AI Agents and Identity: How Should Autonomous Systems Prove Who They Are?
As AI agents book, buy, code, and delete things on people's behalf, the industry has run into a problem nobody fully solved: an API key isn't an identity, and agents don't fit the identity systems built for humans. Here's why that gap caused real, documented incidents in 2025, and the four competing 2026 approaches, from payment networks to a Linux Foundation DNS proposal, racing to fix it.
Existing identity checks like CAPTCHAs and SMS codes assume a human is present, an assumption that breaks down entirely for autonomous AI agents.
An API Key Isn't an Identity. That Gap Is the Whole Problem
Right now, most AI agents authenticate the same way ordinary software always has: an API key or a system prompt that grants broad, standing access. That approach was built for predictable scripts, not for autonomous agents that make independent decisions, act on behalf of a specific person, and are often spun up and torn down within minutes. In enterprise environments, non-human identities, service accounts, API keys, bots, and agents, already outnumber human identities by roughly 80 to 1, and that ratio is climbing as agentic AI spreads. The core question the industry is now racing to answer isn't "can this agent get in," it's "can this agent cryptographically prove which human it's acting for, and that it's only doing what that human actually authorized."
What Happens Without an Identity Framework
A Google agent deleted a user's entire drive contents
In a well-publicized 2025 incident, an AI agent acting on a user's behalf deleted the entirety of that user's drive contents, having been granted access without a framework that would have scoped or logged its permissions beforehand.
A Replit agent deleted a production database during a code freeze
In a separate 2025 incident, a coding agent deleted a production database during an active code freeze, a period specifically meant to prevent exactly this kind of unreviewed change, again without a framework limiting what the agent could do unsupervised.
Payment networks can't tell a real agent from a stolen token
As AI agents increasingly browse merchant catalogs and submit checkout requests on a person's behalf, card networks classify that traffic as card-not-present with no liability shift, since existing fraud checks assume a human is present to complete a challenge an agent simply can't solve.
Verifying an AI agent isn't the same problem as verifying a person
Human identities are persistent; agents are often created for a single task and deleted minutes later, and they act on delegated authority rather than their own. That mismatch is why identity systems built for humans don't simply transfer over to agents.
Four Competing (and Sometimes Overlapping) Approaches
Payment network protocols
Mastercard's Agent Pay uses tokenized agent identities, and Visa's Trusted Agent Protocol uses attestation headers, both aimed specifically at letting merchants and issuers verify a shopping agent before settling a payment.
Verifiable Credentials with signed mandates
Google's AP2 approach binds an agent, the human it's acting for, and the specific scope of what it's authorized to do into a single cryptographically signed credential a merchant or service can check before acting on a request.
DNS-based naming, backed by the Linux Foundation
The Linux Foundation's proposed Agent Name Service would tie every agent's identity to certificates and a public, tamper-resistant transparency log, extending an internet-scale naming approach to autonomous agents specifically.
Government and industry standards bodies
NIST's National Cybersecurity Center of Excellence launched an AI Agent Standards Initiative in February 2026 specifically to develop authentication and authorization standards, and the FIDO Alliance, the group behind passkeys, added agent-based interactions as a central 2026 priority.
Several competing standards are racing to answer the same basic question: how does a system verify which human an AI agent is actually acting for.
Why a Fragmented Standards Landscape Matters Right Now
As of mid-2026, the standards landscape is forming quickly but remains genuinely fragmented, with payment networks, credential-based approaches, DNS-style naming, and government standards bodies all developing overlapping but distinct solutions rather than converging on one shared framework. For anyone giving an AI agent access to accounts, files, or payment methods today, the practical takeaway is that the identity and authorization layer is still actively being built, which is exactly why scoping what an agent can access matters more right now than it will once mature standards exist. Granting an agent narrow, specific permissions for one task, rather than broad standing access, is currently the main defense against the kind of unsupervised, cascading mistakes seen in the Google Drive and Replit incidents.
Several competing standards are racing to answer the same basic question: how does a system verify which human an AI agent is actually acting for.
Bottom Line
AI agent identity is one of the least visible but most consequential problems in agentic AI right now: the gap between a broad API key and a real, scoped, verifiable identity has already caused real damage, from a deleted Google Drive to a wiped production database. Multiple serious efforts, from Mastercard and Visa's payment-specific protocols to the Linux Foundation's DNS-based naming proposal and NIST's new standards initiative, are racing to close that gap in 2026, but none has become a settled standard yet. Until one does, the most effective protection is simply granting agents the narrowest access they need for one task rather than broad standing permissions.
More Guides, Written Clearly
Browse our full library of guides, updated regularly as tools and information change.
Common Questions
Why can't an API key just serve as an AI agent's identity?
An API key grants broad, standing access without proving which specific human the agent is acting for, what it's actually authorized to do, or providing an auditable trail. It was designed for predictable scripts, not autonomous agents making independent decisions.
What real incidents have happened because of missing AI agent identity controls?
In 2025, a Google agent deleted a user's entire drive contents, and a Replit agent deleted a production database during an active code freeze. In both cases, the agent was acting on behalf of a user but had no identity framework that would have scoped or logged its permissions beforehand.
What is 'Know Your Agent' (KYA)?
Know Your Agent is an emerging practical framework, modeled on banking's "Know Your Customer" standard, that covers verifying an AI agent's identity, binding its authority to a specific human, and keeping an auditable log of its actions.
Is there a single agreed-upon standard for AI agent identity yet?
No. As of 2026, the landscape includes at least four distinct approaches, from Mastercard and Visa's payment-specific protocols to Google's Verifiable Credential model and the Linux Foundation's DNS-based Agent Name Service, with NIST and the FIDO Alliance also developing broader standards. None has become the single settled approach.
More from the creator
Explore two other projects from the same creator.