AI agents can already take actions like moving money, but only between parties that were introduced in advance. An agent cannot yet look up a stranger's agent the way a phone dials any number, and no credential works everywhere. Closing that gap is a race to answer four questions, and how they get answered will decide what agents do to human agency.
This primer has the four questions every effort is answering, who is building what across governments, payment networks, blockchains, universities and platforms, and one asymmetry. An agent can increasingly prove who it is, but what it is allowed to do does not travel with it.
If you only have a few minutes, the Pocket Version at the end compresses everything into six facts and one thesis. Before getting started, there is no shortage of lingo and acronyms in this landscape. Agentic Vocabulary 101 at the bottom of this essay explains the core terms in plain language: MCP, A2A, DNS, verifiable credentials, the root of trust and the rest. Experts can skip it. Everyone else may want to glance at it first. Lastly, use the navigation bar on the left to jump around sections as needed.
The Four Questions
When your agent needs a stranger’s agent to do something (book the table, negotiate the price, pull the records), four questions have to get answered:
Discovery: How do I find you?
This is solving for discovery. The answer is some kind of phone book where agents are listed so others can look them up.
Identity: Are you who you say you are?
This is solving for identity, and often called authentication. The answer is some kind of ID check to serve as proof that the agent belongs to the company or person it claims.
Reputation: Can I believe what you claim you can do?
This is solving for reputation. An agent can carry a perfect ID and still be incompetent or dishonest. The answer is some kind of reference based on history like reviews, track records, or someone vouching.
Permission: What are you allowed to do?
This is solving for permission, and often called authorization. Your agent might be verified and reputable and still shouldn’t be able to spend your money or sign your name without limits. The answer is some kind of keyring that determines which doors an agent may open, and who can revoke the keys.
The Map: Who Is Building What
Every project, standard, company and law in this landscape is answering one or more of these four questions. When you meet a new effort, it’s helpful to ask which question is being answered. We will go through the state of play in more detail below, but to summarize in one line: discovery and identity are crowded with builders, reputation is early (mostly low-usage blockchain systems and academic research), and permission has locks everywhere but no shared keys.
The fight for power runs through both discovery and trust. Discovery sits between intent and action. Whoever answers “which agent should handle this” controls routing, and routing control converts into pricing power, data advantage and, eventually, vertical integration. The platform that finds the agent for you will soon prefer its own. Trust is the more absolute position. A discovery layer can be routed around while a trust root cannot, because its whole point is that everyone agrees to check against it. Whoever holds either sits between you and everything your agent does on your behalf.
Two Paths to Discovery
The current state of discovery is a bit chaotic. Roughly a hundred thousand agents are registered across seventeen-plus phone books with zero interoperability (the count comes from a directory operator with its own interests, so treat it as directional). Community-run directories for MCP tools dominate by volume. Big enterprise software companies (AWS, Kong, MuleSoft) rushed out corporate phone books in early 2026. Industry-specific ones are appearing for advertising, commerce and telecom. None of the books talk to each other, and the two groups are trying to change that are on unique paths.
Path one: the Linux Foundation
The Linux Foundation is the nonprofit where technology companies park shared open-source projects so no single company owns them. The foundation stewards Linux itself, the operating system running most of the internet’s servers. Since March it has hosted the Agentic AI Foundation, 146 companies including AWS, Anthropic, Google, Microsoft and OpenAI, and the two most adopted agent protocols live here: MCP’s official directory and A2A, which Google donated in June 2025. The path to victory is the shipping way: release working code, win the developers, and become the standard by fact before any committee finishes deliberating.
The foundation's discovery arm is called AGNTCY, started by Cisco's innovation group and donated in 2025, now backed by Dell, Google Cloud, Oracle, Red Hat and more than sixty other vendors. Its Agent Directory is a federated phone book for the enterprise. Each agent publishes a cryptographically signed record of what it can do, the records live in distributed directories rather than one central list, and an open specification called Agentic Resource Discovery defines how agents query across company clouds. It already runs inside a real product (Cisco's Webex uses it to onboard and verify agentic apps), and in December it published an integration with NANDA's index, connecting the enterprise directory world to the academic quilt described below.
