving liveness, key custody, oracle trust and the software stack outside the trust boundary. That is the shape of the research frontier: strong binding of key to behaviour, with most operational trust still external.
The parameters that decide the outcome are commercial rather than cryptographic. A commissioned research pass found that “KYA” collapses six distinct problems (agent authentication, bot-versus-agent distinction, delegated authority and mandates, agent-to-merchant trust, credential issuance, and reputation or attestation), of which only the last is genuinely unclaimed, and it has essentially no paying demand. Every monetisable primitive in the layer was donated to a standards body inside twelve months: Google donated AP2 to the FIDO Alliance on 28 April 2026 with Mastercard co-donating “Verifiable Intent”, Cloudflare put Web Bot Auth into the IETF using RFC 9421 signatures and Ed25519, Coinbase gave x402 to the Linux Foundation, the Linux Foundation announced an Agent Name Service as free neutral trust infrastructure, and ZeroID was open-sourced in April 2026. A dedicated search for a regulatory, liability or network mandate with a date found none; Mastercard has closed the liability gap by layering agent identity onto existing EMV tokenisation, so liability follows tokenised-transaction rules and the issuer carries fraud.
One terminology note: the same acronym is used in the security literature for “Know Your Agent”, a framework for reconnaissance-driven black-box pentesting of agents, which builds target profiles of an agent and uses them to craft stronger indirect prompt-injection attacks. That is an attacker-side discipline, not an identity layer, but it is evidence that agent metadata and profiles are adversarially useful in both directions.
Evidence base
- Existing agent protocols specify message exchange but not identity, authorisation, capability attestation or post-delegation accountability; InterSAGE proposes a four-layer trust substrate with agent identity cards, DID-bound verifiable-credential discovery, monotonic capability attenuation and kernel-mediated audit trails, published 14 Aug 2026
- An agent whose neural-network weights are a deterministic function of its private key, committed in zero knowledge at genesis and re-checked each state transition, completed a 2.36-day Solana devnet run with two host-side resumptions and no rejected transition, with liveness, key custody and oracle trust left external, published 5 Aug 2026
- Every monetisable primitive in the layer was donated to a standards body within twelve months: AP2 to FIDO on 28 Apr 2026 with Mastercard co-donating Verifiable Intent, Web Bot Auth to the IETF, x402 to the Linux Foundation, an announced Agent Name Service, and ZeroID open-sourced in Apr 2026; a search for a dated regulatory or liability forcing function found none
- The x402 Foundation reached operational launch with 40 members on 14 Jul 2026 including Visa, Mastercard, Stripe, Google, AWS and Cloudflare, with zero protocol fees and no native token, while measured volume fell from a $5.15M peak in Nov 2025 to $1.19M by May 2026 ref
- The same commoditisation pattern is further advanced at the human identity layer: Google open-sourced its ZKP libraries under Apache 2.0, the EU shipped an open-source age-verification blueprint behind the app announced 15 Apr 2026, and eIDAS 2.0 encourages ZKPs in the wallet ref
- The best-funded identity-verification comparable, with 18M+ verified humans, 475M+ proofs and a $2.5bn valuation, restructured a ~500-person team on 8 Jun 2026 because revenue lagged costs, and only then introduced per-verification application fees ref
- AI-enabled attacks rose 89% year on year, 16% of breaches involve attacker-used AI, autonomous agents feature in roughly one in eight AI breaches, and AI-driven attacks cost $4.49M on average ref
Open questions
- Does any buyer emerge with a budget line for agent identity itself, as opposed to agent security operations or key custody, where an existing budget line demonstrably converts to acquisitions?
- Does a card network, regulator or large platform ever open a liability gap that only agent attestation can close, reversing Mastercard’s decision to route agent transactions through existing EMV tokenisation liability rules?
- Can any implementation carry the full InterSAGE-style stack (identity cards, DID-bound capability manifests, attenuated delegation, kernel-mediated audit) in production across organisational boundaries, with published overhead and failure data?
- Does the ~20x measurement discrepancy in agentic payment volume resolve upward, which would be the first credible evidence of transaction scale large enough to need paid identity infrastructure?
Assessment drafted 2026-08-31 from up to 10 KB sources using the technology-scorecard framework; scores are a draft read pending review.