● Agentic standards · the scene, mapped
Delegation only works at scale when it's provable — when an agent can show what it's allowed to do before it acts, and who did what, under whose authority after. These are the standards making that real, what each one covers, and how they fit together.
One page, one argument — read it top to bottom
First
What we run
The Proof Pair — the open spec we operate: mandate in, receipt out.
Then
How we read the field
The Agentic Pulse — narrative measured against reality, every figure sourced.
Which surfaces
A lane we're opening
Claim Provenance — an unoccupied question we think matters, put in the open as an invitation.
Set in
The whole map
The scene and the market — every rail, and where the lane still sits empty.
● Our open working spec · v0 · live
Mandate in, receipt out — delegation made provable at both ends. A mandate is authority you can verify before the act: a verifiable credential from a human to an agent — scoped, expiring, revocable. A receipt is attribution you can verify after it: a signed, hash-chained record binding the action to the agent and the mandate that authorized it. One spec, because every receipt references its mandate. This is what we run, specified so you can run it too.
Read the spec — the-aios.org/proof-pair → · open, CC-BY 4.0, anyone may implement
Then — how we read the fieldThat's what we run. To place it honestly, we start by reading the agent economy as it actually is — the story it tells, measured against what it can show.
Agentic Pulse · narrative vs measured reality
The pulse reads the gap between the agentic narrative — the raise, the whitepaper, the projection — and the measured reality: real volume, production status, whether the thing can prove who acted. The phenomenon it surfaces is what the field calls agent-washing. It is a diagnostic, not a scoreboard. Every figure traces to a named source. Where a value can't be sourced it reads [TBD-verify] — never an invented number.
~38% → ~20%
of execs trust agents for routine analysis — but it falls to ~20% the moment the agent touches a transaction.
Forthcoming — Sell Trust (2026).
$4.6T
the canonical agentic-economy sizing — a Foundation Capital top-down projection of addressable knowledge-work wages, explicitly NOT measured revenue. “A map to gold, sold at the trailhead.”
Foundation Capital — top-down projection.
Agent payments
NarrativeValuation narrative in the billions (~$7B frame).
Measured reality~$28,000/day in real, measured volume.
Can it prove who acted?[TBD-verify]
Source: Forthcoming — Sell Trust (2026). Protocol deliberately unnamed in the source.
Tool auth
NarrativePositioned as production agent-tool infrastructure.
Measured reality~8,000 servers scanned; ~40% had no authentication at all.
Can it prove who acted?Among servers that DID have auth, effectively none can prove who is on the other end — “a key, yes; an identity, no.”
Source: arXiv:2605.22333 — “A First Measurement Study on Authentication Security in Real-World Remote MCP Servers” (2026).
Agent identity / authorization
NarrativeIETF draft-track; positioned as the agent-auth standard.
Measured reality0 production deployments (as of 2026-07-06); IETF draft rev-09.
Can it prove who acted?Root anchored in provider DNS — not person-owned keys.
Source: Public IETF draft — AAuth (Dick Hardt); draft rev-09 as of 2026-07-06, restamp if it advances before publish.
Agent identity
NarrativeRaising on the agent-identity thesis; Anthropic-affiliated.
Measured realityWhitepaper-stage; no shown production — “raised on a whitepaper.”
Can it prove who acted?[TBD-verify]
Source: AIOS Observatory assessment — whitepaper-stage; no shown production as of mid-2026.
● Real cash, for contrast — the honest floor (not washing)
The index cuts toward the honest builders too. These are what real, measured agent revenue looks like — the floor the narrative should be graded against, not just the ceiling it's sold at.
Agent labor (real cash)
Measured reality~$100M revenue, priced per “resolution.”
Can it prove who acted?[TBD-verify]
Source: Company public pricing / press.
Agent labor (real cash)
Measured reality$2.25 per 15 minutes (public pricing).
Can it prove who acted?[TBD-verify]
Source: Public pricing (Cognition / Devin).
Which surfaces — an open laneReading the field this way surfaces where the gaps are. One gap has no one standing in it yet — and it isn't a lane to seize, it's a question to open.
● An open lane · a question we think matters, offered not claimed
Proof answers is this real? It has no answer for should I be suspicious — and who, exactly, is behind the doubt? In an era where AI makes coordinated, plausible, tireless suspicion cheaper than it has ever been, we have a fact layer for what things are. We have nothing for who manufactures doubt about them.