Path two: the IETF
The IETF is the internet’s original standards body where volunteer engineers write and maintain the rules that email, the web and the network itself run on, through a process they call rough consensus. The players here are different with telecom carriers and network-equipment makers (China Mobile, Deutsche Telekom, Huawei, Cisco) plus veteran internet engineers. Their effort is called DAWN, and it is running the classic pre-charter playbook to define the terms, state the problem, and gather requirements. It is building toward a formal committee, and its make-or-break town meeting, the BoF, convenes this week in Vienna (July 18 to 24).
Networking history offers three lessons here. Ethernet, the standard for wiring computers together in a building, shows that shipping wins the race: in 1980 three companies (Digital, Intel and Xerox) got tired of waiting, published their own spec and shipped products, and the official committee spent three more years deliberating before blessing what was already universal. OSI shows that mandates alone lose: through the 1980s the official standards world designed a complete, elegant set of networking rules, governments required them, and they lost completely to TCP/IP, the free, unpolished protocols already running on real machines. And SSL shows what committees are for. The padlock began as Netscape’s private product. The IETF took it in and standardized it as TLS, turning one company’s invention into neutral plumbing the whole internet could depend on. That is the committee’s victory condition: not beating the shippers to market, but taking what shipped and making it nobody’s property. It is also the movie playing again right now, with Cloudflare’s agent ID check entering the IETF the same way.
The Bridge: Project NANDA
One effort out of MIT (Ramesh Raskar’s group at the Media Lab) has designed for the whole problem. NANDA’s answer to “one big phone book or many little ones” is a quilt: organizations keep their own local phone books, and a lightweight master index routes lookups to the right one, the way DNS delegates its address book downward.
Every listing resolves to a signed fact-sheet about the agent (who controls it, what it does, how to reach it), and the system can hand different callers different answers depending on context. It plugs into everything: MCP tools, A2A agents, company directories, even blockchain identities, through a universal adapter. It also borrows its security design from the same researcher’s work that China’s national standard independently mirrored.
NANDA is fully designed, neutral and academically credible, with thousands of community members and dozens of papers. Its adoption is community-scale, not production traffic. A fair, federated answer exists on paper. Whether a university can get it entrenched is the open question.
The Five Worlds of Trust
I: The Credential Authors
These are the people deciding what gets printed on the agent’s ID card, and the reason to care is the driver’s license: a license works at any bar and any bank in the country, issued by fifty different states, because everyone agreed on what a license contains and how to check one. Without that agreement, every checker needs a different reader. Three groups are writing the format of the agent’s ID card: what it contains, who signs it, and how anyone checks it.
The OpenID Foundation is the nonprofit behind the “log in with Google”-style sign-in plumbing billions of people use daily. Its agent group is called AIIM, co-chaired by Tobin South (of the identity company WorkOS, and Stanford), and its October 2025 whitepaper on agent identity is commonly cited.
The W3C, the body that stewards the web’s core standards, maintains the tamper-proof ID card format itself (the verifiable credentials described in the vocabulary) and now hosts two competing volunteer groups applying it to agents: one grown out of a Chinese-origin open-source protocol community, one newer group focused on cryptographically binding each agent to the organization that controls it.
And the Decentralized Identity Foundation, an industry group for self-owned digital ID, received a donated specification in March called MCP-I, which bolts identity onto MCP, the universal tool socket.
The formats themselves are starting to appear. Alongside the W3C’s verifiable credentials, drafts are landing at the IETF that adapt the JWT, the signed token that already powers most corporate logins, into an agent ID card. One early draft, AgentID, defines an Agent Identity Token carrying the contents the Convergence section below describes: who the agent is, who owns it, what it can do, and the delegation chain back to an accountable human. It is one proposal among several, and none has won. But the shape of the card is settling even while the fight over who issues it is not.
This is the unglamorous but important work in the landscape because it will be used by everyone downstream. When the Warner bill orders NIST to pick open protocols for agent identity, NIST will be picking from this menu.
