State of play: how a shop finds out who stands behind a signed AI agent
This page records what is technically possible today, what ID MANDAT has built on top of it, and what is still missing. It will be updated, with dates, so the history can be read.
The state of the art
In the IETF, the Web Bot Auth working group is working on a way for automated programs to sign their requests cryptographically. The draft “HTTP Message Signatures for automated traffic” (draft-ietf-webbotauth-httpsig-protocol-00, 1 September 2026) has authors from Cloudflare and Google, among others. A signed request names the address of a key directory in the Signature-Agent header. With it a shop can check that the request comes from the holder of the key. IETF Datatracker
The draft explicitly does not define who operates the agent or what it may do. It is a working-group draft, not a finished standard.
The gap
A valid signature answers “Does this request come from the holder of this key?” It does not answer “Which company is behind it?” or “What may the agent do on that company’s behalf?” Without those answers a shop can only treat all agents alike: let all in, or block all. The dispute over Amazon and AI shopping agents shows why that is not enough: Amazon blocks AI shopping agents.
What ID MANDAT has built
- Lookup by key directory. The shop sends the address from the
Signature-Agentheader to/api/v1/verify?signature_agent=…and learns which registered company has declared that directory for its agents, at what level it was checked, and what the agent may and may not do. The answer is digitally signed (Ed25519, beta). - The same lookup for people. The check page has a second field for the address.
- For programs and agents. A new tool in the MCP server (
verify_signature_agent) and functions in the Python (check_signature_agent) and JavaScript (checkSignatureAgent) libraries, version 0.3.0 on GitHub. - The company declares its directory itself. The credential file has an optional
signatureAgentfield for this. The credential generator has a matching input. - House rules for agents. The For shops page has a generator that creates a file
/.well-known/agent-house-rules.json: whether agents must identify themselves, whether a registry check is expected, and what is allowed, allowed only after asking, or forbidden. This is ID MANDAT’s own proposal, not a standard, and as far as we know no agent reads it automatically today.
What the logic looks like at the shop
1. Is the signature valid? no -> reject
2. Ask the registry: who is behind it, what may the agent do?
unknown or revoked -> decide by your own house rules
3. Does the action fit the declared mandate and the house rules?
yes -> allow, no -> reject, unclear -> ask a humanWhat we cover and what we do not
Giving an agent authority needs several building blocks. Here is where we stand on each:
| Building block | Status at ID MANDAT |
|---|---|
| Identity of the company | Yes. Bound to the domain. At the “Verified” level, plus a check against the legal notice and the commercial register or VAT ID. |
| Who acts for whom | As a declaration. The company declares which agents act for it. ID MANDAT does not confirm that the authority was actually granted. |
| What the agent may do | As a declaration. may and mayNot per agent, stated by the operator and not checked by ID MANDAT. |
| Passing authority on to other agents (delegation) | No. Chains such as “agent A may instruct agent B” do not exist. |
| Expiry | Partly. Entries expire, and each answer is valid for 15 minutes. Time-limited authority for single transactions does not exist. |
| Revocation | Yes. Revoked, suspended and expired entries are named as such in the answer. |
| Proof of who did what and when (audit) | No, by design. ID MANDAT does not store individual lookups by domain, IP or person, only the number of lookups per day. A log would have to sit with the shop or the agent. |
| Authority per transaction (amount, purpose, time window) | No. That is a different layer. Separate procedures are emerging for it, for example for payments. ID MANDAT answers the question before it: who is the principal. |
What this does not do
- ID MANDAT does not fetch the key directory and does not check that the company actually controls it. The match rests on the company’s own declaration. If the directory is on the same domain, the answer notes this as a hint, not as proof.
- The statements about agents and their authority come from the company itself. ID MANDAT confirms identity and authority, not creditworthiness, trustworthiness or quality.
- No match is not a sign of anything improper. A valid signature may still be genuine; it just does not say who is responsible.
- The registry is new and small. Its usefulness grows with the number of entries and of shops that query it.
What is still open
- An example of our own with a real agent and a real key directory.
- More entries and first shops that query the registry.
- The standard itself: the credential file format is openly documented; adoption by a recognised body is so far only planned.
For shops · Check a domain or key directory · Technical standard · Register a company