This primer has the four questions every effort is answering, who is building what across governments, payment networks, blockchains, universities and platforms, and one asymmetry. An agent can increasingly prove who it is, but what it is allowed to do does not travel with it.

If you only have a few minutes, the Pocket Version at the end compresses everything into six facts and one thesis. Before getting started, there is no shortage of lingo and acronyms in this landscape. Agentic Vocabulary 101 at the bottom of this essay explains the core terms in plain language: MCP, A2A, DNS, verifiable credentials, the root of trust and the rest. Experts can skip it. Everyone else may want to glance at it first. Lastly, use the navigation bar on the left to jump around sections as needed.

The Four Questions

When your agent needs a stranger’s agent to do something (book the table, negotiate the price, pull the records), four questions have to get answered:

Discovery: How do I find you?

This is solving for discovery. The answer is some kind of phone book where agents are listed so others can look them up.

Identity: Are you who you say you are?

This is solving for identity, and often called authentication. The answer is some kind of ID check to serve as proof that the agent belongs to the company or person it claims.

Reputation: Can I believe what you claim you can do?

This is solving for reputation. An agent can carry a perfect ID and still be incompetent or dishonest. The answer is some kind of reference based on history like reviews, track records, or someone vouching.

Permission: What are you allowed to do?

This is solving for permission, and often called authorization. Your agent might be verified and reputable and still shouldn’t be able to spend your money or sign your name without limits. The answer is some kind of keyring that determines which doors an agent may open, and who can revoke the keys.

The Map: Who Is Building What

Every project, standard, company and law in this landscape is answering one or more of these four questions. When you meet a new effort, it’s helpful to ask which question is being answered. We will go through the state of play in more detail below, but to summarize in one line: discovery and identity are crowded with builders, reputation is early (mostly low-usage blockchain systems and academic research), and permission has locks everywhere but no shared keys.

The fight for power runs through both discovery and trust. Discovery sits between intent and action. Whoever answers “which agent should handle this” controls routing, and routing control converts into pricing power, data advantage and, eventually, vertical integration. The platform that finds the agent for you will soon prefer its own. Trust is the more absolute position. A discovery layer can be routed around while a trust root cannot, because its whole point is that everyone agrees to check against it. Whoever holds either sits between you and everything your agent does on your behalf.

Two Paths to Discovery

The current state of discovery is a bit chaotic. Roughly a hundred thousand agents are registered across seventeen-plus phone books with zero interoperability (the count comes from a directory operator with its own interests, so treat it as directional). Community-run directories for MCP tools dominate by volume. Big enterprise software companies (AWS, Kong, MuleSoft) rushed out corporate phone books in early 2026. Industry-specific ones are appearing for advertising, commerce and telecom. None of the books talk to each other, and the two groups are trying to change that are on unique paths.

Path one: the Linux Foundation

The Linux Foundation is the nonprofit where technology companies park shared open-source projects so no single company owns them. The foundation stewards Linux itself, the operating system running most of the internet’s servers. Since March it has hosted the Agentic AI Foundation, 146 companies including AWS, Anthropic, Google, Microsoft and OpenAI, and the two most adopted agent protocols live here: MCP’s official directory and A2A, which Google donated in June 2025. The path to victory is the shipping way: release working code, win the developers, and become the standard by fact before any committee finishes deliberating.

The foundation's discovery arm is called AGNTCY, started by Cisco's innovation group and donated in 2025, now backed by Dell, Google Cloud, Oracle, Red Hat and more than sixty other vendors. Its Agent Directory is a federated phone book for the enterprise. Each agent publishes a cryptographically signed record of what it can do, the records live in distributed directories rather than one central list, and an open specification called Agentic Resource Discovery defines how agents query across company clouds. It already runs inside a real product (Cisco's Webex uses it to onboard and verify agentic apps), and in December it published an integration with NANDA's index, connecting the enterprise directory world to the academic quilt described below.

Path two: the IETF

The IETF is the internet’s original standards body where volunteer engineers write and maintain the rules that email, the web and the network itself run on, through a process they call rough consensus. The players here are different with telecom carriers and network-equipment makers (China Mobile, Deutsche Telekom, Huawei, Cisco) plus veteran internet engineers. Their effort is called DAWN, and it is running the classic pre-charter playbook to define the terms, state the problem, and gather requirements. It is building toward a formal committee, and its make-or-break town meeting, the BoF, convenes this week in Vienna (July 18 to 24).

Networking history offers three lessons here. Ethernet, the standard for wiring computers together in a building, shows that shipping wins the race: in 1980 three companies (Digital, Intel and Xerox) got tired of waiting, published their own spec and shipped products, and the official committee spent three more years deliberating before blessing what was already universal. OSI shows that mandates alone lose: through the 1980s the official standards world designed a complete, elegant set of networking rules, governments required them, and they lost completely to TCP/IP, the free, unpolished protocols already running on real machines. And SSL shows what committees are for. The padlock began as Netscape’s private product. The IETF took it in and standardized it as TLS, turning one company’s invention into neutral plumbing the whole internet could depend on. That is the committee’s victory condition: not beating the shippers to market, but taking what shipped and making it nobody’s property. It is also the movie playing again right now, with Cloudflare’s agent ID check entering the IETF the same way.

The Bridge: Project NANDA

One effort out of MIT (Ramesh Raskar’s group at the Media Lab) has designed for the whole problem. NANDA’s answer to “one big phone book or many little ones” is a quilt: organizations keep their own local phone books, and a lightweight master index routes lookups to the right one, the way DNS delegates its address book downward.

Every listing resolves to a signed fact-sheet about the agent (who controls it, what it does, how to reach it), and the system can hand different callers different answers depending on context. It plugs into everything: MCP tools, A2A agents, company directories, even blockchain identities, through a universal adapter. It also borrows its security design from the same researcher’s work that China’s national standard independently mirrored.