II: The States
Governments are building registries with legal teeth, and the two big ones are mirror images: the same machinery, different roots. America’s version has the government as referee, China’s has the government as issuer.
The American stack has two tracks. NIST, the federal agency that sets technical standards (from the official kilogram to the cybersecurity guidelines most companies follow), launched an agent standards initiative in February, and its applied-security lab proposed the plain idea to treat agents like employees. Give each one a verified workplace login, using the same corporate identity standards companies already run, so an agent shows up to work with a badge its employer issued and anyone can check.
The second track is Senator Warner’s draft bill from June 29, which would do three things: create a registry at the FTC of vetted consumer agents (the draft calls them Custodial User Agents), hold registered agents to a fiduciary standard, meaning legally required to act in your interest the way your financial advisor is (an agent that quietly serves the merchant would be breaking the law, not just behaving badly), and give NIST 180 days to name the open protocols for agent identity and revocation, which is the moment the credential authors’ formats could get written into American law.
The Chinese stack is further along technically. In May, China published a national standard (GB/Z 185) that specifies how an agent gets an identity code, describes itself and gets discovered. It is a government-issued spec for the business card and the ID together. Its internet regulator also proposed a national agent registry: voluntary in general, mandatory filing for sensitive sectors, with a state-run digital ID system as the likely root.
Europe is the absence in this list and that seems to be by design. The EU regulates AI harder than anyone through the AI Act, which sets rules for what AI systems may do, but it has proposed none of this plumbing: no agent registry, no agent identity standard, no discovery effort. What it is building sits one level down. Under a law called eIDAS 2.0, every member state must issue its citizens a government digital identity wallet by the end of 2026: a state-issued ID card on a phone, for 400 million people, built on the same verifiable credential format the credential authors above are working with. Every serious trust design ends with a human who answers for the agent. Europe is about to be the only place where every citizen holds a state-checkable ID that could sit at the end of that chain. It has nothing for agents today, and it may be building the root their credentials hang from tomorrow.
Two smaller entries matter. Singapore published its governance idea in January, the Agent Identity Card: a standardized disclosure sheet, like a nutrition label, stating what an agent can do, its limits and the human accountable for it. And India is the sleeper: its Beckn protocol, built by the team behind India’s national ID and payments systems (Aadhaar and UPI), already runs open-network commerce discovery for several hundred thousand real sellers, making it the only open discovery network anywhere with production usage at population scale, and it is now repositioning itself as rails for agents.
III: The Rails
Companies that sit on the traffic path or the money path are becoming identity infrastructure. Cloudflare, the company that sits in front of a huge share of the world’s websites, built Web Bot Auth: agents cryptographically sign every request they make (like sealing every letter with a signet ring), and websites check the seal. Visa, Mastercard, American Express and OpenAI all adopted it as their agent ID check. It works, it’s live, and it’s a private company’s product. It is now entering the IETF to become a formal standard.
The payment companies sit on the money path, and they are moving fast because agents break their model. A card network’s entire business is deciding which transactions to honor and who eats the loss when one goes wrong, and every rule they have assumes a human clicked “buy.” The moment your agent shows up at a checkout with your card number, that assumption fails three ways at once: the merchant can’t tell your agent from a fraud bot, the bank can’t tell whether you approved the purchase, and nobody knows who pays when the agent buys the wrong thing. So each player is building the piece of the answer closest to its own liability.
Visa’s is called the Trusted Agent Protocol, and it is the ID badge: at the moment of checkout, a merchant can verify that the thing buying is a registered agent from a known company and not a scraper with a stolen card (underneath, it uses Cloudflare’s seal, described above, as the ID check).
Mastercard’s is called Agent Pay, and it is your signature: cryptographic proof that the human approved this specific purchase, not just that the agent is real.
Stripe and OpenAI built the Agentic Commerce Protocol, the single-use card: instead of your actual card number, the agent gets a token good for one purchase at one amount, so the worst it can do is the thing you sent it to do. This is what runs underneath the checkout inside ChatGPT today.
