AI agents can talk to each other. Giving them an identity could get them to trust.

In barely a year, the industry has agreed on how AI agents should find one another and hand off work. It has reached no such agreement on the harder question as to how an agent proves what it is allowed to do. One of decentralized identity's architects argues the answer was built years ago.

SSI was built to protect people, and it is likely to reach us at scale through the very machines that now need it too.

Glenn Gore CEO Affinidi

An AI agent can now book travel, move money between accounts, and file paperwork on a person's behalf, and run for hours with no one watching. But it still cannot reliably prove to another agent that it is what it claims to be or that it actually has the authority to do what it is doing.

The layer that's missing

The communication layer for AI agents has come together with unusual speed. Anthropic's Model Context Protocol and Google's Agent2Agent protocol have both been handed to the Linux Foundation, which places them under neutral, open governance rather than any single company's control. Their backers, Google, Anthropic, Microsoft and Salesforce among them, have committed to making the two interoperate, with a first joint specification on the roadmap. A2A on its own crossed 150 production organizations at its one-year mark in April.

What about the trust layer? Where are the decentralized identity tools meant to let one agent verify who another agent is, and what it is permitted to do? A2A's security model is a signed "agent card" served from a web domain, which establishes that a message came from a particular site but not who controls the agent behind it, on whose behalf it is acting, or what it has been authorized to do, the questions that begin to matter a lot more the moment an agent is moving money or reaching into a system for someone. The U.S. National Institute of Standards and Technology has opened an initiative on agent identity and authorization. Now would seem a fine time to settle whether the agent on the other end is who it claims, and that it is cleared to do what it is doing.

The architect's bet

Glenn Gore has spent the better part of six years on solving the problem of how to let any two parties (people or machines) prove to each other who they are and what they are entitled to do, with no platform in the middle to vouch for them. Gore is chief executive of Affinidi, and before that he was a global chief architect at Amazon Web Services. His considered view, after years inside the work of self-sovereign identity's long effort to let people and organizations hold their own credentials directly, is that the SSI will end up mattering most not because it protected individuals, but because it turns out to be what AI agents need.

Over these years, Gore saw the standards underpinning decentralized identity keep multiplying faster than anyone could build something lasting on them, always one revision short of settling. 

So late last year, he stopped waiting on the standards bodies. His wager was that they were not going to converge in time to matter, and that what moved the field forward most was a working system in production. He drew a boundary around a deliberately small set of settled pieces, a couple of identifier methods, the W3C format for verifiable credentials, an authentication mechanism, five or six in all, and declined to chase anything newer. The approach rests on an old engineering principle that complex systems evolve from simpler ones that worked, and never arrive fully formed from a clean-sheet design.

The real argument is about who the technology is for. For a decade, decentralized identity has been sold as a way to protect individuals, yet for a decade most individuals have not given up logging in with Google and Apple. But on this point, Gore notes that technologies are often carried to scale less by their intended users than by the opposite ones; mobile phones were initially built for business yet scaled through consumer use. He expects an inversion here as well.

Talking sideways

The reason agents force the issue has to do with the fact that enterprise identity is built top-down, so that a company owns its directory, employees hang off it, permissions flow up to the platform and back down. Agents break that geometry.

An agent acting for one company has to establish, on the fly, that it is dealing with a legitimate agent from another, outside its own trust domain, with no shared directory sitting above them both. That, he argues, is what an identifier you actually own provides and an email address does not. "I can prove that I have access to it, but I don't have proof that I own it, because Google owns my email address, not me," he said. A decentralized identifier, by contrast, is a globally unique address that carries its own keys, so the holder can prove ownership, and its own service endpoints, so two parties can find and message each other directly. Multiply that across millions of agents, he says, and lateral trust at machine speed becomes possible.

Knowing whom to believe

Proving an identifier is only the first step; the harder one is deciding whether to believe what it claims. During the pandemic, Affinidi verified COVID-19 test results for travel, and ran straight into the problem. A traveler presents a test from a clinic in Denver, and a checkpoint in Singapore has no way to know which Denver clinics are real. The licensed lists exist, of banks, doctors, clinics, but they are scattered across jurisdictions and not queryable by software. Closing that gap, turning the world's registries into things a machine can check and trust, is the part of the stack that tends to get deferred while the field works on the rest, and the part Gore has put the most effort into.

Built and running

Its clearest expression is in open source, in work with the Linux Foundation to apply the stack to the one community that documents its own trust rules in public: the maintainers of open-source software, including the Linux kernel. 

Out of that came a model Gore describes as a seven-step pipeline for joining any community: a request, a manifest of what you have to prove, the evidence you gather, cryptographic verification, an evaluation that can loop in a human, a verdict, and a fresh credential issued by the outcome itself. To become a kernel maintainer you must be vouched for by existing maintainers; the pipeline turns that social rule into something a system can enforce and reissue. It runs, he notes, on policy tooling that already exists.

Using DIDComm, a protocol for agent-to-agent exchange, Gore demonstrated routing a message through a chain of intermediaries, each stripping one layer of encryption, so the recipient learns only the last hop and never the sender's location. He says it is among the first working implementations of multi-hop routing of its kind, and that the route lives in the identifier rather than behind a fixed web address, so an agent can change how it is reached as easily as rotating a key, and systems can be built without the brittle dependence on domains the rest of the agent stack still carries.

In one live demonstration, Gore logged into a third-party site using an agent running in another hemisphere, with no central server in the path, then deleted the underlying credential and watched the login fail on cue. Another demo placed an AI agent in a group chat with its own identifier and a zero-knowledge proof of itself, indistinguishable to the other members from a person. When pressed to reveal its secret, it could not, because it had been built not to know it.

The commercial case

With the tech functional, what does the consumer case look like? Gore made the case for enterprise liability. The argument that lands, he says, is "stop holding the honeypot." He points to a generation of healthcare startups rightfully wary of medical record liability, and the class of companies that, like Airbnb without hotels, succeed by never holding what they trade in, while holding the highest rate of customer consent to reach it. What powers this is provable consent, a cryptographic record a company can show an auditor, which contrasts against the prevailing standard that simply asserts a user clicked a terms-of-service box some years ago.

He may be early; he has been early before. But the agent economy will need a trust layer, and in Gore’s view the companies that build on one early will hold ground the latecomers cannot easily take back.