NANDA is fully designed, neutral and academically credible, with thousands of community members and dozens of papers. Its adoption is community-scale, not production traffic. A fair, federated answer exists on paper. Whether a university can get it entrenched is the open question.

The Five Worlds of Trust

I: The Credential Authors

These are the people deciding what gets printed on the agent’s ID card, and the reason to care is the driver’s license: a license works at any bar and any bank in the country, issued by fifty different states, because everyone agreed on what a license contains and how to check one. Without that agreement, every checker needs a different reader. Three groups are writing the format of the agent’s ID card: what it contains, who signs it, and how anyone checks it.

The OpenID Foundation is the nonprofit behind the “log in with Google”-style sign-in plumbing billions of people use daily. Its agent group is called AIIM, co-chaired by Tobin South (of the identity company WorkOS, and Stanford), and its October 2025 whitepaper on agent identity is commonly cited.

The W3C, the body that stewards the web’s core standards, maintains the tamper-proof ID card format itself (the verifiable credentials described in the vocabulary) and now hosts two competing volunteer groups applying it to agents: one grown out of a Chinese-origin open-source protocol community, one newer group focused on cryptographically binding each agent to the organization that controls it.

And the Decentralized Identity Foundation, an industry group for self-owned digital ID, received a donated specification in March called MCP-I, which bolts identity onto MCP, the universal tool socket.

The formats themselves are starting to appear. Alongside the W3C’s verifiable credentials, drafts are landing at the IETF that adapt the JWT, the signed token that already powers most corporate logins, into an agent ID card. One early draft, AgentID, defines an Agent Identity Token carrying the contents the Convergence section below describes: who the agent is, who owns it, what it can do, and the delegation chain back to an accountable human. It is one proposal among several, and none has won. But the shape of the card is settling even while the fight over who issues it is not.

This is the unglamorous but important work in the landscape because it will be used by everyone downstream. When the Warner bill orders NIST to pick open protocols for agent identity, NIST will be picking from this menu.

II: The States

Governments are building registries with legal teeth, and the two big ones are mirror images: the same machinery, different roots. America’s version has the government as referee, China’s has the government as issuer.

The American stack has two tracks. NIST, the federal agency that sets technical standards (from the official kilogram to the cybersecurity guidelines most companies follow), launched an agent standards initiative in February, and its applied-security lab proposed the plain idea to treat agents like employees. Give each one a verified workplace login, using the same corporate identity standards companies already run, so an agent shows up to work with a badge its employer issued and anyone can check.

The second track is Senator Warner’s draft bill from June 29, which would do three things: create a registry at the FTC of vetted consumer agents (the draft calls them Custodial User Agents), hold registered agents to a fiduciary standard, meaning legally required to act in your interest the way your financial advisor is (an agent that quietly serves the merchant would be breaking the law, not just behaving badly), and give NIST 180 days to name the open protocols for agent identity and revocation, which is the moment the credential authors’ formats could get written into American law.

The Chinese stack is further along technically. In May, China published a national standard (GB/Z 185) that specifies how an agent gets an identity code, describes itself and gets discovered. It is a government-issued spec for the business card and the ID together. Its internet regulator also proposed a national agent registry: voluntary in general, mandatory filing for sensitive sectors, with a state-run digital ID system as the likely root.

Europe is the absence in this list and that seems to be by design. The EU regulates AI harder than anyone through the AI Act, which sets rules for what AI systems may do, but it has proposed none of this plumbing: no agent registry, no agent identity standard, no discovery effort. What it is building sits one level down. Under a law called eIDAS 2.0, every member state must issue its citizens a government digital identity wallet by the end of 2026: a state-issued ID card on a phone, for 400 million people, built on the same verifiable credential format the credential authors above are working with. Every serious trust design ends with a human who answers for the agent. Europe is about to be the only place where every citizen holds a state-checkable ID that could sit at the end of that chain. It has nothing for agents today, and it may be building the root their credentials hang from tomorrow.

Two smaller entries matter. Singapore published its governance idea in January, the Agent Identity Card: a standardized disclosure sheet, like a nutrition label, stating what an agent can do, its limits and the human accountable for it. And India is the sleeper: its Beckn protocol, built by the team behind India’s national ID and payments systems (Aadhaar and UPI), already runs open-network commerce discovery for several hundred thousand real sellers, making it the only open discovery network anywhere with production usage at population scale, and it is now repositioning itself as rails for agents.

III: The Rails

Companies that sit on the traffic path or the money path are becoming identity infrastructure. Cloudflare, the company that sits in front of a huge share of the world’s websites, built Web Bot Auth: agents cryptographically sign every request they make (like sealing every letter with a signet ring), and websites check the seal. Visa, Mastercard, American Express and OpenAI all adopted it as their agent ID check. It works, it’s live, and it’s a private company’s product. It is now entering the IETF to become a formal standard.

The payment companies sit on the money path, and they are moving fast because agents break their model. A card network’s entire business is deciding which transactions to honor and who eats the loss when one goes wrong, and every rule they have assumes a human clicked “buy.” The moment your agent shows up at a checkout with your card number, that assumption fails three ways at once: the merchant can’t tell your agent from a fraud bot, the bank can’t tell whether you approved the purchase, and nobody knows who pays when the agent buys the wrong thing. So each player is building the piece of the answer closest to its own liability.

Visa’s is called the Trusted Agent Protocol, and it is the ID badge: at the moment of checkout, a merchant can verify that the thing buying is a registered agent from a known company and not a scraper with a stolen card (underneath, it uses Cloudflare’s seal, described above, as the ID check).

Mastercard’s is called Agent Pay, and it is your signature: cryptographic proof that the human approved this specific purchase, not just that the agent is real.