And Google’s Agent Payments Protocol (AP2), launched with more than sixty partners, is the signed shopping note. Your instruction gets sealed into checkable documents the agent carries with it. It contains an Intent Mandate recording what you asked for (“running shoes, under $150”) and a Cart Mandate recording the final purchase. AP2 enables the merchant and the bank to verify what you actually said and what the agent may spend.
Four companies are building four pieces: the badge, the signature, the single-use card, and the note. These are the first players seriously cutting keys for the permission question, with two important limitations. First, their keys open exactly one kind of door, money, and second, each network’s keys fit only its own locks. They lead not out of virtue but liability. When a purchase goes wrong someone must eat the loss, and the networks will not process agent payments at scale until that question has an answer.
IV: The Chains
The crypto projects have working review systems with inflated usage numbers. The one to take seriously regardless of your take on crypto is a standard called ERC-8004, nicknamed “Trustless Agents.” An ERC is a published community standard for things built on Ethereum, like a building code anyone may adopt, and this one was written by a relevant set of authors: MetaMask (the most widely used crypto wallet), the Ethereum Foundation, and engineers from Google and Coinbase. That authorship is why non-crypto people are paying attention. It works with A2A, the agent business card, rather than against it, and it carves three public lists into the ledger.
The first is an identity list: each agent gets a numbered entry pointing to its fact sheet, so anyone can look it up. The second is a feedback list: signed reviews of the agent’s past work, readable by all. The third is a validation list: proofs that a piece of work was actually done and checked, backed by validators who post money they lose if they vouch dishonestly. Phone book, review board and inspection record, all in the crypto town square. It went live on Ethereum in late January and roughly 21,500 agents have registered across chains, though actual daily usage is a small fraction of that.
A few other crypto projects to know: Olas is real but narrow (millions of automated finance transactions, almost all on one chain), Fetch.ai claims millions of registered agents (a vanity metric without usage), and Virtuals runs real agent commerce that has collapsed some 99 percent from its peak. Crypto’s contribution is providing working phone books nobody owns, with reviews attached. Its admitted problem is that the reviews inherit the weakness of the identities writing them. Registration on a public ledger is nearly free and unlimited, so an agent can spin up a crowd of fake counterparties and review itself into credibility. The system asks the honesty question. It cannot yet stop the answers from being manufactured.
V: The Academy
The universities are building the neutral referee for reputation. The flagship is called Loyal Agents, a partnership between Stanford’s Digital Economy Lab (led by Sandy Pentland, one of the most cited computational social scientists alive) and Consumer Reports, the nonprofit that has independently tested products since 1936.
The idea is an open rating service that answers the question related to human agency: when your agent shops for you, whose interest does it actually serve? The method is the sandbox test: drop an agent into a simulated task, a purchase with a hidden kickback available, a negotiation where cutting corners pays, and measure whether it serves you or the platform behind it.
The academic literature underneath (a research thread usually cited as “infrastructure for AI agents,” from Alan Chan, Gillian Hadfield and others) supplies the theory: agents need IDs, registries and incident reporting for the same reason cars need license plates and crash standards, because scale plus anonymity breaks accountability.
There is one more channel. In a July essay, Pentland wrote that he has joined a group of Stanford, Berkeley and MIT faculty working to flesh out what he describes as a recent US-China agreement on interoperable architecture for trustworthy agents in trade and finance. He reports the IETF, FATF (the body that coordinates anti-fraud rules across countries) and the large payment and finance corporations working the same problem. It is a unique part of the landscape where the two state systems are discussed in the same room.
The Walls: What Wins by Default
The five worlds are focused on the public domain and how the four questions should be answered in public, between strangers, so any agent can deal with any other agent. But the questions are already being answered today inside the walls of companies. A company can answer all four for its own agents without waiting for any standard, and one platform already answers all four for a billion people. These walls are the competition the public layer faces. If efforts like Vienna stall and the formats fragment, the outcome is not chaos but walls, and tolls between them.
Corporate Walls: Private Registries
Every large company already runs the four-question machine for its humans: an employee directory (find), badges and logins (identity), references and reviews (reputation), and permissions on doors and systems (the keys). The enterprise software industry is now extending that machine to agents.