The missing primitive: a verifiable answer to who is actually behind this assertion, since when, in coordination with whom — coordinated-inauthenticity detection as public infrastructure, not a platform's private trust-and-safety black box. Provenance pointed at the accuser, not the accused. Provenance for the suspicion itself.
We're putting this open question on the record — as an invitation, not a claim. An unoccupied lane we think matters, named in public so the people who should build it can find it — the same host posture as the Proof Pair. The spec isn't written yet. Neither is anyone else's, and we'd rather help open the lane than fence it off. Consider this an open door.
Set in — the whole mapThat's the lane we're opening. Here is the whole field it sits in — every rail pulling the same direction, and where the lane still reads empty.
● The scene — 14 rails, one direction
Who is this agent, and who stands behind it?
Ethereum
On-chain registries for agent identity, reputation, and validation — public anchor rails any agent framework can reference. The identity and reputation registries are deployed on Ethereum mainnet; the validation registry is not yet, and the EIP itself is still a Draft.
How it fits: Agent DIDs are registrable in its identity registry, and receipt-chain checkpoints can publish to its validation registry (the Proof Pair's planned v0.1 anchoring path).
Source: EIP-8004 (status: Draft) + official contracts repo · checked 2026-11-02
W3C
The identity substrate: decentralized identifiers plus cryptographically verifiable claims — the data model underneath every serious credential system. VC Data Model 2.0 and DID Core 1.0 are W3C Recommendations; DID 1.1 is a Candidate Recommendation.
How it fits: Every actor in the Proof Pair is a DID; a mandate is a Verifiable Credential. This is the layer the whole scene stands on.
Source: W3C Recommendation — VC Data Model 2.0 (15 May 2025) · checked 2026-11-02
What may it do, for whom, until when — and can that be revoked?
IETF (OAuth WG)
Verifiable credentials as JWTs with claim-level selective disclosure and cryptographic holder binding (KB-JWT). The base format is now RFC 9901; the VC profile is in IESG evaluation.
How it fits: The mandate's single normative format in Proof Pair v0 — an agent proves “I may spend ≤ $X for org Y” without revealing its full grant set.
Source: IETF Datatracker — draft-ietf-oauth-sd-jwt-vc (IESG Evaluation) · checked 2026-11-02
OpenID Foundation
The issuance and presentation transports for verifiable credentials — how credentials move between issuers, holders, and verifiers over HTTP. Both are Final 1.0 specifications (OID4VP July 2025, OID4VCI September 2025); deployment is still ramping.
How it fits: The Proof Pair's profiled bindings for issuing mandates and presenting them to HTTP verifiers. Headless agent wallets are conformant holders.
Source: OpenID Foundation — OID4VCI 1.0 (Final) · checked 2026-11-02
DIF
Encrypted, transport-agnostic messaging between DID-identified parties, with mediators that queue messages for offline agents. v2.1 is a DIF Ratified Specification.
How it fits: The agent-to-agent and mailbox transport: how a headless agent receives and presents mandates while its machine sleeps.
Source: DIF — DIDComm Messaging v2.1 (Ratified) · checked 2026-11-02
W3C
Credential revocation at scale — a compact, privacy-preserving way for verifiers to check whether a credential is still valid. A W3C Recommendation since May 2025.
How it fits: The Proof Pair's single normative revocation mechanism: a compromised agent must be stoppable in seconds, not CRL-hours.
Source: W3C Recommendation — Bitstring Status List (15 May 2025) · checked 2026-11-02
Can it pay, and can the payment be tied to what the person approved?
Google → FIDO Alliance
Signed user-intent artifacts for agent commerce: Intent Mandates (what the user authorized the agent to seek) and Cart Mandates (the specific transaction approved). Google donated it to the FIDO Alliance in April 2026, where its Payments Technical Working Group is developing it; the latest release is v0.2.
How it fits: A Proof Pair mandate compiles down to an AP2 Intent/Cart Mandate for payments. The delta: AP2's trust chain terminates at a processor account; the Proof Pair's terminates at a verifiable human or institutional root — which is what regulated and cross-institutional delegation needs.