Stripe and OpenAI built the Agentic Commerce Protocol, the single-use card: instead of your actual card number, the agent gets a token good for one purchase at one amount, so the worst it can do is the thing you sent it to do. This is what runs underneath the checkout inside ChatGPT today.

And Google’s Agent Payments Protocol (AP2), launched with more than sixty partners, is the signed shopping note. Your instruction gets sealed into checkable documents the agent carries with it. It contains an Intent Mandate recording what you asked for (“running shoes, under $150”) and a Cart Mandate recording the final purchase. AP2 enables the merchant and the bank to verify what you actually said and what the agent may spend.

Four companies are building four pieces: the badge, the signature, the single-use card, and the note. These are the first players seriously cutting keys for the permission question, with two important limitations. First, their keys open exactly one kind of door, money, and second, each network’s keys fit only its own locks. They lead not out of virtue but liability. When a purchase goes wrong someone must eat the loss, and the networks will not process agent payments at scale until that question has an answer.

IV: The Chains

The crypto projects have working review systems with inflated usage numbers. The one to take seriously regardless of your take on crypto is a standard called ERC-8004, nicknamed “Trustless Agents.” An ERC is a published community standard for things built on Ethereum, like a building code anyone may adopt, and this one was written by a relevant set of authors: MetaMask (the most widely used crypto wallet), the Ethereum Foundation, and engineers from Google and Coinbase. That authorship is why non-crypto people are paying attention. It works with A2A, the agent business card, rather than against it, and it carves three public lists into the ledger.

The first is an identity list: each agent gets a numbered entry pointing to its fact sheet, so anyone can look it up. The second is a feedback list: signed reviews of the agent’s past work, readable by all. The third is a validation list: proofs that a piece of work was actually done and checked, backed by validators who post money they lose if they vouch dishonestly. Phone book, review board and inspection record, all in the crypto town square. It went live on Ethereum in late January and roughly 21,500 agents have registered across chains, though actual daily usage is a small fraction of that.

A few other crypto projects to know: Olas is real but narrow (millions of automated finance transactions, almost all on one chain), Fetch.ai claims millions of registered agents (a vanity metric without usage), and Virtuals runs real agent commerce that has collapsed some 99 percent from its peak. Crypto’s contribution is providing working phone books nobody owns, with reviews attached. Its admitted problem is that the reviews inherit the weakness of the identities writing them. Registration on a public ledger is nearly free and unlimited, so an agent can spin up a crowd of fake counterparties and review itself into credibility. The system asks the honesty question. It cannot yet stop the answers from being manufactured.

V: The Academy

The universities are building the neutral referee for reputation. The flagship is called Loyal Agents, a partnership between Stanford’s Digital Economy Lab (led by Sandy Pentland, one of the most cited computational social scientists alive) and Consumer Reports, the nonprofit that has independently tested products since 1936.

The idea is an open rating service that answers the question related to human agency: when your agent shops for you, whose interest does it actually serve? The method is the sandbox test: drop an agent into a simulated task, a purchase with a hidden kickback available, a negotiation where cutting corners pays, and measure whether it serves you or the platform behind it.

The academic literature underneath (a research thread usually cited as “infrastructure for AI agents,” from Alan Chan, Gillian Hadfield and others) supplies the theory: agents need IDs, registries and incident reporting for the same reason cars need license plates and crash standards, because scale plus anonymity breaks accountability.

There is one more channel. In a July essay, Pentland wrote that he has joined a group of Stanford, Berkeley and MIT faculty working to flesh out what he describes as a recent US-China agreement on interoperable architecture for trustworthy agents in trade and finance. He reports the IETF, FATF (the body that coordinates anti-fraud rules across countries) and the large payment and finance corporations working the same problem. It is a unique part of the landscape where the two state systems are discussed in the same room.

The Walls: What Wins by Default

The five worlds are focused on the public domain and how the four questions should be answered in public, between strangers, so any agent can deal with any other agent. But the questions are already being answered today inside the walls of companies. A company can answer all four for its own agents without waiting for any standard, and one platform already answers all four for a billion people. These walls are the competition the public layer faces. If efforts like Vienna stall and the formats fragment, the outcome is not chaos but walls, and tolls between them.

Corporate Walls: Private Registries

Every large company already runs the four-question machine for its humans: an employee directory (find), badges and logins (identity), references and reviews (reputation), and permissions on doors and systems (the keys). The enterprise software industry is now extending that machine to agents.

Microsoft’s version is called Entra Agent ID: Entra is the corporate login system that signs employees into their work laptops at most big companies, and Agent ID issues agents the same kind of workplace badge.

Databricks, the data platform, markets itself as the "agent system of record": one governed ledger of every agent a company runs, what data each may touch, and a gateway that meters its activity and can cut it off. The corporate-login vendors (Okta, WorkOS and their peers) are all moving the same direction. Ping Identity's Identity for AI, generally available since March, abandons standing keys entirely. An agent holds no permanent permissions. Every action is evaluated in the moment, against who delegated it and what policy allows, and the agent receives narrowly scoped authority for just that action. They call it runtime identity: the checkpoint moves from the login screen to the moment of action. In June, Ping extended it into AWS, Google Cloud and Cloudflare, which means the company whose seal checks agent identity at the web's front door now also carries enterprise permission decisions at the edge. It is still a wall, keys that work where Ping runs. But it shows what the portable version would have to do.

Demand is guaranteed, because the states above require it: China’s rules already mandate internal agent registries, and the Warner draft’s audit and revocation requirements would create the same obligation here. This is where the permission question gets its first working answers, because a company can enforce keys inside its own walls without waiting for any standard.

What’s missing is the seam. Your badge works in your building, but there is no agreed way to show it at another company’s front desk. How internal vouching (“we stand behind this agent”) connects to public verification (“the network confirms that company”) is unstandardized, and no one owns it yet.