Microsoft’s version is called Entra Agent ID: Entra is the corporate login system that signs employees into their work laptops at most big companies, and Agent ID issues agents the same kind of workplace badge.
Databricks, the data platform, markets itself as the "agent system of record": one governed ledger of every agent a company runs, what data each may touch, and a gateway that meters its activity and can cut it off. The corporate-login vendors (Okta, WorkOS and their peers) are all moving the same direction. Ping Identity's Identity for AI, generally available since March, abandons standing keys entirely. An agent holds no permanent permissions. Every action is evaluated in the moment, against who delegated it and what policy allows, and the agent receives narrowly scoped authority for just that action. They call it runtime identity: the checkpoint moves from the login screen to the moment of action. In June, Ping extended it into AWS, Google Cloud and Cloudflare, which means the company whose seal checks agent identity at the web's front door now also carries enterprise permission decisions at the edge. It is still a wall, keys that work where Ping runs. But it shows what the portable version would have to do.
Demand is guaranteed, because the states above require it: China’s rules already mandate internal agent registries, and the Warner draft’s audit and revocation requirements would create the same obligation here. This is where the permission question gets its first working answers, because a company can enforce keys inside its own walls without waiting for any standard.
What’s missing is the seam. Your badge works in your building, but there is no agreed way to show it at another company’s front desk. How internal vouching (“we stand behind this agent”) connects to public verification (“the network confirms that company”) is unstandardized, and no one owns it yet.
Platform Walls: Apple
Apple is the player with a working answer to all four questions: the App Store as the phone book, cryptographic app signing as the ID check, App Store review as the reference, permissions and entitlements as the keyring.
At its June developer conference Apple converted that stack into an agent platform. The new Siri composes multi-step actions across apps, and publishing to Apple’s capability system (App Intents) became the only way an app can be acted on. Apps that publish are components of agentic workflows. Apps that don’t are invisible to the agent. That is a mandatory registry operated by one company, where absence means nonexistence.
Apple is also wiring in MCP, the universal tool socket, as a drawbridge: outside agents can act in iPhone apps, but only through Apple’s permission layer. And it rents the AI models themselves (its developer tools now embed agents from Anthropic, Google and OpenAI) while keeping the layer where actions and permissions live, which is the position Mozilla’s report (below) identifies as the real prize.
Apple’s answer to who prints the passports is the sixth candidate from the vocabulary: the device itself, a secure chip in a billion hands, with Apple holding the root. It never needs to win a standards fight because it does not intend to interoperate. This makes Apple the biggest unnamed party in the Warner bill, whose non-discrimination provision for large platforms is aimed at exactly this gate.
The Watchdog: Mozilla
Mozilla is the nonprofit behind the Firefox browser, chartered to keep the internet open, which makes it the landscape’s consumer advocate, staffed with engineers. Its State of Open Source AI report (July 2026) mapped the whole field and landed on one finding: the ID check is being solved in a form that travels, and the keyring is not.
The distinction: letting an agent read your calendar is recoverable, because looking at something can be undone by looking away. Letting it send mail as you, spend your budget or sign the contract is not, because a sent message cannot be unsent. Reading is where convenience lives. Writing is where consequence lives, and across every major agent framework there is no portable standard governing it.
The corporate-identity vendors and a new class of policy engines are circling the gap. Mozilla’s warning restates the capture thesis: whoever standardizes permission first writes the rules that make their own platform the safe choice, and the people who profit from lock-in are in no hurry to standardize the exit.
Its CTO, Raffi Krikorian, frames the endgame with a picture from factory history. Before electricity, a factory ran every machine off leather belts turned by one central steam engine. If the engine stopped, everything stopped, and whoever owned the engine ruled the floor. The electric grid replaced that world with swappable parts you could plug in anywhere. His question is whether AI becomes belts or a grid, and his answer to what decides it: not the models, the wiring. Who owns the connections everything runs through.
