Two weeks ago, I sat in a small conference room in Chengdu with a municipal data officer and three smart-contract developers, trying to explain why the identity layer of an autonomous agent matters more than the model running behind it. The officer kept returning to a single phrase: who signs? Not who codes, not who deploys, not who pays. Who signs. In a world where software increasingly acts on our behalf without asking permission each time, the signature is the only remaining trace of human intent. That question is precisely what the current debate over agent identity standards is really about, beneath all the countdown rhetoric and the language of administrative procedure. And the answer, uncomfortable as it is, has little to do with whether a particular draft expires in thirty-six days.
Let me explain why I think the industry is having the wrong conversation, and what a more honest one would sound like.
The Countdown That Means Nothing
The article framing this debate leads with a number. Thirty-six days until the industry's primary agent identity standard expires. The implication is crisis, urgency, a window closing on the entire ecosystem of autonomous software acting on behalf of human users. That framing is seductive and almost entirely misleading.
I have watched IETF drafts expire for two decades. It is, in the most literal sense, routine. Thousands of drafts lapse every year and are revived, revised, or quietly retired. The author of the piece in question actually admits this a few paragraphs in, then proceeds with the countdown anyway, because the countdown is the sell. What it obscures is the far more interesting question: why is a draft that nobody disputes on technical grounds, built on a decade of stable foundations, still sitting at revision minus four with no working group last call scheduled?
That question has an answer, and the answer is not administrative inertia.
The real story is not that a standard is expiring. It is that a standard is being captured while it is still in the cradle.
The protocol at the center of this debate, the one commonly called ID-JAG, is a remarkably sensible piece of engineering. It takes three components that have been proven in the OAuth ecosystem for more than ten years, the token exchange mechanism, the JWT authorization grant, and identity provider mediation, and combines them into a profile tailored to a genuine and sharp problem: how does software obtain authorization across applications without a human present to click consent?
That problem is real. I have audited enough systems in the past four years to know that the scaling bottleneck for autonomous agents is not model capability. It is authorization continuity. A single agent task that reads a message, updates a calendar, sends a notification, and writes to a customer relationship system crosses four trust boundaries. If each requires a human nod, the agent's value collapses to zero. The combination that ID-JAG proposes is the right answer to that problem, which is precisely why it deserves to become a standard, and precisely why its slow progress matters.
What We Are Actually Building
There is a temptation to treat identity protocols as plumbing, invisible infrastructure that either works or does not. I want to resist that temptation because I think it misreads what is at stake.
The classic choices for cross-application access are three. Static API keys, which are long-lived, unscoped, unauditable, and catastrophic the moment they leak. Three-legged OAuth, which requires the user to be present to approve, which agents by their nature are not. Or an identity provider brokered exchange, in which the trust already established through single sign-on is used to mint a short-lived, scoped, auditable credential that is then exchanged for a downstream access token. This third path is, in my judgment, the only one that scales to an economy of autonomous software, because it is the only one that anchors the audit trail to a human identity even when no human is present.
That sentence is worth pausing on. The reason it matters goes beyond engineering elegance. When an agent acts on your behalf, a legal question and a technical question converge. Who is responsible for what it did? What authority did it hold? When did that authority lapse? An identity protocol that answers these questions cleanly is not merely convenient infrastructure. It is the substrate on which liability, accountability, and trust become assignable.
I have written before about decentralized governance as emotional security, and I stand by that phrase, but I want to refine it here. Security is not a feeling. It is a structure that survives the moment you are not looking. The cleanest structure we have for machine agency is a credential that is short-lived, narrowly scoped, traceable to a human, and revocable at any moment. That is what good identity work delivers. And that is why I find the current conversation so frustrating.
The Risk Nobody Is Naming
Here is where the received narrative and my reading diverge most sharply. The conventional framing warns that companies are deploying agent identity infrastructure before the standard is settled, and that when the standard finally changes, those companies will face expensive rework. This story is tidy and, I think, largely backwards.
The conventional framing treats large vendors as the victims of standard instability. They are not. They are its beneficiaries, and in some cases its authors.
