Several standards bodies are trying to give AI agents something they have never had: a way to prove who they are, rather than assert it in a header.
There is no agent identity standard yet. As of October 2026 there is a W3C Community Group, at least two IETF drafts, and several independent specifications — all working on the same idea and none of them ratified. The idea is simple to state: an agent should be able to prove who it is and who it acts for, rather than declaring it in a User-Agent that anyone can type.
Detection has been losing ground to agents all year, and the industry response has split in two directions. One is better detection: score harder, look deeper, accept more false positives. The other is the one this page is about — stop inferring and start verifying.
The appeal is that it converts a judgement into a fact. Today, "is this a legitimate AI assistant?" is answered by looking at behaviour, fingerprints and origin, and guessing. With a signed identity, a declared agent that can prove its claim is simply handled — and detection gets to spend its effort on the traffic that declined to identify itself, or claimed an identity it could not prove.
That reframing is why the current situation is uncomfortable. Publishers are being asked to decide which agents to allow while the only identifier available is self-declared. Building a policy on an unverifiable claim is the same mistake robots.txt makes — and the reason robots.txt is a request, not a control.
| Effort | Started | Core idea |
|---|---|---|
| W3C Agent Identity Registry Protocol CG | Apr 2026 | A DID method for agents, verifiable credentials, cross-organisation trust negotiation, and profiles for MCP, A2A, OAuth/OIDC and SPIFFE. Coordinates with DIF, OpenID AIIM and IETF WIMSE. |
| IETF — Clawdentity | 2026 | Per-agent Ed25519 identity, registry-issued tokens, proof-of-possession signing, revocation, and a zero-trust relay. |
| IETF — AgentID | 2026 | A signed JWT carrying owner verification, capability and a delegation chain, built on OAuth 2.0, OIDC and JWK. |
| W3C WebAuthn discussion | 2026 | Whether WebAuthn's attestation model can be applied to software — i.e. agent — authenticators. |
| Composable Agent Trust Stack | 2026 | A federated six-layer architecture; notably observes convergence on Ed25519 across protocols and a shared /.well-known/ hosting convention. |
| AISS (independent) | 2026 | Hash-chained signed events, agent IDs derived from public keys, and post-quantum hybrid signing. |
Strip away the differences in transport and encoding and every proposal does the same three things: a key pair the agent holds, an attestation from someone you already trust binding that key to a real owner, and a signature on the request so a server can verify the claim without asking the agent to be honest about it.
The convergence on Ed25519 as the signing primitive is worth noting — it means the drafts are at least compatible at the cryptography layer even where the semantics differ. Several proposals already include delegation chains, which matters more than it sounds: the interesting question for most operators is not "which agent is this" but "which human authorised it, and for what".
Operationally, very little — nothing here is deployable and anything claiming compliance today is implementing a draft. The one thing worth doing is unglamorous: keep the full request. Record the claimed agent identity, any signature headers you receive, and the address the request actually came from.
When verification becomes practical you will want to know which of the agents that contacted you over the previous year could have proven their identity, and which were asserting a name they had no claim to. That analysis is impossible on data you did not keep, and it is the only way to answer the question retroactively rather than starting from zero.
ZeroBot returns the claimed identity alongside the verdict and, where fingerprinting is enabled, the automation signals behind it — so the record exists on your side rather than only in a dashboard you cannot query.
A way for an AI agent to prove who it is and who it acts for, rather than asserting it in a User-Agent string. Every proposal in this space does the same three things: gives the agent a cryptographic key pair, has a trusted party vouch for the binding between that key and a real owner, and lets the agent sign requests so a server can verify them without trusting a self-declared header.
The W3C chartered an Agent Identity Registry Protocol Community Group in April 2026, covering a DID method for agents, a verifiable-credential format, cross-organisation trust negotiation, and profiles for MCP, A2A, OAuth/OIDC and SPIFFE. The IETF has drafts including Clawdentity and AgentID, and there is active W3C WebAuthn discussion about whether attestation models apply to software authenticators.
It would move one question from inference to verification. Today "is this a legitimate agent?" is a judgement made from behaviour and fingerprints. With a signed identity, a declared and verified agent is a fact, and detection can spend its effort on the traffic that declined to identify itself — or claimed an identity it could not prove.
No. As of October 2026 there are drafts, a W3C Community Group, and several independent specifications, but no ratified standard and no widespread deployment. Anything claiming compliance today is describing an implementation of a draft.
Not much operationally, but log what you can. If you keep the full request — claimed agent identity, signature headers if present, and the IP it actually came from — you will be able to answer the identity question retroactively once verification becomes practical. Retroactive analysis is impossible on data you did not keep.
W3C — Agent Identity Registry Protocol Community Group created · IETF — Clawdentity protocol draft · W3C WebAuthn — attestation for agent authenticators · Composable Agent Trust Stack · AISS — Agent Identity and Signature Standard. Drafts change; check the current revision before relying on any detail here.
Claimed identity, automation signals and the verdict, returned to you per request.
Get started free →