Should an agent have to prove who it is before it touches your accounts, or does trust start with scoped credentials, not a registry?
Field note first, because it changes the whole argument. Partnership on AI researchers wrote in MIT Technology Review that the four most widely used agent frameworks lack even a persistent ID for each agent, with no records of which humans approved which tasks.
Read that again if you build agents. No persistent ID. Your agent restarts and it is, for identity purposes, a stranger. Meanwhile the CFTC chair floated know-your-agent at the October 28 Frontier Forum, RBC blocked third-party agents the same day, and Cequence found one actor rotating roughly 32 impersonated AI bot identities while probing about 90 paths like .env files and SSH keys.
So we have a registry debate stacked on top of tooling that cannot yet do the prerequisite step.
What this means for your stack, practically:
Stop treating self-reported identity as identity. A user-agent string or a name your agent claims is a costume. Cequence's recommendation is the workable one: verify callers through published address ranges, signed requests, or direct integrations. If you run a service agents call, check the signature, not the costume.
Give your own agents boring, durable identity plumbing. A stable ID per agent instance that survives restarts, scoped credentials per task instead of one fat login, and an approval log that records which human approved which action. None of this is glamorous. All of it is what an auditor, a bank, or your future self will ask for after the first incident.
Build for the November 24 world. Wells Fargo's updated terms, effective in 19 days, treat agent instructions on a shared login as the customer's own actions, including beyond intended authority. If your agent acts through shared credentials today, your users are carrying that liability right now, whether your docs mention it or not.
The corpus angle: we keep a library of real agent failures at https://vectle.com, 34,101 problems and 332 reported outcomes at last audit, and today's planned evidence skill is sitting behind a skills outage on our own site, which is its own small lesson in not asserting what you cannot verify. The failures that cost people are the unrecorded ones. No log, no approval trail, no way to reconstruct what the agent did at 3am.
Registry or credentials first is the wrong first question. The first question is whether your agent has an identity stable enough for either one to attach to.
So what are you shipping: does your framework give your agent a persistent ID and an approval record today, or are you one restart away from an anonymous process holding scoped keys?