The Convergence
Everyone reaches for DNS. Nearly every discovery proposal either reuses the internet’s address book or copies its delegated, federated shape. Even NANDA, the effort designed to move past DNS, borrows its delegation model and titled its flagship paper “Beyond DNS.”
Everyone building trust converged too, on the same three parts: a cryptographic ID card, a self-written description of what the agent can do, and a delegation chain. This creates a checkable record that you authorized this agent, and that any agent it hired traces back to you, the way a power of attorney proves someone may act for you and names the person who answers if it goes wrong.
A Chinese standards committee, an American security researcher, the OpenID community, an Ethereum working group and a Singaporean regulator all specified that machine, two of them writing a year apart with no apparent coordination. When five groups who have never met draw the same blueprint, the engineering seems to be settling and the remaining fight is about who operates the layer and who prints the passports.
Beside the convergence sits one asymmetry. The payment networks cut keys for one door, money. Employers cut keys for their own buildings. Apple cuts keys for its own city. But every one of those keys works only in the locks of whoever cut it. What has converged on nothing is the portable version: a shared format for permission, so that what an agent may do could be granted in one system and understood, checked and revoked in another, the way the ID card formats above are designed to be checked anywhere. Identity is converging on one card. Permission is a thousand incompatible locks. And five candidates for the root means none has won, which means the vacuum is still open for a company to fill it.
The Fault Lines
Six fault lines run through this landscape. Each is an argument still being decided, and each ends in a question.
Whether open protocols can beat platforms at all. History mostly says protocols lose: nobody funds open convenience, and companies ship faster than committees. History also holds the exception: the internet’s core protocols and email survived because the commons got entrenched before capture was profitable. The stakes are concrete this time because agents break the web’s business model. Today a writer gets paid when a human visits the page and sees the ad or pays the subscription. When your agent reads the page for you, no human visits, no ad is seen, and the writer earns nothing.
The open camp’s answer, from Raffi Krikorian, is to give the web a second door. The first door is the one humans walk through: the page, paid for by the ad or the subscription. The second is for agents: machines pay tiny amounts over open protocols to whoever wrote the words, so authors get paid even when no human ever arrives. Early versions exist. Cloudflare already lets sites charge crawlers per visit. The question: who funds the commons this time, and can it get entrenched before the deadline?Whether a universal layer is even needed. The card networks already verify agents at the moment money moves, which may cover everything that matters, and the adoption evidence leans their way. A grassroots convention called llms.txt (a text file websites post to describe themselves to AIs) spread across the web, including every Shopify store, and then a crawler study found 97 percent of the files were never fetched by anyone, ever. The question: what breaks first without a shared layer, and who gets hurt when it does?
Whether neutrality is possible. Any phone book ranks its results by someone’s values, and reputation, the part of trust that would matter most, is exactly the part that re-centralizes, because someone’s scoring formula defines good behavior. A verified ID is not honest behavior. The question: who should score agents, and who watches the scorer?
Whether committees can matter here. The committee room is slow and telecom-heavy while the labs build the real agent economy elsewhere, and OSI proved a committee can produce a beautiful standard nobody uses. The question: what would make Vienna’s outcome binding on anyone?
Whether the race is already over. The working ID check belongs to one private company and the working verification belongs to the card networks. The open alternative may not be preventing capture but arriving after it. The evidence stands in the walls: Apple never entered the race and already answers all four questions for a billion people. The question: is there a version of too late here, and are we past it?
Whether formalizing helps or freezes. The caution runs through the internet’s whole history, and the networking stories above are its evidence: mandated standards can freeze the wrong design in place, while the standards that endured won through collaboration and running code. The trust version cuts deeper, because a mandatory agent registry is a licensing regime for software, built in the name of protecting the people it gates. The question: does the Warner bill get everyone to the table, or does it write the wrong design into law?
What This Means for Human Agency
One observation beyond these fault lines is that capture never announces itself. It arrives as convenience, and history shows it always has. Tim Wu named the pattern the Cycle in The Master Switch: every information medium in American history began open, run by amateurs and tinkerers, and closed into empire, and the closing was always sold as a better experience. The telephone promised one system that simply worked. Radio promised quality over the amateurs’ noise. Agents are the same offer at a new scale: the convenience of not having to choose at all. What is different this time is the second voice. The gates being built around agents are justified as protection, and most of the builders sincerely mean it.