Source: FIDO Alliance — Google donates AP2 (Apr 2026) · checked 2026-11-02
Mastercard
A chain of signed credentials (layered SD-JWT) proving that an agent's purchase stayed inside the limits the person set — amount, merchant, line items. Published in March 2026 as an open draft (v0.1), maintained by Mastercard and open to multi-stakeholder contribution.
How it fits: Built on SD-JWT, the same format family as a Proof Pair mandate, so the two can be expressed in each other's terms. It answers the payments half of the question the mandate answers in general: did the person authorize this, within these limits.
Source: Verifiable Intent spec — README (Draft v0.1) · checked 2026-11-02
x402 Foundation (Linux Foundation) · incubated by Coinbase
Payment inside the HTTP request itself, using the long-reserved 402 Payment Required status: a client or agent pays for a resource and gets it in one exchange. Launched by Coinbase in 2025; now governed by a Linux Foundation project with 40 member organizations at its July 2026 launch.
How it fits: Settles the payment; says nothing about who authorized it. That is the half a mandate supplies — the proof that this spend was delegated, by whom, within what limit.
Source: Linux Foundation — x402 Foundation operational launch (14 Jul 2026) · checked 2026-11-02
Who did what, under whose authority — and can anyone check?
Coalition for Content Provenance
Signed, append-only provenance manifests for media content — who made this, with what, changed how. The specification is at version 2.5 (October 2026).
How it fits: The pattern source for the receipt chain: the same signed, tamper-evident manifest discipline, applied to agent actions instead of media files.
Source: C2PA Technical Specification 2.5 · checked 2026-11-02
Can it prove a claim without revealing the data behind it?
Privacy & Scaling Explorations · Ethereum Foundation
Proves you belong to a group without revealing which member you are, with a nullifier that stops the same member from signalling twice. On its fourth major version (v4, 2024; latest release October 2026).
How it fits: Membership without identity: an agent could show it acts for some verified member of an organization without disclosing which one — the privacy-preserving edge of the identity lane.
Source: Semaphore documentation + releases (v4.14.5, Oct 2026) · checked 2026-11-02
W3C
Selective disclosure for verifiable credentials with unlinkable derived proofs: a holder reveals only some fields, and two presentations of the same credential cannot be correlated. A W3C Candidate Recommendation (September 2026).
How it fits: The privacy property SD-JWT alone does not give: the same mandate presented to two verifiers cannot be linked back to one agent.
Source: W3C Candidate Recommendation Draft — vc-di-bbs (10 Sep 2026) · checked 2026-11-02
Open field · EZKL among the most-used provers
Zero-knowledge proofs that a given model produced a given output, without revealing the weights or the inputs. Tooling exists and proofs can be checked on-chain, in a browser or on a device; proving cost is still high and there is no standard yet.
How it fits: For receipts, the difference between “an agent did this” and “this model, under this mandate, did this” — provable to someone who cannot see the model.
Source: EZKL — open zkML prover (v23.0.5, Feb 2026) · checked 2026-11-02
What the field says the gap is.
Anthropic
The security framing published in 2026: Zero Trust for agents means identities that are cryptographically rooted and permissions scoped per task — because traditional access controls won't stop an agent from misusing permissions it legitimately holds.
How it fits: Names the gap the Proof Pair fills. Identity answers who. A mandate answers what this agent may do, for whom, until when. A receipt answers who did what, under whose authority.
Source: Anthropic — Zero Trust for AI agents (27 May 2026) · checked 2026-11-02
● The agent-identity landscape, mapped
Most agent-identity comparisons line up whitepapers against whitepapers. This one is calibrated against a proven end-to-end implementation — a working system in which an agent is issued a scoped, owner-bound credential, presents it to a counterparty in a different organization with no prior relationship, and has that credential verified cryptographically on the wire, with selective disclosure and explicit revocation, today. The bar here is implemented, not proposed.
● The lane, stated first
Here is the specific combination the field has not delivered — an agent identity that is simultaneously all of these at once:
No solution in the field delivers all of the above. The map below shows where each one stops.
● Six solutions — what they do, where they stop
A crucial distinction runs through the field: most of these are not rivals — they are integration points. Four of the six operate at layers below or beside agent authority (where agents run, how traffic is enforced, who issues inside one company). Only one occupies the same layer.
Dick Hardt · IETF draft
What it doesDelegated authorization for agents. The most direct attempt at the same problem: letting a principal grant scoped authority to an agent. Includes a genuinely good asynchronous-consent pattern (pending / deferred approval).
