What Is AI Agent Identity? How Sites Know Your Agent Is Real

When you log in to a shop, the site knows it is you. When an AI agent visits that shop for you, the site faces a harder question. Is this a helpful assistant acting with your permission, a scraper, or a fraudster pretending to be you?

That question moved from technical forums to the news in September 2026, when Amazon blocked Meta’s Muse shopping agent. Amazon’s stated reason was that Muse “does not identify itself as an AI agent.” Since then, Google, ServiceNow and the big card networks have all announced ways to give agents a verifiable identity.

This explainer covers what AI agent identity means, the three main ways it works, what it does and does not protect, and what to check before you give any agent access to your accounts. It draws on standards drafts, company announcements and news reports opened on 19 October 2026.

What is AI agent identity?

AI agent identity answers three questions about an automated visitor. Which agent is this? On whose behalf is it acting? What is it allowed to do? A fourth question follows close behind: who is accountable if it goes wrong?

This differs from your own login. Your password or passkey proves you are you. An agent’s identity proves the software is genuine and links it to you, ideally with limits attached. A good system lets a site tell “Varun’s shopping agent, allowed to compare prices” apart from “an unknown bot hammering the checkout page”.

Picture a booking agent that checks hotel prices for you. With a verified identity, the hotel site can see that the visitor is a known agent, acting for a named customer, with permission to search but not to pay. The site can then serve prices quickly and still ask you to approve the booking.

Without it, an agent that drives a normal browser simply looks like you. That sounds convenient, but it means sites cannot tell your clicks from your agent’s clicks. If something goes wrong, nobody can easily show who did what.

Why AI agent identity is suddenly in the news

Several events landed within a few weeks of each other.

• Amazon and Meta Muse. Amazon blocked Meta’s Muse agent from 20 September 2026. Reports in TechRepublic and Search Engine Journal say Amazon cited Muse not identifying itself and concerns about credential handling. Meta’s own security documentation, as reported by TechRepublic, says Muse cannot see users’ passwords or payment methods and that users must approve purchases.
• Unidentified traffic. On 7 October, security firm Cequence said Muse traffic reached more than half of the customers it studied within two weeks, without identifying itself as an AI agent. This is Cequence’s own finding.
• Google. On 8 October, Google Cloud’s Thomas Kurian said of the new Gemini agent: “Every agent gets its own identity, cryptographically attested and governed like an employee, with least-privilege permissions.”
• ServiceNow. On 15 October, ServiceNow announced AI Passport, a signed credential for workplace agents. Computerworld reports that ServiceNow expects it by the end of 2026.

Each of these points to the same gap. Agents are already acting on the web, but there is no shared way for them to say who they are.

How websites recognise AI agents: signed requests

The most developed approach for the open web goes by the name Web Bot Auth. It lets an automated client sign each web request with a cryptographic key, using an existing internet standard called HTTP Message Signatures. The website can then check the signature against a public key that the agent’s operator publishes.

Think of it as a wax seal on a letter. Anyone can write “from ChatGPT” on an envelope, which is roughly what a browser’s user-agent text does. A seal that only the real sender can make is much harder to fake.

There is a real consumer example already. OpenAI’s help page on ChatGPT Work’s Cloud browser says it signs requests and publishes its keys at a fixed address on chatgpt.com. Our article on the ChatGPT cloud browser explains how that browser works.

Cloudflare, which sits in front of a large share of websites, updated its documentation on 8 October 2026 to say “Signed agents are now Verified”. To earn that label, a bot must identify itself honestly and must not behave abusively.

Status matters here. The current Web Bot Auth document is an IETF draft dated 26 June 2026, written by authors from Cloudflare and Google. It is “work in progress”, not a finished standard. Robots.txt, the old file that tells crawlers where not to go, does not solve this either, because a site can only name agents that announce themselves.

How payments verify agents: Know Your Agent

Banks already have “Know Your Customer” checks. The payments industry is now building the agent version, usually called Know Your Agent, or KYA.

In September 2026, Ant International, Mastercard and Visa announced a collaboration on an interoperable KYA framework, as reported by RTTNews. It focuses on tracing which company operates an agent, shared certification rules and ongoing transaction monitoring. Each network keeps its own checks. The partners say they will “explore” common principles, so this is an early-stage plan rather than a live product.

It builds on each company’s existing work:

• Visa’s Trusted Agent Protocol ties signatures to a specific merchant and purpose, for a limited time, so they cannot be reused. Visa says it is still “in the process of development and deployment”.
• Mastercard’s Verifiable Intent, announced in March 2026 with Google, creates a tamper-resistant record of what the user actually authorised. That record can help in a dispute.

We cover both in more depth in our guide to AI agent payments from Mastercard and Visa.

AI agent identity at work: IDs, passports and limits

Workplaces are further ahead, because companies already manage employee identities. Three examples show the direction.

