AI Agent Identity and Trust Standards: Who's Writing Them, and Where They Stand

Web Bot Auth lets an automated client sign each HTTP request so that a website can check which operator sent it. It builds on HTTP Message Signatures (RFC 9421, February 2024): the agent signs at least the request's authority or target URI, with a creation and expiry time, a key ID and the tag web-bot-auth, and a Signature-Agent header tells the site where to fetch the operator's public keys, a JWKS directory served at a well-known URI.¹⁴

The IETF's Web Bot Auth working group charter (dated October 23, 2025) scopes the work to search crawlers, archivers, AI-training crawlers and "AI agents retrieving or interacting with content on behalf of end users". It authenticates the agent, not the end user, and "tracking or assigning reputation to particular bots" is explicitly out of scope.² The group adopted the protocol on September 1, 2026, as draft-ietf-webbotauth-httpsig-protocol-00, replacing the earlier individual drafts; its authors are from Cloudflare and Google.¹³ A companion individual draft, the Signature Agent Card, would let an operator publish who it is, its purpose, rate expectations and keys in one JSON document.⁵

Visa launched its Trusted Agent Protocol on October 14, 2025, as "a foundational framework for agentic commerce", developed with Cloudflare and published on the Visa Developer Center and GitHub.⁶ A trusted agent includes an RFC 9421 message signature in its request; the merchant rebuilds the signature base from the request and checks it against the agent's public key, and the signature is bound to the merchant's domain and the page, with a timestamp and session ID against replays.⁷

Cloudflare said the same day that the protocol "enables payment networks to integrate Web Bot Auth", and that Mastercard was building Web Bot Auth into Mastercard Agent Pay and American Express into its agentic commerce program.⁸ Visa says the initial specifications apply to the Visa network "in this phase" and that it is "committed to aligning closely" with the IETF, the OpenID Foundation and EMVCo.⁶ No version number is published, so the table dates it by its launch.

The IETF's WIMSE (Workload Identity in Multi System Environments) working group adopted an agent framework on September 15, 2026: draft-ietf-wimse-aims-00, the AI Identity Management System. It replaces the individual draft-klrc-aiagent-auth.⁹¹⁰ AIMS deliberately defines no new protocol. It describes how existing standards, the WIMSE identifier model (which may be a SPIFFE ID), OAuth 2.0 and its extensions, can authenticate and authorize AI agent interactions, and where the gaps are for future standards.⁹ Its six authors are from Defakto Security, AWS, Zscaler, Ping Identity, OpenAI and Okta.⁹

The OAuth working group's charter, revised in June 2026, now names the same problem: "developing new mechanisms or/and extensions for authorization of automated agents working on behalf of users", including across administrative domains.¹¹

The Model Context Protocol (MCP) has its own authorization rules. In the current revision, 2026-07-28, authorization is optional; when a server uses it, the server is an OAuth 2.1 resource server and the MCP client an OAuth 2.1 client, clients must use resource indicators (RFC 8707), and clients and authorization servers should support OAuth Client ID Metadata Documents for registration.¹² This identifies the client application and the user for a tool server; it doesn't give the agent an identity of its own. Anthropic donated MCP on December 9, 2025, to the Agentic AI Foundation, a directed fund under the Linux Foundation.¹³

Skyfire's KYAPay drafts define a JSON Web Token format "for agent identity and payment tokens", so that authorization and resource servers from different vendors can read them.¹⁴ The current document is draft-skyfire-oauth-kyapay-token-02, dated October 2, 2026; it replaced the earlier draft-skyfire-kyapayprofile.¹⁴¹⁵ It is an individual submission, with authors from Skyfire Systems and Self-Issued Consulting.¹⁴

Two individual drafts try to compose existing OAuth pieces into one delegation scheme. The Credential Delegation Protocol (draft-sweeney-wimse-credential-delegation-01, October 13, 2026) profiles OAuth 2.0 Token Exchange (RFC 8693), DPoP proof-of-possession (RFC 9449) and Rich Authorization Requests, noting that "no current specification defines how these mechanisms compose" for AI agents.¹⁶¹⁸ The AI Agent Authorization Integration Framework (draft-liu-ai-agent-authorization-integration-00, July 6, 2026), by authors from Alibaba Group, Cisco and Okta, combines cross-domain identity, policy-based authorization, user consent evidence and multi-hop delegation.¹⁷

In the Agent2Agent (A2A) protocol, each agent publishes an Agent Card describing its skills and endpoints. Since version 0.3.0 (July 30, 2025) the card can carry signatures, and A2A 1.0 says cards "MAY be digitally signed" with JSON Web Signature (RFC 7515), after canonicalizing the JSON with RFC 8785, so a client can check the card "originates from the claimed provider".²⁰¹⁹ Signing is optional. Otherwise the spec relies on web security: clients "SHOULD verify the A2A Server's identity" through its TLS certificate, and credentials are obtained out of band.¹⁹

A2A was developed by Google and donated to the Linux Foundation; a technical steering committee with members from AWS, Cisco, Google, IBM Research, Microsoft, Salesforce, SAP and ServiceNow maintains it.²¹ The latest release in its changelog is 1.0.1, May 26, 2026.²⁰

AIP addresses the hop where one agent hands work to another with no authorization server in between. It "conveys delegated authority along a chain of AI agents" so that the final service can verify, from the token and the issuer's public key, who granted the authority, which agents it passed through, and "that no hop widened what it received". It is written to compose with AIMS, which covers hops that do have an authorization server.²²

ERC-8004 takes a different route: three registries on Ethereum or its layer-2 chains. An Identity Registry gives each agent an ERC-721 token that points to its registration file; a Reputation Registry standardizes posting and reading feedback; a Validation Registry records checks by independent validators, such as stakers re-running a job, zero-knowledge proofs or trusted-execution oracles.²⁴ Its four authors list handles or addresses at MetaMask, the Ethereum Foundation, Google and Coinbase, and its status is Draft.²⁴ The proposal itself warns that "Sybil attacks are possible, inflating the reputation of fake agents".²⁴

A June 2026 preprint that crawled the registries on Ethereum, BNB Smart Chain and Base to May 13, 2026, measured how that plays out: only 3%, 4% and 15% of registrations exposed a valid registration file with at least one live endpoint, and 73.5%, 59.2% and 90.6% of reviewers showed coordinated Sybil behavior. The authors conclude that the Reputation Registry, as deployed, "cannot function as a trust signal".²⁵ Those are the study's measurements, not the proposal's. MetaPrompt covers on-chain registries as agent infrastructure only; we don't track crypto-asset prices.

Vouched donated an agent identity framework to the Decentralized Identity Foundation in March 2026, and DIF renamed it the Know Your Agent Operating System (KYA-OS) on April 22, 2026, describing it as "an identity and delegation standard for the full range of agentic protocols, extending well beyond MCP".²⁶ It uses decentralized identifiers and verifiable credentials to give agents verifiable identities and to represent delegation as credentials with explicit scope, and defines three conformance levels, from existing OIDC and JWT identifiers up to full lifecycle management and auditing. A task force in DIF's Trusted AI Agents Working Group is refining it.²⁶

NIST's National Cybersecurity Center of Excellence published a draft concept paper on February 5, 2026, for a possible project showing "how identity standards and best practices can be applied to software agents", with questions on identification, authorization, auditing and non-repudiation of AI agents; comments closed on April 2, 2026.²⁷²⁸ It sits under NIST's AI Agent Standards Initiative, which says it will run gap analyses and research "agent authentication and identity infrastructure" to inform industry-led standards; as of its August 14, 2026 update the page still lists the paper as a draft.²⁹