Platform Walls: Apple

Apple is the player with a working answer to all four questions: the App Store as the phone book, cryptographic app signing as the ID check, App Store review as the reference, permissions and entitlements as the keyring.

At its June developer conference Apple converted that stack into an agent platform. The new Siri composes multi-step actions across apps, and publishing to Apple’s capability system (App Intents) became the only way an app can be acted on. Apps that publish are components of agentic workflows. Apps that don’t are invisible to the agent. That is a mandatory registry operated by one company, where absence means nonexistence.

Apple is also wiring in MCP, the universal tool socket, as a drawbridge: outside agents can act in iPhone apps, but only through Apple’s permission layer. And it rents the AI models themselves (its developer tools now embed agents from Anthropic, Google and OpenAI) while keeping the layer where actions and permissions live, which is the position Mozilla’s report (below) identifies as the real prize.

Apple’s answer to who prints the passports is the sixth candidate from the vocabulary: the device itself, a secure chip in a billion hands, with Apple holding the root. It never needs to win a standards fight because it does not intend to interoperate. This makes Apple the biggest unnamed party in the Warner bill, whose non-discrimination provision for large platforms is aimed at exactly this gate.

The Watchdog: Mozilla

Mozilla is the nonprofit behind the Firefox browser, chartered to keep the internet open, which makes it the landscape’s consumer advocate, staffed with engineers. Its State of Open Source AI report (July 2026) mapped the whole field and landed on one finding: the ID check is being solved in a form that travels, and the keyring is not.

The distinction: letting an agent read your calendar is recoverable, because looking at something can be undone by looking away. Letting it send mail as you, spend your budget or sign the contract is not, because a sent message cannot be unsent. Reading is where convenience lives. Writing is where consequence lives, and across every major agent framework there is no portable standard governing it.

The corporate-identity vendors and a new class of policy engines are circling the gap. Mozilla’s warning restates the capture thesis: whoever standardizes permission first writes the rules that make their own platform the safe choice, and the people who profit from lock-in are in no hurry to standardize the exit.

Its CTO, Raffi Krikorian, frames the endgame with a picture from factory history. Before electricity, a factory ran every machine off leather belts turned by one central steam engine. If the engine stopped, everything stopped, and whoever owned the engine ruled the floor. The electric grid replaced that world with swappable parts you could plug in anywhere. His question is whether AI becomes belts or a grid, and his answer to what decides it: not the models, the wiring. Who owns the connections everything runs through.

The Convergence

Everyone reaches for DNS. Nearly every discovery proposal either reuses the internet’s address book or copies its delegated, federated shape. Even NANDA, the effort designed to move past DNS, borrows its delegation model and titled its flagship paper “Beyond DNS.”

Everyone building trust converged too, on the same three parts: a cryptographic ID card, a self-written description of what the agent can do, and a delegation chain. This creates a checkable record that you authorized this agent, and that any agent it hired traces back to you, the way a power of attorney proves someone may act for you and names the person who answers if it goes wrong.

A Chinese standards committee, an American security researcher, the OpenID community, an Ethereum working group and a Singaporean regulator all specified that machine, two of them writing a year apart with no apparent coordination. When five groups who have never met draw the same blueprint, the engineering seems to be settling and the remaining fight is about who operates the layer and who prints the passports.

Beside the convergence sits one asymmetry. The payment networks cut keys for one door, money. Employers cut keys for their own buildings. Apple cuts keys for its own city. But every one of those keys works only in the locks of whoever cut it. What has converged on nothing is the portable version: a shared format for permission, so that what an agent may do could be granted in one system and understood, checked and revoked in another, the way the ID card formats above are designed to be checked anywhere. Identity is converging on one card. Permission is a thousand incompatible locks. And five candidates for the root means none has won, which means the vacuum is still open for a company to fill it.

The Fault Lines

Six fault lines run through this landscape. Each is an argument still being decided, and each ends in a question.

1. Whether open protocols can beat platforms at all. History mostly says protocols lose: nobody funds open convenience, and companies ship faster than committees. History also holds the exception: the internet’s core protocols and email survived because the commons got entrenched before capture was profitable. The stakes are concrete this time because agents break the web’s business model. Today a writer gets paid when a human visits the page and sees the ad or pays the subscription. When your agent reads the page for you, no human visits, no ad is seen, and the writer earns nothing.
   
   The open camp’s answer, from Raffi Krikorian, is to give the web a second door. The first door is the one humans walk through: the page, paid for by the ad or the subscription. The second is for agents: machines pay tiny amounts over open protocols to whoever wrote the words, so authors get paid even when no human ever arrives. Early versions exist. Cloudflare already lets sites charge crawlers per visit. The question: who funds the commons this time, and can it get entrenched before the deadline?

2. Whether a universal layer is even needed. The card networks already verify agents at the moment money moves, which may cover everything that matters, and the adoption evidence leans their way. A grassroots convention called llms.txt (a text file websites post to describe themselves to AIs) spread across the web, including every Shopify store, and then a crawler study found 97 percent of the files were never fetched by anyone, ever. The question: what breaks first without a shared layer, and who gets hurt when it does?

3. Whether neutrality is possible. Any phone book ranks its results by someone’s values, and reputation, the part of trust that would matter most, is exactly the part that re-centralizes, because someone’s scoring formula defines good behavior. A verified ID is not honest behavior. The question: who should score agents, and who watches the scorer?

4. Whether committees can matter here. The committee room is slow and telecom-heavy while the labs build the real agent economy elsewhere, and OSI proved a committee can produce a beautiful standard nobody uses. The question: what would make Vienna’s outcome binding on anyone?