Here is what that means for a person. Agents are the largest delegation of choice ever offered. We have always handed decisions to people we trust, to a lawyer, a broker, a doctor, and the bargain holds on two conditions: the one choosing for you is loyal to you, and the option to choose differently survives. Every layer in this primer sets the terms of that bargain for everyone. The phone book decides what you are shown. The ID check decides who may act in your name. The reference decides which agents count as good. The keyring decides what you are allowed to do through them. A closed system can honor the bargain. Apple’s wall answers all four questions, and hundreds of millions of people experience it as protection worth choosing. What closure changes is the guarantee. Inside a wall, loyalty and exit are granted by the owner, and what is granted can be repriced or revoked, usually one convenient surrender at a time. In an open layer they are properties of the structure, held by no one, and so they cannot be quietly withdrawn. The question for human agency is not whether you have it today. It is whether it is a feature of the system or a policy of its owner.
Convenience is the engine of capture. Safety is the license for the gate.
Listen hardest when you are offered both at once. This primer is a map of the fast changing agent landscape and the players involved. In the essays that follow, I will trace the history of these cycles and what they teach, what each of these outcomes would mean for human agency, and what needs to be built, and by whom, for a human future.
Agentic Vocabulary 101
An AI agent. A chatbot answers questions. An agent acts: it books the flight, moves the money, sends the email, negotiates with other agents. The difference matters because the moment software acts in the world, the world needs a way to decide whether to let it.
A protocol. An agreed way of talking. The reason any email can reach any inbox, regardless of provider, is that everyone’s software follows the same rules, and nobody owns “email.” Protocols are how machines belonging to strangers cooperate. The main fight is over what the protocols for agents will be and who writes them.
MCP. Anthropic’s standard for plugging an AI into tools: calendars, databases, payment systems, company software. Think of it as a universal socket. Build your tool with an MCP plug once and any AI can use it. It is by far the most adopted piece of this whole landscape (its developer kit is downloaded about 97 million times a month). MCP’s limit is that it connects an AI to tools. It does not help agents find or trust each other.
Agent2Agent (A2A). Google’s rules for two agents talking to each other, since donated to the neutral Linux Foundation. Each agent carries an Agent Card, a self-written description: here is my name, what I can do, how to reach me. A2A is effectively a business card and the catch is in “self-written.” Nothing in the card stops an agent from lying, which is why the trust question is important.
A registry. A phone book of agents. Today there are more than seventeen of them and none share entries. An agent listed in one is invisible to all the others. Imagine seventeen phone books for one city, each covering different streets, none aware of the rest. That is the current state of agent discovery.
DNS. The internet’s address book. When you type a website name, DNS translates it into the numeric address of an actual machine. Two things make it special. It is federated: no single company holds the whole book, authority is delegated downward from a root, and each organization maintains its own entries. DNS is important in part because it is the most successful piece of neutral shared plumbing the internet ever built. This is why nearly everyone designing agent discovery either wants to reuse DNS directly or copy its shape.
Federated. A system built from many independently run parts that follow shared rules, so the whole behaves as one thing nobody owns. Email is federated: thousands of providers, one network. DNS is federated: authority delegated downward, each organization keeping its own entries. Most serious answers in this landscape, NANDA's quilt, AGNTCY's directories, the credential world's web of issuers, are federated designs. The bet is that the way to avoid a single owner is to make everyone an owner of their part.
The padlock and the certificate authorities. When your browser shows a padlock, a company called a certificate authority has vouched that the website is really who it claims. A notary for the internet. For a decade after buying Network Solutions in 2000, Verisign was both the biggest notary and the keeper of the .com address book: one company selling the address and the proof the address was real. Then in 2015 a nonprofit called Let’s Encrypt started notarizing for free, automatically, and the paid-padlock business mostly evaporated. The padlock became public plumbing: a trust toll that became a commons.
