The Agent Stack and Standards_

I'm Shashank, and I'm presenting the standards in the agent space — in the next five minutes. The idea behind all of this: we built the internet for humans, not for agents. Now that more than half of web traffic is bots and agents,[2] we have to redo parts of the internet to support these new users. And we don't want to just build a horseless carriage — we want to actually build a car.[3]

“We built the internet so far for humans, not for agents. And now that we are seeing more than half the traffic actually by the bots and agents, we have to redo some parts of the internet to support these new users.”

A few things are already partly answered; I'll start with those and end with the open questions. Who are you, to an agent? Are you allowed to do this? Are you allowed to pay, and how would you pay? Did you do the work you were supposed to do? And how do you use tools, or communicate with other agents? Those are the questions — each with a standard attached.

“So who are you to an agent? And are you allowed to do this? Are you allowed to pay, and how would you pay? Did you do the work which you’re supposed to be doing? And how do you use tools or communicate with other agents?”

The first question is identity. This is a draft ERC — the slide's tagline is that an agent is a token plus its receipts[4] — where each agent has a single agent card exposing which endpoints it serves, which communication standards it speaks, its output formats. Two further registries plug into that card: reputation and validation. What exactly goes into a reputation is deliberately open-ended; what's standardized is how to index it and which common fields go on the card. All of it lives on-chain, immutably, so nobody can tamper with agents' identities. Many card fields will be filled in by the people who use the agents — today, they're still mostly empty.

Once the agent exists, it needs to go and do things — as simple as may I access this Reddit API for ten requests? Previously, all a site saw was a User-Agent string — and, as the slide puts it, the User-Agent header lies; signatures don't.[5] Web Bot Auth, driven by Cloudflare and others, has the agent cryptographically sign each request — I am this agent, this is my key, verify me per request — and publish its keys at a well-known path.[6] The agent that scrapes Reddit ten times a day is now an identity with a reputation to lose, adhering to a standard, rather than a string anyone can type.

What if the API is paywalled? For that there's x402, now under the Linux Foundation.[7] It's built on HTTP status 402: 404 is page-not-found; 402 is payment-not-done — reserved in 1997, finally being used in 2025 and 2026. The flow: you request the endpoint; it replies with the amount and the address to pay; you retry with a signed payment header; a facilitator verifies and settles it; the server opens the endpoint and returns a receipt.

Next: did the agent actually do what it promised — can we have proof of work delivered, even after payment? There's a proposal here that dmarz is a co-author on,[8] where the guarantee comes from attestation itself: the workload runs inside a TEE, its image is verifiable, and an on-chain verifier checks the chip-signed measurement — so a registry can say this address runs this exact code. The chip signs; the chain checks. These guarantees are interlinkable and composable — usable with the payment standards, and feeding the agent's reputation.

“If the workload is running inside the TEE, and, like, the image of it is verifiable, we would have an on-chain verifier, which is then providing a guarantee that work they promised to do is actually done.”

I'll go quickly on the last two. MCP is how big agents access tools today[9] — if you want your agent using Notion or Canva, MCP is the easiest path; the counterpoint you'll hear is "just give it a CLI." And A2A — started at Google, now Linux Foundation[10] — is signed communication between two agents: each publishes a card saying which services it offers, synchronous or asynchronous, on which ports, with standard request and payload formats, so agents can negotiate and participate with each other.

Those are the open standards. Every one of them has alternatives:[11] for access there's Web Bot Auth but also OAuth and Auth0-style approaches; identity has enterprise agent-ID schemes and DIDs; payments have the card networks' own protocols. The slide's landscape table says it plainly — every layer is contested — and its footnote captures the year: in 2026, agent standards got adult supervision — Linux Foundation, FIDO, IETF.

Now the open questions. Identity only defines the card — the agent's name and address. Reputation and trust are still open problems: how do you actually tell a trustworthy agent from an untrustworthy one, when no scoring standard says what a score means?[12] There's no easy way to declare what information you're willing to reveal to an agent, or how much agency you're willing to give it. Scoping agents correctly, and building trust and reputation on top of verification, looks like long work.

This is just my mental model: one common model, local, that I talk to the most and trust the most — and that model reveals information and interacts with the rest of the world through these standards. As the slide puts it: one model you trust; a thousand you don't have to. Thank you.

“It’s just like having one common model, like, which is local, which I talk to the most and I trust the most. Then that model is revealing information and interacting with the rest of the world through different standards.”

Every dotted-underline term above, in full. Links are given only where verified; specs are easy to find by name.