5. Whether the race is already over. The working ID check belongs to one private company and the working verification belongs to the card networks. The open alternative may not be preventing capture but arriving after it. The evidence stands in the walls: Apple never entered the race and already answers all four questions for a billion people. The question: is there a version of too late here, and are we past it?

6. Whether formalizing helps or freezes. The caution runs through the internet’s whole history, and the networking stories above are its evidence: mandated standards can freeze the wrong design in place, while the standards that endured won through collaboration and running code. The trust version cuts deeper, because a mandatory agent registry is a licensing regime for software, built in the name of protecting the people it gates. The question: does the Warner bill get everyone to the table, or does it write the wrong design into law?

What This Means for Human Agency

One observation beyond these fault lines is that capture never announces itself. It arrives as convenience, and history shows it always has. Tim Wu named the pattern the Cycle in The Master Switch: every information medium in American history began open, run by amateurs and tinkerers, and closed into empire, and the closing was always sold as a better experience. The telephone promised one system that simply worked. Radio promised quality over the amateurs’ noise. Agents are the same offer at a new scale: the convenience of not having to choose at all. What is different this time is the second voice. The gates being built around agents are justified as protection, and most of the builders sincerely mean it.

Here is what that means for a person. Agents are the largest delegation of choice ever offered. We have always handed decisions to people we trust, to a lawyer, a broker, a doctor, and the bargain holds on two conditions: the one choosing for you is loyal to you, and the option to choose differently survives. Every layer in this primer sets the terms of that bargain for everyone. The phone book decides what you are shown. The ID check decides who may act in your name. The reference decides which agents count as good. The keyring decides what you are allowed to do through them. A closed system can honor the bargain. Apple’s wall answers all four questions, and hundreds of millions of people experience it as protection worth choosing. What closure changes is the guarantee. Inside a wall, loyalty and exit are granted by the owner, and what is granted can be repriced or revoked, usually one convenient surrender at a time. In an open layer they are properties of the structure, held by no one, and so they cannot be quietly withdrawn. The question for human agency is not whether you have it today. It is whether it is a feature of the system or a policy of its owner.

Convenience is the engine of capture. Safety is the license for the gate.

Listen hardest when you are offered both at once. This primer is a map of the fast changing agent landscape and the players involved. In the essays that follow, I will trace the history of these cycles and what they teach, what each of these outcomes would mean for human agency, and what needs to be built, and by whom, for a human future.

Agentic Vocabulary 101

An AI agent. A chatbot answers questions. An agent acts: it books the flight, moves the money, sends the email, negotiates with other agents. The difference matters because the moment software acts in the world, the world needs a way to decide whether to let it.

A protocol. An agreed way of talking. The reason any email can reach any inbox, regardless of provider, is that everyone’s software follows the same rules, and nobody owns “email.” Protocols are how machines belonging to strangers cooperate. The main fight is over what the protocols for agents will be and who writes them.

MCP. Anthropic’s standard for plugging an AI into tools: calendars, databases, payment systems, company software. Think of it as a universal socket. Build your tool with an MCP plug once and any AI can use it. It is by far the most adopted piece of this whole landscape (its developer kit is downloaded about 97 million times a month). MCP’s limit is that it connects an AI to tools. It does not help agents find or trust each other.

Agent2Agent (A2A). Google’s rules for two agents talking to each other, since donated to the neutral Linux Foundation. Each agent carries an Agent Card, a self-written description: here is my name, what I can do, how to reach me. A2A is effectively a business card and the catch is in “self-written.” Nothing in the card stops an agent from lying, which is why the trust question is important.

A registry. A phone book of agents. Today there are more than seventeen of them and none share entries. An agent listed in one is invisible to all the others. Imagine seventeen phone books for one city, each covering different streets, none aware of the rest. That is the current state of agent discovery.

DNS. The internet’s address book. When you type a website name, DNS translates it into the numeric address of an actual machine. Two things make it special. It is federated: no single company holds the whole book, authority is delegated downward from a root, and each organization maintains its own entries. DNS is important in part because it is the most successful piece of neutral shared plumbing the internet ever built. This is why nearly everyone designing agent discovery either wants to reuse DNS directly or copy its shape.

Federated. A system built from many independently run parts that follow shared rules, so the whole behaves as one thing nobody owns. Email is federated: thousands of providers, one network. DNS is federated: authority delegated downward, each organization keeping its own entries. Most serious answers in this landscape, NANDA's quilt, AGNTCY's directories, the credential world's web of issuers, are federated designs. The bet is that the way to avoid a single owner is to make everyone an owner of their part.

The padlock and the certificate authorities. When your browser shows a padlock, a company called a certificate authority has vouched that the website is really who it claims. A notary for the internet. For a decade after buying Network Solutions in 2000, Verisign was both the biggest notary and the keeper of the .com address book: one company selling the address and the proof the address was real. Then in 2015 a nonprofit called Let’s Encrypt started notarizing for free, automatically, and the paid-padlock business mostly evaporated. The padlock became public plumbing: a trust toll that became a commons.

Verifiable credentials. A digital ID card with cryptographic tamper-proofing, so anyone can check it is genuine without phoning the issuer. The web’s standards body (the W3C) defines the format. Most serious proposals for agent identity are variations to give every agent one of these cards, issued and signed by whoever controls the agent, so anyone can check who stands behind it.

JWT. Short for JSON Web Token, the workhorse credential of the modern internet. It is a small signed packet of claims: who this is, who issued it, what it may do, when it expires. When a website keeps you logged in, a JWT is usually why. The agent ID cards now being drafted, including the Agent Identity Token described above, are JWTs with new claims: the agent's owner, its capabilities and its chain of delegation back to a human.

Blockchain registries. A public ledger that nobody owns and nobody can quietly edit, like a record carved in stone in the town square. Putting the agent phone book there means no company and no government holds the eraser. The trade-offs are that nobody can fix errors either, and being listed proves nothing about honesty. Real projects run this way today but their headline numbers are inflated even though the machinery works.

