An Agent That Cannot Be Looked Up Is an Anonymous Stranger With an API Key

Everything below about our own deployment is verifiable from a cold terminal, and the section that says so gives you the commands.

The question that arrives with autonomous software

An agent contacts your system and asks to do something. Book the freight, pull the report, place the order, open the account.

You need answers to questions you have never had to ask software before. Who owns this thing? Not which server it runs on, but which legal person is answerable for it. Has it done this before, and how did that go? If it misbehaves, who do I contact, and how fast can somebody switch it off?

An API key answers none of them. A key proves that whoever holds it holds it. It is a bearer token, it carries no ownership, no history and no accountability, and revoking it is a conversation with whoever issued it.

Why letting the agent describe itself does not fix it

The obvious answer is to have the agent serve a document about itself at a known location: what it is, who runs it, what it can do.

That is useful for capability discovery and worthless for trust, because the agent wrote it. A self-declared manifest tells you what somebody wants you to believe, and the failure mode is not subtle.

The word "passport" is doing real work here. A passport is valuable precisely because its holder did not issue it and a third party can check it independently. An identity document you print yourself is stationery.

What a checkable agent identity actually needs

An issuer who is not the agent. Somebody else asserts the binding, and their assertion is what a verifier evaluates.

A record a stranger can read without asking either party. If confirming an agent's identity means calling its operator, the operator is the trust anchor and the identity is decorative.

An owner that resolves to something accountable. The chain from agent to a party who can be contacted or removed is the entire point. An identity terminating in another pseudonym has moved the problem.

And revocation measured in seconds. Autonomous software acts continuously, so a withdrawal path that takes a day arrives after the damage.

What we found doing exactly that

Our own record of this used to note a discrepancy: the manifest described our identifier method's standards-registry status as still under review, months after it had been registered.

Re-probing it, the discrepancy is gone. The manifest states the registered status correctly and its own last-updated timestamp is current.

We report that because the correction runs in the direction that costs us the anecdote. The note describing the flaw had itself gone stale, and a record that describes a fixed problem as current is the same category of error as one describing a broken thing as working. Both are labels that stopped matching the thing.

Why revocation latency is the part to interrogate

For human identity, a credential that lags reality by a day is usually survivable. For an agent it is not.

Software does not pause. An agent whose authority should have ended at 09:00 and ends at 17:00 has eight hours of continuous action behind it, and every one of those actions looks authorised to everyone who checks.

So for machine identity the question is not whether revocation exists but what its latency is, and that is a design property rather than an operational promise. Ours trades instant withdrawal for availability, which is defensible and which a buyer should choose knowingly rather than discover.

What to ask anyone offering agent identity

"Who issued this, and is it the agent's operator?" If those are the same party, you have a business card.

"Can I resolve it without contacting you?" This separates an identity from a lookup service you now depend on.

"How long between a revocation decision and the last successful action under the old authority?" Ask for the number. Every design has one.

"What does the identity terminate in?" Follow the ownership chain until it reaches something you could contact. If it does not, the accountability is decorative.

Where this leaves a decision

If you are already accepting instructions from autonomous software, the identity question is live whether or not anyone has raised it, and the honest position is that this whole area is early everywhere, including here.

What we have is one passport on a test network, a structure whose two halves a stranger can check against each other, and no operator relying on it commercially. If that is useful to build against now, it is available.