Verifiable credentials. A digital ID card with cryptographic tamper-proofing, so anyone can check it is genuine without phoning the issuer. The web’s standards body (the W3C) defines the format. Most serious proposals for agent identity are variations to give every agent one of these cards, issued and signed by whoever controls the agent, so anyone can check who stands behind it.
JWT. Short for JSON Web Token, the workhorse credential of the modern internet. It is a small signed packet of claims: who this is, who issued it, what it may do, when it expires. When a website keeps you logged in, a JWT is usually why. The agent ID cards now being drafted, including the Agent Identity Token described above, are JWTs with new claims: the agent's owner, its capabilities and its chain of delegation back to a human.
Blockchain registries. A public ledger that nobody owns and nobody can quietly edit, like a record carved in stone in the town square. Putting the agent phone book there means no company and no government holds the eraser. The trade-offs are that nobody can fix errors either, and being listed proves nothing about honesty. Real projects run this way today but their headline numbers are inflated even though the machinery works.
Authentication versus Authorization. Authentication is the ID check at the entrance that proves who you are. Authorization is the keyring: what you are allowed to do once inside. Nearly the entire field is building better ID checks. Keys exist, but only as local locks: each payment network, each employer and each platform cuts its own, and none fits another’s doors. Mozilla’s July report made this concrete: across every major agent framework, there is no portable standard for what an agent may do, only for who it is. Your agent can increasingly prove its identity anywhere. What it may spend is decided differently inside every system it touches. The newest enterprise approach, called runtime authorization, goes further: no standing keys at all. Authority is issued per action, in the moment, and expires with it.
Standards bodies, the IETF and their BoFs. The internet’s rules get written two ways. The committee way: volunteer engineers at bodies like the IETF (the Internet Engineering Task Force, the internet’s original standards organization) hash out rules by “rough consensus,” slowly, with legitimacy. The shipping way: a company releases something good, everyone adopts it, and it becomes the rule by fact rather than by vote. Anthropic’s MCP won the shipping way. A BoF (“birds of a feather”) is the IETF’s town meeting: a session to decide whether a topic even deserves a committee. Most BoFs fail, but they matter. One on agent discovery convenes this week in Vienna.
Root of trust. Every system of vouching has to end somewhere: a final authority you don’t verify, you simply trust. Think of these as the authority who prints the passports. In web trust, the certificate authorities were the root. There is a fight for who prints the passports for agents. There are five contenders and they appear throughout the map above: the DNS world (reuse the internet’s address book), the state (a government registry), the card networks (Visa and Mastercard, who already verify everything touching money), a blockchain (so no one holds it), or a federation of credential-issuers with no single anchor at all. Apple is the sixth player who hasn’t entered the ring because it’s playing a different game.
The Pocket Version
For quick reference, here are the primer’s six facts and its thesis.
Agents can transact but cannot find or verify each other across company lines. That missing layer is being built now.
Every effort answers one of four questions: how do I find you (phone book), who are you (ID check), can I believe you (references), what may you do (keyring).
The ID check is getting solved and one private company’s version is already live for Visa, Mastercard and OpenAI. Permission has no standard: keys exist everywhere, but each system cuts its own and none fits another’s locks.
Five candidates want to print the passports: the DNS world, the state, the card networks, a blockchain, or a federation with no single anchor. Five candidates means nobody has won. A sixth never entered the race and may be furthest ahead because the device is already in your pocket. Apple already answers all four questions inside its own walls and just made its registry mandatory for agents.
Vienna, this week: the internet’s standards body decides whether agent discovery gets a formal committee. Most such attempts fail.
The one time an open commons beat capture was when it got entrenched before capture was profitable. The payment networks are not waiting.
The thesis is that capture always arrives as convenience and this time it carries a second voice of safety. Understanding what we are being offered, and why, is how the implications come into view.
if apple is so far ahead because they already hold root of trust by millions or people. maybe we just need a watchdog for apple that is agreeable by all, maybe that could be blockchain as its least disputable and most neutral?