Authentication versus Authorization. Authentication is the ID check at the entrance that proves who you are. Authorization is the keyring: what you are allowed to do once inside. Nearly the entire field is building better ID checks. Keys exist, but only as local locks: each payment network, each employer and each platform cuts its own, and none fits another’s doors. Mozilla’s July report made this concrete: across every major agent framework, there is no portable standard for what an agent may do, only for who it is. Your agent can increasingly prove its identity anywhere. What it may spend is decided differently inside every system it touches. The newest enterprise approach, called runtime authorization, goes further: no standing keys at all. Authority is issued per action, in the moment, and expires with it.

Standards bodies, the IETF and their BoFs. The internet’s rules get written two ways. The committee way: volunteer engineers at bodies like the IETF (the Internet Engineering Task Force, the internet’s original standards organization) hash out rules by “rough consensus,” slowly, with legitimacy. The shipping way: a company releases something good, everyone adopts it, and it becomes the rule by fact rather than by vote. Anthropic’s MCP won the shipping way. A BoF (“birds of a feather”) is the IETF’s town meeting: a session to decide whether a topic even deserves a committee. Most BoFs fail, but they matter. One on agent discovery convenes this week in Vienna.

Root of trust. Every system of vouching has to end somewhere: a final authority you don’t verify, you simply trust. Think of these as the authority who prints the passports. In web trust, the certificate authorities were the root. There is a fight for who prints the passports for agents. There are five contenders and they appear throughout the map above: the DNS world (reuse the internet’s address book), the state (a government registry), the card networks (Visa and Mastercard, who already verify everything touching money), a blockchain (so no one holds it), or a federation of credential-issuers with no single anchor at all. Apple is the sixth player who hasn’t entered the ring because it’s playing a different game.

The Pocket Version

For quick reference, here are the primer’s six facts and its thesis.

1. Agents can transact but cannot find or verify each other across company lines. That missing layer is being built now.

2. Every effort answers one of four questions: how do I find you (phone book), who are you (ID check), can I believe you (references), what may you do (keyring).

3. The ID check is getting solved and one private company’s version is already live for Visa, Mastercard and OpenAI. Permission has no standard: keys exist everywhere, but each system cuts its own and none fits another’s locks.

4. Five candidates want to print the passports: the DNS world, the state, the card networks, a blockchain, or a federation with no single anchor. Five candidates means nobody has won. A sixth never entered the race and may be furthest ahead because the device is already in your pocket. Apple already answers all four questions inside its own walls and just made its registry mandatory for agents.

5. Vienna, this week: the internet’s standards body decides whether agent discovery gets a formal committee. Most such attempts fail.

6. The one time an open commons beat capture was when it got entrenched before capture was profitable. The payment networks are not waiting.

The thesis is that capture always arrives as convenience and this time it carries a second voice of safety. Understanding what we are being offered, and why, is how the implications come into view.

A Custodial User Agent acts as the user’s authorized representative to manage the user’s online interactions, purchase decisions, user-generated content, and account settings on a large online platform on the same terms as a user. While the text of the bill focuses heavily on technical and regulatory mechanisms, its stated goal is to ensure that “consumers deserve a real choice in the marketplace” and that “AI agents must be accountable to the people they serve”. Fundamentally, the bill recognizes that agents will be able to act and make decisions on behalf of users and wants to ensure there are agents that will truly work for users and not just platforms.

Here is how the bill seeks to both increase and protect user agency:

Increasing Agency Through Delegation
The legislation gives users the legal right to designate agents to navigate online environments on their behalf. Whether an individual wants to manage their social media, book travel, or make personal finance decisions, they can use “trusted custodial agents” to execute those tasks. By forcing large online platforms to accept commands from these third-party agents on the exact same terms as a human user, the bill prevents tech giants from trapping users in walled gardens and ensures consumers have real, competitive choices in how they interact with the internet.

Protecting Agency through Duty of Loyalty
To ensure this technology actually serves the user’s will, the bill builds strict safeguards around how the agent makes decisions. The legislation demands that these agents act with a “duty of loyalty” and strictly in the user’s best interest. To protect user autonomy, an agent is legally prohibited from taking actions that benefit the agent provider to the user’s detriment, and it cannot act in ways that are “inconsistent with the directions or reasonable expectations of the user”.

Ensuring Ultimate Human Control
The bill treats user agency not just as a principle, but as an engineering requirement. It ensures humans retain ultimate control over their digital representatives through several mechanisms:

• Explicit Consent: Any authority granted to the agent must be express, specific and revocable.

• The Power to Revoke: Platforms and agents must build clear and easy methods that allow users to instantly revoke an agent’s access credentials.

• Audit Trails: To ensure an agent isn’t secretly subverting a user’s goals, agents must maintain real-time, auditable records of every action taken on the user’s behalf

In essence, the bill uses regulation to guarantee that when you deploy an AI to act for you, it functions as a true extension of your own agency, rather than a tool for a platform or developer to exploit your data and decisions. Applying this bill back to my previous essay about agentic ordering on DoorDash, this means that DoorDash can have an agent it offers that works for them and also maintain open doors for CUAs that work their users.

Custodial User Agent Providers
Custodial agents are managed by custodial user agent providers. These providers operate or offer one or more CUAs and fit into two main categories. The first are commercial entities and startups that build, host and offer agents to consumers. These entities can monetize their services through direct fees, contextual advertising or affiliate links.

The second category of providers are individual users. The bill explicitly includes an individual user who operates a CUA solely on their own behalf and not for anyone else. This ensures that technically savvy individuals who want to run their own local or open-source AI agents are legally recognized as their own providers.

