# What Is AI Agent Identity? How Sites Know Your Agent Is Real

- Link: https://thejusgrow.com/what-is-ai-agent-identity/
- Published: 2026-10-21T08:20:40-07:00
- Author: Varun Sharma

AI agent identity: the short answer

AI agent identity is the proof a website, bank or employer uses to check which AI
agent is knocking, who it works for and what it is allowed to do. It usually takes
the form of a cryptographic signature or credential. As of October 2026 the standards
are still drafts, but companies are already shipping products built on them.

When you log in to a shop, the site knows it is you. When an AI agent visits that
shop for you, the site faces a harder question. Is this a helpful assistant acting
with your permission, a scraper, or a fraudster pretending to be you?

That question moved from technical forums to the news in September 2026, when Amazon
blocked Meta’s Muse shopping agent. Amazon’s stated reason was that Muse “does not
identify itself as an AI agent.” Since then, Google, ServiceNow and the big card
networks have all announced ways to give agents a verifiable identity.

This explainer covers what AI agent identity means, the three main ways it works,
what it does and does not protect, and what to check before you give any agent access
to your accounts. It draws on standards drafts, company announcements and news reports
opened on 19 October 2026.

## What is AI agent identity?

AI agent identity answers three questions about an automated visitor. Which agent
is this? On whose behalf is it acting? What is it allowed to do? A fourth question
follows close behind: who is accountable if it goes wrong?

![Laptop on a small round table showing a padlock icon and the word Secured, illustrating
AI agent identity checks on the web](https://thejusgrow.com/wp-content/uploads/2026/
10/ai-agent-identity-secured-laptop-1024x577.webp)

Signed web requests let a site check which agent is visiting before it trusts it.
Photo: Pexels

This differs from your own login. Your password or passkey proves you are you. An
agent’s identity proves the software is genuine and links it to you, ideally with
limits attached. A good system lets a site tell “Varun’s shopping agent, allowed
to compare prices” apart from “an unknown bot hammering the checkout page”.

Picture a booking agent that checks hotel prices for you. With a verified identity,
the hotel site can see that the visitor is a known agent, acting for a named customer,
with permission to search but not to pay. The site can then serve prices quickly
and still ask you to approve the booking.

Without it, an agent that drives a normal browser simply looks like you. That sounds
convenient, but it means sites cannot tell your clicks from your agent’s clicks.
If something goes wrong, nobody can easily show who did what.

## Why AI agent identity is suddenly in the news

Several events landed within a few weeks of each other.

 * **Amazon and Meta Muse.** Amazon blocked Meta’s Muse agent from 20 September 
   2026. Reports in TechRepublic and Search Engine Journal say Amazon cited Muse
   not identifying itself and concerns about credential handling. Meta’s own security
   documentation, as reported by TechRepublic, says Muse cannot see users’ passwords
   or payment methods and that users must approve purchases.
 * **Unidentified traffic.** On 7 October, security firm Cequence said Muse traffic
   reached more than half of the customers it studied within two weeks, without 
   identifying itself as an AI agent. This is Cequence’s own finding.
 * **Google.** On 8 October, Google Cloud’s Thomas Kurian said of the new Gemini
   agent: “Every agent gets its own identity, cryptographically attested and governed
   like an employee, with least-privilege permissions.”
 * **ServiceNow.** On 15 October, ServiceNow announced AI Passport, a signed credential
   for workplace agents. Computerworld reports that ServiceNow expects it by the
   end of 2026.

Each of these points to the same gap. Agents are already acting on the web, but 
there is no shared way for them to say who they are.

## How websites recognise AI agents: signed requests

The most developed approach for the open web goes by the name Web Bot Auth. It lets
an automated client sign each web request with a cryptographic key, using an existing
internet standard called HTTP Message Signatures. The website can then check the
signature against a public key that the agent’s operator publishes.

Think of it as a wax seal on a letter. Anyone can write “from ChatGPT” on an envelope,
which is roughly what a browser’s user-agent text does. A seal that only the real
sender can make is much harder to fake.

There is a real consumer example already. OpenAI’s help page on [ChatGPT Work’s Cloud browser](https://help-lb.openai.com/en/articles/11845367-chatgpt-works-cloud-browser-allowlisting)
says it signs requests and publishes its keys at a fixed address on chatgpt.com.
Our article on the [ChatGPT cloud browser](https://thejusgrow.com/chatgpt-cloud-browser/)
explains how that browser works.

Cloudflare, which sits in front of a large share of websites, updated its documentation
on 8 October 2026 to say “Signed agents are now Verified”. To earn that label, a
bot must identify itself honestly and must not behave abusively.