• Microsoft Entra Agent ID is, in Microsoft’s words, generally available for managing agent identities and access. Some setup wizards remain in preview.
• Google’s Gemini agent gives each agent its own attested identity, passed along through standards such as OAuth. Google did not give a separate availability date for this feature. Our article on the Google Gemini agent has more on the product.
• ServiceNow AI Passport records an agent’s identity, permitted actions, reachable systems and accountable owner, and checks them while the agent runs.

A demo described by Tech Times shows why limits matter. An agent with a $25 refund limit could refund $18. When it tried to refund $40, the system blocked it and sent the case to a human.

What AI agent identity does and does not protect

Identity is useful, but it is narrow. It proves where an action came from and what the agent was allowed to do. It does not prove the action was a good idea.

AI agent identity can help with	AI agent identity cannot help with
Telling a genuine agent from an impostor	An agent that misreads your instructions
Showing who an agent acts for	Hidden instructions on a web page
Enforcing spending or action limits	A bad decision within the agent’s limits
Creating an audit trail for disputes	A site that blocks all agents anyway
Revoking one agent without changing your password	Weak security at the agent maker

The second row deserves attention. A signed, verified agent can still fall for text planted on a page, a risk called prompt injection. Identity tells a site who is visiting. It says nothing about whether the visitor has been fooled.

What happens when a site blocks your agent

You may see an error, a CAPTCHA you cannot pass through the agent, or a page that simply never loads. Some sites block unknown agents outright. Others only block certain actions, such as checkout. Cequence describes its own approach as “block the action, not the agent.”

If this happens, finish the task yourself rather than trying to get around the block. A shop’s terms of use may forbid automated access, and breaking them could put your account at risk. Expect more sites to set clear rules once AI agent identity standards settle.

How to check an agent before you give it access

Before you connect any agent to an account that holds money or personal data, ask these questions:

• Does it identify itself to websites, or does it pretend to be you?
• Where does it store your passwords or tokens, and can it see them?
• Does it ask for approval before purchases, messages or account changes?
• Can you set spending or action limits?
• Can you revoke its access in one place?
• Does it keep a log you can read later?

Our guide to AI agent permission settings shows where these controls live in the main assistants. For a wider view, see are AI agents safe?

Three layers of AI agent identity at a glance

The three approaches above work at different points in a task. This summary shows where each one sits and how mature it is as of October 2026.

Layer	Main example	What it proves	Status
Web requests	Web Bot Auth signatures	Which agent sent the request	IETF draft
Payments	Know Your Agent, Trusted Agent Protocol, Verifiable Intent	Who operates the agent and what the user approved	Early framework and pilots
Workplace systems	Entra Agent ID, Gemini agent identity, AI Passport	What an agent may access and who owns it	Mixed: some available, some due later

None of these layers talks to the others by default yet. A shopping trip could involve all three, which is why standards bodies are trying to link them.

What to watch next

The Web Bot Auth draft expires on 28 December 2026, so expect a revised version. Watch whether the card networks publish concrete KYA rules, and whether consumer agents follow ChatGPT Work’s cloud browser in signing their traffic. ServiceNow’s AI Passport is due by the end of the year. The open question is whether shops will reward identified agents with smoother access, or treat all agents with suspicion.

AI agent identity: FAQs

Sources

• IETF, “HTTP Message Signatures for automated traffic” (draft-meunier-webbotauth-httpsig-protocol-00, 26 June 2026)
• OpenAI Help Center, “ChatGPT Work’s Cloud browser allowlisting | OpenAI Help Center” (accessed 19 October 2026)
• Cloudflare Docs, “Verified bots · Cloudflare bot solutions docs” (8 October 2026)
• RTTNews, “Ant International, Mastercard, Visa Collaborate On Interoperable Know-Your-Agent Framework” (10 September 2026)
• Visa Developer, “Trusted Agent Protocol” (accessed 19 October 2026)
• Mastercard, “How Verifiable Intent builds trust in agentic AI commerce | Mastercard US” (5 March 2026)
• TechRepublic, “Amazon Blocks Meta’s Muse AI Agent From Shopping on Amazon.com Over Bot Access” (22 September 2026)
• Search Engine Journal, “Amazon Blocked Meta’s Muse, And Robots.txt Had Nothing To Say” (29 September 2026)
• Cequence, “Meta’s Muse Reached More Than Half of Customers Cequence Studied in Two Weeks Without Identifying Itself as an AI Agent” (7 October 2026)
• Google Cloud Blog, “Welcome to Gemini at Work 2026: Introducing the Gemini agent” (8 October 2026)
• Computerworld, “ServiceNow makes it easier to build AI agents, gives them verifiable identities” (15 October 2026)
• Tech Times, “ServiceNow Gives Enterprise AI Agents Cryptographic IDs to Enforce Limits at Runtime” (16 October 2026)
• Microsoft Learn, “What’s new in Microsoft Entra Agent ID | Microsoft Learn” (1 May 2026)