Who is the agent? Two answers in one week, and a gap
What happened
Two announcements this week address the same question: how does a website, or another agent, find out who stands behind an AI agent?
Proof x401 (15 October 2026). The US company Proof says in its own press release that it has put an open HTTP protocol called x401 into production. A website can use it to ask an agent for evidence before proceeding, for example verified identity claims and a cryptographic signature over specific transaction terms. The person reviews the details on their own device and confirms with a biometric; if the amount or recipient changes afterwards, the signature fails. That is Proof's description of its own product (GlobeNewswire). We have not tested it independently.
“Chain of Trust” (14 October 2026). GoDaddy, Infoblox, Google and Cloudflare, working with Singapore's IMDA, demonstrated an open reference architecture at GovWare in Singapore, according to the report. In the demo, a buyer agent purchases a flight from a seller agent it did not know before. The seller is found via DNS and checked against a public log, an independent service issues signed AP2 mandates (what, from whom, up to what amount), and a human approves with a passkey. Scenarios with a look-alike seller and forged credentials were stopped, the report says (Yahoo Finance). It was a demonstration, not a production service.
The background to both is the dispute over AI shopping agents. Proof's release itself mentions that Amazon blocked Meta's Muse agent because it did not identify itself; see our article on Amazon.
Why this does not settle the question
Both approaches answer the question for a single transaction: this purchase, this transfer, this mandate. That is useful and solves a lot. But shops, banks and other agents face a second question that comes before the transaction: does this agent belong to the company it claims to represent, and what is it permanently allowed and not allowed to do?
The interests differ. The customer does not want things done in their name that they did not intend. The shop wants to know whether it can trust a request, and would rather not shut out every agent. The operator wants its agents not to be mistaken for forgeries. A ban protects the shop, blanket admission serves the operator, and neither says who is knocking.
We are not claiming that the solutions above cannot answer this. We only note that both reports describe evidence per transaction or per mandate, not a public directory, checkable without an account, of which agents a company has declared as its own on its own domain. (We know the role of the name service ANS in the Chain of Trust architecture only from the report and have not examined it in detail.)
What ID MANDAT contributes
ID MANDAT is an open registry: a company declares on its own domain which AI agents act for it and what each may and may not do. Anyone can check this without an account, on the web, through a signed REST API (beta), via MCP or A2A. Revoked or suspended entries are shown as such.
That is the layer before the transaction. Our stance (not a forecast): per-transaction proof and a public directory are more likely to complement than replace each other. Whether and how they fit together is open; we would like to talk to people who build agents or shops.
What this does not do
- ID MANDAT confirms identity and authority, not creditworthiness, trustworthiness or quality.
- Statements about agents and their permissions come from the company itself (a declaration by the operator, not a check of each individual permission).
- It does not show that a specific request was approved by a person. Procedures like those described above do that.
- It cannot determine whether shops or AI systems accept or prefer entries.
Register your company · Check a domain · Technical standard · What is ID MANDAT?