Status matters here. The current Web Bot Auth document is an IETF draft dated 26
June 2026, written by authors from Cloudflare and Google. It is “work in progress”,
not a finished standard. Robots.txt, the old file that tells crawlers where not 
to go, does not solve this either, because a site can only name agents that announce
themselves.

## How payments verify agents: Know Your Agent

Banks already have “Know Your Customer” checks. The payments industry is now building
the agent version, usually called Know Your Agent, or KYA.

![Hand holding a smartphone over a card payment terminal on a wooden counter](https://
thejusgrow.com/wp-content/uploads/2026/10/ai-agent-identity-phone-payment-1024x683.
webp)

Card networks are building Know Your Agent checks for payments that AI agents start
for you. Photo: Pexels

In September 2026, Ant International, Mastercard and Visa announced a collaboration
on an interoperable KYA framework, as reported by RTTNews. It focuses on tracing
which company operates an agent, shared certification rules and ongoing transaction
monitoring. Each network keeps its own checks. The partners say they will “explore”
common principles, so this is an early-stage plan rather than a live product.

It builds on each company’s existing work:

 * **Visa’s Trusted Agent Protocol** ties signatures to a specific merchant and 
   purpose, for a limited time, so they cannot be reused. Visa says it is still “
   in the process of development and deployment”.
 * **Mastercard’s Verifiable Intent**, announced in March 2026 with Google, creates
   a tamper-resistant record of what the user actually authorised. That record can
   help in a dispute.

We cover both in more depth in our guide to [AI agent payments from Mastercard and Visa](https://thejusgrow.com/ai-agent-payments-mastercard-visa/).

## AI agent identity at work: IDs, passports and limits

Workplaces are further ahead, because companies already manage employee identities.
Three examples show the direction.

 * **Microsoft Entra Agent ID** is, in Microsoft’s words, generally available for
   managing agent identities and access. Some setup wizards remain in preview.
 * **Google’s Gemini agent** gives each agent its own attested identity, passed 
   along through standards such as OAuth. Google did not give a separate availability
   date for this feature. Our article on the [Google Gemini agent](https://thejusgrow.com/google-gemini-agent/)
   has more on the product.
 * **ServiceNow AI Passport** records an agent’s identity, permitted actions, reachable
   systems and accountable owner, and checks them while the agent runs.

A demo described by Tech Times shows why limits matter. An agent with a $25 refund
limit could refund $18. When it tried to refund $40, the system blocked it and sent
the case to a human.

## What AI agent identity does and does not protect

Identity is useful, but it is narrow. It proves where an action came from and what
the agent was allowed to do. It does not prove the action was a good idea.

| AI agent identity can help with | AI agent identity cannot help with | 
| Telling a genuine agent from an impostor | An agent that misreads your instructions | 
| Showing who an agent acts for | Hidden instructions on a web page | 
| Enforcing spending or action limits | A bad decision within the agent’s limits | 
| Creating an audit trail for disputes | A site that blocks all agents anyway | 
| Revoking one agent without changing your password | Weak security at the agent maker |

The second row deserves attention. A signed, verified agent can still fall for text
planted on a page, a risk called [prompt injection](https://thejusgrow.com/what-is-prompt-injection/).
Identity tells a site who is visiting. It says nothing about whether the visitor
has been fooled.

## What happens when a site blocks your agent

You may see an error, a CAPTCHA you cannot pass through the agent, or a page that
simply never loads. Some sites block unknown agents outright. Others only block 
certain actions, such as checkout. Cequence describes its own approach as “block
the action, not the agent.”

If this happens, finish the task yourself rather than trying to get around the block.
A shop’s terms of use may forbid automated access, and breaking them could put your
account at risk. Expect more sites to set clear rules once AI agent identity standards
settle.

## How to check an agent before you give it access

Before you connect any agent to an account that holds money or personal data, ask
these questions:

 * Does it identify itself to websites, or does it pretend to be you?
 * Where does it store your passwords or tokens, and can it see them?
 * Does it ask for approval before purchases, messages or account changes?
 * Can you set spending or action limits?
 * Can you revoke its access in one place?
 * Does it keep a log you can read later?

Our guide to [AI agent permission settings](https://thejusgrow.com/ai-agent-permission-settings/)
shows where these controls live in the main assistants. For a wider view, see [are AI agents safe?](https://thejusgrow.com/are-ai-agents-safe/)

## Three layers of AI agent identity at a glance

The three approaches above work at different points in a task. This summary shows
where each one sits and how mature it is as of October 2026.

| Layer | Main example | What it proves | Status | 
| Web requests | Web Bot Auth signatures | Which agent sent the request | IETF draft | 
| Payments | Know Your Agent, Trusted Agent Protocol, Verifiable Intent | Who operates the agent and what the user approved | Early framework and pilots | 
| Workplace systems | Entra Agent ID, Gemini agent identity, AI Passport | What an agent may access and who owns it | Mixed: some available, some due later |

None of these layers talks to the others by default yet. A shopping trip could involve
all three, which is why standards bodies are trying to link them.