Consider the structure. The primary draft is authored by individuals embedded inside a major identity provider, one of whom also chairs the working group where that draft is being discussed. That is not a scandal. It is a structural fact, and it is the kind of fact that readers deserve to have stated plainly rather than left implicit. When the person who schedules the working group last call is the same person who wrote the specification, the standard's external credibility becomes a question that cannot be answered by the standard's own technical merits. Other players, particularly the largest identity platform in the enterprise market, have every incentive to stay on the sidelines rather than invest in a process whose outcome they cannot shape. The delay, in other words, may not be caused by institutional inertia. It may be caused by the fact that the standard is legible as one company's standard rather than the industry's.
My confidence in this reading is moderate, not absolute. I cannot prove that a major competitor made a deliberate decision to withhold participation. What I can say is that the absence of that competitor from the conversation is the single largest strategic gap in the way this debate is being framed, and that the gap is not being treated as a gap at all.
A second risk is more concrete and even less discussed. The maturity of the protocol's components varies wildly across layers. The underlying mechanisms are production-grade, stable for years. The enterprise purchasability is also production-grade, with contracts and service levels in place. But interoperability is still at the proof-of-concept stage, with one originating implementation and one enthusiastic follower, and no public evidence of independent cross-vendor testing. When enterprise buyers procure a protocol at the first two levels while ignoring the third, they are not choosing a standard. They are choosing an implementation that happens to look like a standard. Those are not the same thing, and the difference will surface on the day an enterprise tries to make two unrelated vendors talk to each other under a shared identity plane.
The missing number that haunts this entire conversation is simple. Of the twenty thousand customers of the initiating vendor, how many have actually enabled the capability? Of the twenty-five announced partners, how many are processing real production traffic? Shipped is not the same as adopted, and no one in this debate has offered a single figure that would let us distinguish the two.
The Application That Has to Trust the Token
There is a wooden-barrel dimension to this story that almost no one discusses, and I want to name it because it determines whether any of this works.
An identity protocol succeeds or fails not at the identity provider but at the receiving application. It is possible, and in fact easy, for a provider to mint a beautiful, short-lived, tightly scoped credential. It is much harder to persuade hundreds of downstream applications to validate that credential, map it to their local permission model, and handle revocation correctly. The announced partner list is dominated by identity vendors, edge platforms, and protocol implementers. Where are the applications? If the receiving side of the ecosystem is thin, then agents will only be able to hop between a handful of friendly services, and the value of the whole architecture will be bounded by that handful.
I have seen this pattern before in the digital asset world. In the early years of tokenized securities, everyone celebrated the issuance platforms. Nobody asked who would custody the assets. The business went where the custody was, and most of the issuance platforms faded. The same gravity applies here. The identity provider mints the credential, but the application must accept it, and acceptance is where adoption lives or dies.
There is also a quieter cost that no one in this debate has priced. Every credential exchange is a network round trip. If agents in a mature deployment initiate billions of cross-application calls per day, identity verification stops being invisible infrastructure and becomes one of the dominant sources of latency in the entire stack. That is a genuine infrastructure problem with a genuine beneficiary, the edge platforms that can perform verification close to the workload, and a genuine cost pressure, for the identity providers whose capacity must be refactored. I found it telling that the edge platform in the partner list is discussed as though it were a name on a slide. It is not. It is a company positioning itself at the exact place where the physics of the new workload will concentrate.
The Regulatory Catalyst Nobody Counted On
The most ambitious claim in the received narrative is that the commercial world is running ahead of the standard, and that this is dangerous. I want to interrogate that claim from a direction the article never takes.
What if the standard does not need the standards body to succeed?
Regulation is the most underdiscussed variable in this entire debate, and in my view it is the one most likely to determine the outcome. In Europe, the obligations of the artificial intelligence act and the operational resilience rules for financial institutions are converging on a single requirement: demonstrate who authorized what, when, and under which conditions. That is literally the capability this protocol was designed to provide. When a regulator asks a bank to produce an audit trail for an autonomous system's cross-application actions, the bank does not care whether a working group last call has been scheduled. It cares whether a system exists that can answer the question.