Where it stopsRoot of trust is anchored in the provider's DNS, not in keys the person holds — so authority terminates at a provider, not a human. A standards-track draft with, as of writing, no production deployments. Not offline-verifiable.
Direct rival — same layer. But DNS-rooted and pre-production.
delegation / capability tokens · [TBD-verify: confirm full name]
What it doesA capability-token scheme for delegating narrow permissions, with a strong attenuate-only rule: each hop in a delegation chain can only narrow authority, never widen it.
Where it stopsSolves sub-delegation elegantly but does not carry a person-root, government anchoring, or cross-org verification without shared infrastructure. Adjacent to the lane, not in it.
Source of a good idea — the attenuation invariant is worth adopting; the protocol is not the same product.
What it doesEnterprise identity for agents inside one organization / tenant — issuing, listing, and governing an org's own agents at scale, with mature lifecycle tooling.
Where it stopsBounded to the org that issues. It is an intra-org issuer, not a cross-org trust fabric; two agents from different companies don't gain mutual verifiability from it.
Integration point (an issuer to interoperate with), with lifecycle blueprints worth learning from. Watch item: if combined with a verified-credential product for cross-org portability, the boundary could shift. [TBD-verify: GA status]
What it doesA policy-enforcement layer for agent traffic — evaluates rich policy expressions at the gateway and allows / denies calls. Cloud-native, well-distributed.
Where it stopsEnforces policy; it does not establish who the agent is or where its authority came from. It needs an authority to enforce.
Integration point — a person-rooted credential is a standard token that enters its policy engine with minimal adaptation. Compose, don't compete.
What it doesAn agent runtime — where agents are built and run.
Where it stopsRuns agents; says nothing about portable, verifiable identity or cross-org authority.
Integration point — the layer beneath identity, not a rival to it.
What it doesAn agent runtime / substrate — infrastructure for operating agents.
Where it stopsOperational substrate, not an identity or authority layer.
Integration point — not a rival.
The tally: four integration points (two runtimes, one enforcement layer, one intra-org issuer), one source of a technique to adopt, and one true rival in the same layer — AAuth — which is DNS-rooted and has yet to ship in production.
● Where the person-rooted approach sits
Against that map, the lane is still open. A person-rooted agent credential — owner-bound, revocable, selectively disclosable, cross-org, offline-verifiable, and anchorable to a real-world identity — is the one combination nobody else assembles. The human holds the key that authority descends from: AAuth roots in DNS, the enterprise issuers root in a tenant, the runtimes have no root at all. Offline verification is unique to this approach across the whole map. This isn't a claim that everyone else is wrong — they solve different problems, and the authority layer that sits above all of them, rooted in a person, is unoccupied.
● The honest limit — where person-root actually matters
A market map that only lists strengths is not credible. A person-owned root of trust has real demand only where the context requires that a human authorized something — government acts, legally binding mandates, citizen transactions, regulated consent. Where authority is purely machine-to-machine and no human needs to be provably behind it, a provider-root or an org-issuer is often enough, and cheaper. So this is both the market and its edge: the value is highest exactly where the law, an institution, or accountability demands a real person stand behind the agent's action — and it is deliberately not trying to be the default for every automated call between two services. This same limit was reached independently by two separate analyses; independent convergence on a system's honest boundary is a credibility signal, not a weakness.
● Compose, don't compete
The position we're aiming for is to be the authority layer everyone else can build on — adopting the best ideas without adopting whole protocols: attenuation per hop (sub-delegation can only narrow authority, never widen it), asynchronous consent (deferred / pending approval as a first-class flow), and lifecycle blueprints from the enterprise issuers. A person-rooted mandate is the source of truth that renders down into the authorization protocols the ecosystem already uses — riding existing rails rather than fighting them. The proof of “compose, don't compete” is an integration, not an argument.
Standards alignment: built on and interoperating with the open standards the category is converging on — ERC-8004, AP2, W3C Verifiable Credentials, SD-JWT, and OID4VC — so composability is designed in, not bolted on.
● Open questions for the category
A map of a live field, drawn honestly, by the team measuring the category rather than marketing to it. Benchmarked against a running end-to-end implementation as of mid-2026; standards drafts and product statuses evolve — time-sensitive claims are re-verified before publication.