## What to watch next

The Web Bot Auth draft expires on 28 December 2026, so expect a revised version.
Watch whether the card networks publish concrete KYA rules, and whether consumer
agents follow ChatGPT Work’s cloud browser in signing their traffic. ServiceNow’s
AI Passport is due by the end of the year. The open question is whether shops will
reward identified agents with smoother access, or treat all agents with suspicion.

## AI agent identity: FAQs

**Is AI agent identity the same as KYC?**

Not quite. Know Your Customer checks a person. AI agent identity checks the software
acting for that person, including who runs it and what it may do. Payment networks
call their version Know Your Agent.

**Does ChatGPT identify itself when it browses for me?**

OpenAI says ChatGPT Work’s Cloud browser signs its web requests using Web Bot Auth
and publishes its keys on chatgpt.com. That applies to the cloud browser described
in OpenAI’s help page.

**Is Know Your Agent live yet?**

No. In September 2026 Ant International, Mastercard and Visa said they would explore
common principles for an interoperable framework. The partners have named no consumer
feature or timeline.

**Does agent identity stop prompt injection?**

No. Identity proves who sent a request. A verified agent can still follow hidden
instructions planted on a web page, so approvals and limits still matter.

## Sources

 * [IETF, “HTTP Message Signatures for automated traffic” (draft-meunier-webbotauth-httpsig-protocol-00, 26 June 2026)](https://www.ietf.org/archive/id/draft-meunier-webbotauth-httpsig-protocol-00.html)
 * [OpenAI Help Center, “ChatGPT Work’s Cloud browser allowlisting | OpenAI Help Center” (accessed 19 October 2026)](https://help-lb.openai.com/en/articles/11845367-chatgpt-works-cloud-browser-allowlisting)
 * [Cloudflare Docs, “Verified bots · Cloudflare bot solutions docs” (8 October 2026)](https://developers.cloudflare.com/bots/concepts/bot/signed-agents/policy/)
 * [RTTNews, “Ant International, Mastercard, Visa Collaborate On Interoperable Know-Your-Agent Framework” (10 September 2026)](https://www.rttnews.com/3689826/ant-international-mastercard-visa-collaborate-on-interoperable-know-your-agent-framework.aspx)
 * [Visa Developer, “Trusted Agent Protocol” (accessed 19 October 2026)](https://developer.visa.com/capabilities/trusted-agent-protocol/overview)
 * [Mastercard, “How Verifiable Intent builds trust in agentic AI commerce | Mastercard US” (5 March 2026)](https://www.mastercard.com/us/en/news-and-trends/stories/2026/verifiable-intent.html)
 * [TechRepublic, “Amazon Blocks Meta’s Muse AI Agent From Shopping on Amazon.com Over Bot Access” (22 September 2026)](https://techrepublic.com/article/news-amazon-blocks-meta-muse)
 * [Search Engine Journal, “Amazon Blocked Meta’s Muse, And Robots.txt Had Nothing To Say” (29 September 2026)](https://searchenginejournal.com/amazon-blocked-metas-muse-and-robots-txt-had-nothing-to-say/590494)
 * [Cequence, “Meta’s Muse Reached More Than Half of Customers Cequence Studied in Two Weeks Without Identifying Itself as an AI Agent” (7 October 2026)](https://www.cequence.ai/news/cequence-launches-agent-trust)
 * [Google Cloud Blog, “Welcome to Gemini at Work 2026: Introducing the Gemini agent” (8 October 2026)](https://cloud.google.com/blog/products/ai-machine-learning/welcome-to-gemini-at-work-2026)
 * [Computerworld, “ServiceNow makes it easier to build AI agents, gives them verifiable identities” (15 October 2026)](https://www.computerworld.com/article/4235892/servicenow-makes-it-easier-to-build-ai-agents-gives-them-verifiable-identities-3.html)
 * [Tech Times, “ServiceNow Gives Enterprise AI Agents Cryptographic IDs to Enforce Limits at Runtime” (16 October 2026)](https://www.techtimes.com/articles/329122/20261016/servicenow-gives-enterprise-ai-agents-cryptographic-ids-enforce-limits-runtime.htm)
 * [Microsoft Learn, “What’s new in Microsoft Entra Agent ID | Microsoft Learn” (1 May 2026)](https://learn.microsoft.com/en-us/entra/agent-id/whats-new-agent-id)