Within the bill’s framework, the provider is the entity legally responsible for the agent. Before an agent can access large online platforms, the provider must register with the Federal Trade Commission (FTC). The provider is also legally obligated to ensure that any agent it operates complies with the strict fiduciary-like duties outlined in the bill, such as protecting user data and acting strictly in the user’s best interest. If an agent repeatedly violates these duties, the FTC can deregister the provider.

The Next Wave of Investment Opportunity

The draft bill explicitly aims to create a competitive market where agentic AI startups can compete on equal terms with the biggest tech companies, which opens up several distinct investment categories. Because the bill forces large platforms to grant access to registered third-party agents, it removes the barrier of walled gardens and allows investment capital and talent to build specialized services.

Developing Consumer Facing AI Agents
Startups can build and operate “custodial user agents” (CUAs) designed to manage specific consumer needs. The bill highlights high-potential areas such as e-commerce, social media management, online personal finance, travel booking, scheduling and email management. The next wave of consumer applications will abstract away the work to realize user demands and interests.

B2B Agent Infrastructure and Compliance Tooling
Because the draft bill turns concepts like token scoping, secure delegation, and consent user experience (UX) into legal statutory requirements rather than just design choices, there will be a significant need for compliance tooling. There are strong opportunities for teams to build agent orchestration layers and connector infrastructure. These B2B companies would help other developers build the required “auditable consent flows” and provide the standardized credential metadata needed to prove “valid authorization” to large platforms.

Traffic Management and Monetization Systems for Large Platforms
While large platforms are legally required to allow agent access, they are not required to provide unlimited free computing power. The bill permits large platforms to establish “reasonable thresholds” regarding the frequency, nature, and volume of requests a custodial user agent (CUA) can make. If an agent exceeds these thresholds (e.g., checking a product price thousands of times an hour), the platform can assess fees. This creates a massive B2B opportunity to build the API gateways, rate-limiting software, and billing infrastructure that large platforms will need to track, manage, and charge third-party agents.

Specialized Cybersecurity and Threat Detection
Large platforms must protect their networks and are authorized to set strict privacy and security standards for agent access. They have the right to deny access to agents that repeatedly facilitate “fraudulent or malicious activity” or fail to meet security standards. Because platforms must also report suspected violations to the FTC, there is an opportunity for cybersecurity firms to develop threat-detection systems specifically designed to evaluate AI agent behavior, monitor for malicious actions, and automate the denial-and-reporting process for large platforms.

FinTech and Highly Regulated Agents
The bill specifically targets complex sectors like personal finance and electronic commerce. Because the legislation requires the FTC to establish an interagency working group with the Consumer Financial Protection Bureau (CFPB), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC), there is a distinct opportunity for FinTech companies. Startups that can navigate both the new CUA fiduciary duties and existing financial regulations will be uniquely positioned to build specialized agents capable of autonomously managing consumer wealth, banking and investments.

Operating as an Independent Certification Body
To accelerate the vetting of agents, the legislation allows the Federal Trade Commission (FTC) to authorize independent certification bodies. This creates a business opportunity for auditing and compliance firms to evaluate CUAs, test their security mechanisms, and grant certifications that create a legal presumption that the agent complies with FTC rules.

Shaping the Foundational Protocols and Standards
The bill directs the National Institute of Standards and Technology (NIST) to identify or develop model technical standards and open protocols within 180 days of enactment. These standards will govern critical functions like verifiable delegation, identity verification, and real-time revocation across the internet. Because these protocols must be free from licensing fees and patent restrictions, tech consortiums, open-source communities, or engineering firms that can rapidly build and propose these protocols have the opportunity to architect the foundational plumbing of the agentic internet.

How to Shape Our Future Economy

Of all the opportunities an agentic economy presents, the most timely is shaping the foundational protocols and standards that will define the rules of the new game. That is because this bill is an initial draft, meaning it is open for public comments.

Warner’s office is collecting responses through a public feedback form, and no deadline has been set, which is the best reason to move now rather than wait. You can submit your feedback directly on his site here, https://www.warner.senate.gov/submit-your-ai-feedback/. You can also send it directly to AI_Feedback@warner.senate.gov.

Lastly, I am forming a small consortium to provide a more detailed thought piece focused specifically on the protocols and standards to be considered. Please reach out to me directly if you have an interest in participating.

My first task is to immediately open the hot and numbing fish so the fried fish doesn’t lose its crispness against the mala, the Sichuan peppercorn and chili sauce. I like to think that I have this ritual down to a science in how I portion each dish in balance with one another after trying just about everything on their menu. The fish is hot and crispy while the mala numbs my mouth, the cucumber salad cools off any excess spice while the chow mein is the perfect pair of comfort food. I’ve enjoyed this weekly cheat meal long enough that I notice when it’s a different chef preparing the food that day.

DoorDash makes this ritual easy for me. I simply open the app and it remembers the dishes that I ordered last week. It offers me rewards based on how much I have spent, discounts if I use particular credit cards and promotional offers like buy 1 get 1 free from the restaurant itself. And it suggests other restaurants I might like, despite my die-hard loyalty to Mama Ji’s.

In a world of AI, DoorDash could do so much more. It could get my context, not just my previous orders last Sunday but absorb my entire life that might impact what I want to eat. For preferences, I can connect reservations I’ve made, groceries I’ve ordered and places I’ve reviewed. For health, I can connect my workout and sleep activity, heart rate and body composition. For routine, I can connect my calendar and location so it would know if I’m traveling or working at the office late. And it could ask me questions about my goals and preferences, such as if I want to lose weight or gain muscle. I can give DoorDash context on what I want to eat, how I want it to impact me and where it needs to be delivered.

With AI, I can also give DoorDash a $1,000 per month budget and have it make all the decisions for me. By giving AI the ability to make choices for us, we are giving it some of our own agency. As we give this agency to agents, the question is if the agent is working for me or DoorDash?

