The Agentic Web Has an Identity Problem

01 / The Web Pushes Back

Capability is arriving faster than trust infrastructure.

The Verge reported on October 17 that major services are increasingly restricting agent access. Yelp permits agents through its paid data-licensing program. Delta is blocking agents from booking tickets. JPMorgan Chase and Charles Schwab have cited security concerns in restricting agents from customer accounts. Amazon continues to fight unauthorized shopping agents.

The legal boundary is unsettled too. In August, the Ninth Circuit overturned a preliminary injunction that had blocked Perplexity’s shopping agent from Amazon, concluding at that stage that Amazon was unlikely to establish unauthorized access under the Computer Fraud and Abuse Act. The underlying dispute continues. Reuters called the decision a significant test of whether users may delegate online activity to autonomous tools.

The tension is understandable on both sides.

Users increasingly expect software to act for them. Websites need to know whether the software is actually authorized, what it may do, and who is accountable when it crosses a boundary.

02 / Identity and Authority

Knowing which agent arrived is only half the problem.

Agent identity answers: Who is this software?

Delegated authority answers the harder questions:

Who sent it? What did that person authorize? For which resource? For how long? Within what dollar or operational limit? May the agent delegate again? Can the grant be revoked?

That distinction matters because possession of a credential should not automatically equal authority.

A browser cookie may prove that an agent has access to an authenticated session. It does not prove that the user intended the agent to buy a $4,000 airline ticket, transfer funds, disclose a health record, accept a contract, or delegate the task to another autonomous system.

Recent security incidents make that more than a theoretical concern. On October 16, Tencent disclosed unintended browsing behavior by evaluation agents and said it was tightening network access and monitoring. The lesson is straightforward: an agent capable of using a credential is not necessarily an agent authorized to use it in every way it can discover.

03 / The Standards Layer

The internet is starting to build the missing pieces.

Several efforts are now converging around the same architecture.

In August, Cloudflare introduced identity and wallet infrastructure for AI agents, explicitly framing the problem as allowing a business to determine who stands behind an agent and what spending limits its human owner has established.

In September, an IETF working-group draft for an AI Identity Management System described how OAuth, workload identity, and existing authorization standards can be applied to agent interactions.

Other current Internet-Drafts go further. A September architecture proposal says internet infrastructure for agents should distinguish agent identity from the human or organization it represents and support narrowly scoped, time-limited, value-limited delegation. An October draft proposes verifiable delegation chains so each agent in a multi-agent workflow can prove where its authority originated and demonstrate that no downstream hop expanded the authority it received. These are works in progress, not adopted IETF standards, but the direction is notable.

Payments are reaching the same conclusion. On October 8, the OpenID Foundation said agentic payments increasingly collapse the boundary between payments and identity, highlighting delegation lineage, verifiable intent, and agent identification in its response to EMVCo’s draft agentic-payments framework.

And existing agentic commerce systems already impose bounded authority. OpenAI and Stripe’s Agentic Commerce Protocol uses delegated payment credentials with explicit amounts and expiration rather than simply handing an agent an unrestricted payment instrument.

The emerging web does not need agents that impersonate humans better. It needs agents that can prove whose authority they carry.

04 / The MoonVault Theory

Human authority should sit above AI.

This is where the MoonVault theory connects.

BlackBoxx and MoonVault solve different problems.

BlackBoxx is intelligence and orchestration infrastructure. It coordinates models, agents, tools, workflows, data, policy, and execution.

MoonVault is trust, authority, custody, and continuity infrastructure. Its role is to establish the human root of authority behind those systems without making a single agent, device, cloud provider, or model vendor the ultimate source of permission.

The core principle is simple:

Possession of information never equals authority.

An agent may know Karl’s identity. It may know a password. It may hold a session. It may even possess a valid agent credential.

None of those facts, by themselves, should prove that Karl authorized the specific action now being attempted.

A MoonVault-style authority layer would instead bind delegation to human intent:

Human root of authority → signed intent → scoped delegation → agent identity → permitted action → expiration / limits → execution proof → revocation.

High-risk actions could require hardware-backed approval. Routine actions could receive short-lived capability grants. An agent could delegate to another agent only when the original grant permits it, and the authority could only narrow as it moves downstream.

That is materially different from putting a master credential inside an AI system and trusting the model not to misuse it.

It also gives the destination something useful to verify. A bank, retailer, airline, healthcare provider, or government service should not have to trust the agent’s claim that it represents the user. It should be able to verify the chain.

05 / The Stack That Follows

The agentic web needs both intelligence and a power of attorney.

The current web largely offers two identities: human user or bot.

That distinction is becoming obsolete.

The more useful architecture looks something like:

Human authority → delegated credential → agent identity → BlackBoxx policy / orchestration → tool or service → verified action → audit evidence

The destination can then decide whether to accept the agent based on evidence rather than browser fingerprints.

That creates a healthier equilibrium for both sides.

Users gain the ability to delegate work without giving autonomous software unlimited standing authority.

Businesses gain the ability to distinguish authorized customers’ agents from anonymous automation, impose transaction limits, reject unsupported capabilities, and preserve accountability.

Agents gain something they do not reliably have today: a legitimate identity on the internet.

This also changes how I think about MoonVault.

The long-term value is not simply storing identity or credentials. It is serving as the durable human authority layer behind increasingly autonomous digital systems: who you are, what you control, what may act for you, under what conditions, and how that authority survives device loss, provider failure, incapacity, or succession.

BlackBoxx can make agents more capable.

MoonVault can make their authority provable.

The web is beginning to discover that it needs both.