All of the measurements I can provide for context are important ingredients to combine to create the best choice. But it’s the interpretation of these data points against the incentives of the agent that determines if something is good for me or good for DoorDash’s bottom line. If I just give them $1,000 a month and say feed me, their incentive is to send me the cheapest calories they can find that keeps me just happy enough that I don’t churn as a customer. As a result, the agent is working for DoorDash and my preferences compete with their goals of retention, delivery efficiency and margin. If instead the agent makes choices to optimize my overall well being, I effectively have the perfect personal chef. In that scenario, I would be more than willing to hand over my agency (and money) in exchange for the convenience. But that doesn’t seem to be the full price of this convenience.

First, I would be handing over a lot of information about myself that is valuable to a lot of stakeholders well beyond those delivering my next meal. How does my information get rented or sold to third parties? Is there some kind of sovereignty I can have over my data? History has shown we don’t really care about our privacy and how it’s monetized by others. We show initial resistance but then succumb to the tremendous convenience we get in the immediate term. Our human nature will continue to work against us unless we build something truly for ourselves.

We also need to consider the impact our agency has on market forces. Today, when I search for Sichuan on DoorDash here in SF, I get over 50 restaurants to choose from. But once my choice becomes giving a budget to DoorDash, how many Sichuan restaurants do they need to have? I might be getting hot numbing fish from a private-label, Kirkland-like DoorDash product, made in their own ghost kitchen. Even the idea of Kirkland becomes invisible as I’m not choosing from a list of options in the first place. It just shows up in brandless plastic containers like it already does today so I don’t notice the brand. What remains of the restaurants? It seems like giving our agency to DoorDash will consolidate the market so that we will then have fewer choices in the future. In this world, how will all these Sichuan restaurants survive? Are there incentives in agency that can or should be considered to preserve a marketplace of choice even when we remove the need for a marketplace by delegating our agency?

The answer to both our privacy and preservation of the choices we enjoy today is to create our own agents that truly work for us. My data goes to my agent and nowhere else, I own it and no one rents it. Instead of DoorDash getting a thousand dollars, my agent has a budget to buy from every restaurant and grocery store in the city. I can work directly with Mama Ji’s agent, or even the agent of my favorite chef at the restaurant. I no longer need to give my data or my agency to another company. I can enjoy the convenience provided by AI making choices for me with an agent that has my best interest in mind. And the marketplace of options grows from 50 Sichuan restaurants to hundreds of Sichuan chefs who capture more of the value they create.

We are predisposed to convenience. We have proven again and again that we will trade privacy for ease, that we will trade immediacy for future consequence. One of the great capabilities of AI is the elimination of barriers to building something ourselves. It is more convenient than ever to shape our future. Fighting for agency is about accepting our desire to delegate choices while pushing to make those choices work for us. The urgency to act today is that we still have thousands of restaurants to point our agents at. If we don’t and give our agency to a third party, those choices will disappear as platforms consolidate them. History suggests most of us won’t step up in time.

The food will be hot either way. The question is how numb.

Subscribe now

The next few decades will be about capturing choices. We call it automating work when AI makes decisions for us. When it writes the email, designs the brand, picks who to hire. As AI makes choices for us, it is forming an agency economy. The impact this will have on us cannot be overstated. Human agency is the capacity to consciously direct our actions in alignment with our values, intentions and understanding rather than being driven by external forces, unconscious conditioning and automatic impulse. Our agency is our ability to claim this action came from “me”.

Today, the race among hyperscalers is to become the dominant standard in AI. We are currently enjoying a golden era as consumers of this technology, heavily subsidized by investors while its underlying business models remain nascent. As the AI economy settles in, sustainable and profitable models will emerge. The inertia from the attention economy will bring business models that orchestrate the external forces, unconscious conditioning and automatic impulses that decrease our agency. Coupled with AI, this economic model threatens to eliminate our agency entirely as it will become the margin of opportunity for companies. If that happens, we will have lost our humanity. We will have become a cultivated species, optimized and harvested by the systems we built.

Yet there is another future made possible with AI. One that integrates this technology into an economic system designed to increase human agency. Instead of cultivating us as a species, it cultivates our potential as humans. This economy is grounded in a single principle. Each human has a unique fingerprint of attributes that can be actualized through coherent choices, and made valuable to other humans.

We can optimize for human agency by optimizing for coherence. Coherence is the measurable alignment between our choices and our values, intentions and understanding. This does not mean a future without an attention economy or a world that functions in a silo from the harsh conditions influencing us. It means another economy, built to optimize for coherence in the face of the external forces, unconscious conditioning and automatic impulses that have shaped the last twenty years.

The battle for human agency will be decided in the interpretation layer between measurement and influence. Measurement is commoditizing. We have reached an abundance of mechanisms to read our bodies, model our behaviors and predict our desires. Influence is where the moral question lives, where the incentives of the systems we build determine which choices we are presented with. Interpretation is where who we are and what we value becomes meaning a machine can act on. Your heart rate climbs and a system decides whether that means excitement, fear or a flight of stairs. Your voice inflects and a system decides your chemistry with another person. Your location changes and a system decides whether that’s a good environment for you. Whoever controls that layer controls the choice architecture shaping our human agency.

We are building a future to increase our human agency. This frontier requires an ecosystem at the earliest stages of economic formation. It requires capital, founders, and a multidisciplinary community of thought leaders. And it requires a language and a lens to organize the world in ways that measure and impact the forces determining our agency.

The defining question of the next century is whether human beings will remain authors of their own choices. Our future is being determined on the frontier of today. As Winston Churchill said, the empires of the future are the empires of the mind. The battle for our agency has begun and the time for you to join is now.

Join the Fight