The implication is profound and it cuts against the article's entire thesis. If adoption is pulled by compliance rather than pushed by standardization, then the timeline of the standards body becomes largely irrelevant to the deployment curve. The commercial world would not be running ahead of the standard. It would be running on a parallel track, and the two tracks would only intersect when a specification becomes formal enough to be cited in an audit rather than merely implemented in software.
This reframing changes what investors should watch. The signal is not the scheduling of a working group last call. The signal is the first time a regulator, in a published enforcement decision or an examination finding, references an agent's authorization audit trail as a required artifact. When that happens, the protocol's adoption becomes demand-driven and irreversible, regardless of the pace of any committee.
And it changes what builders should fear. The fear is not that the specification will change. The fear is that a fragmented geography emerges, in which the self-hosted open-source path dominant in some regions and the commercial hosted path dominant in others produce two identity planes that cannot exchange credentials. I believe this is a plausible outcome, and it raises a question the debate has not touched: when an agent registered in one jurisdiction attempts to act on a system in another, where does the identity mediation legally sit? That question is harder than any technical objection and will not be answered by a revision number.
The Security Question We Skipped
Here is my deepest frustration with the way this story has been told. A debate about identity protocols, in which the word security appears almost exclusively as a synonym for regulatory certainty, has misnamed its subject.
The core innovation of the protocol is a short-lived, auditable, scoped credential replacing a long-lived static secret. That is a genuine security improvement, and I want to be clear that I believe it. But it introduces new attack surfaces, and those surfaces are not being discussed.
The most important is the revocation window. Suppose an agent is compromised through an injected instruction that persuades it to take an action its operator did not intend. The operator detects this within seconds. Can the revocation signal propagate to every downstream system that is currently holding a valid credential minted on that agent's behalf, before those credentials expire naturally? If the answer is no, then the entire value proposition of short-lived credentials collapses in exactly the scenario that matters most. A credential that can be revoked in the identity provider but remains valid for another four minutes across five downstream applications is not a security improvement over a static key. It is a static key with better marketing.
The second surface is delegation depth. If an agent can authorize a second agent, which can authorize a third, at what point does the chain of authority become so diffuse that no human can reconstruct who permitted what? This is the confused deputy problem reborn for an economy of autonomous software, and I have not seen a single public document that specifies a hard limit on chain depth.
The third surface is the identity provider itself. When a single intermediary becomes the trust anchor for an entire agent economy, it becomes a single point of both failure and surveillance. The audit trail that provides accountability is also a record of every machine action taken on behalf of every employee. Who can read it, where is it stored, and under whose jurisdiction does it fall? In a world where data residency rules in one region conflict with legal process in another, an audit trail that cannot be localized is a paper virtue.
I want to be honest about the limits of this analysis. These are risks that should be examined, not vulnerabilities that have been demonstrated. But the asymmetry of attention is striking. The administrative rhythm of a specification, which is visible, countable, and easy to dramatize, has consumed the entire conversation, while the engineering questions that will determine whether the system survives contact with an adversary have been left untouched. That is a media failure dressed as technical reporting, and it serves no one.
Who Gets to Sign
Let me return to the room in Chengdu.
The data officer's question was not about protocol versions. It was about legitimacy. Who signs, and by what right. Every architecture of machine agency eventually rests on an answer to that question, and the answer is never purely technical. It is institutional, it is political, and it is moral.
What I see in the current debate is an industry that has built an elegant answer to the technical question and has not yet confronted the institutional one. The protocol's mechanisms are sound. The audit trail anchored to human identity is the right design. But a standard whose authorship overlaps with its governance, whose adoption cannot be quantified, whose receiving applications are unaccounted for, and whose security properties under adversarial conditions remain unexamined is not yet a standard. It is a promising draft with an unusually good publicist.
The thirty-six-day countdown will pass. The draft will be refreshed or replaced. Somewhere, a revision number will increment, and nothing about the underlying situation will have changed. The genuine questions will still be open: whether the receiving side of the ecosystem can be built, whether the revocation window is short enough to matter, whether a regulator will pull adoption faster than a committee can push it, and whether the largest identity platform in the world will join the conversation or define its own.
What I want, and what I have wanted since I first started writing about governance as a matter of human dignity rather than technical efficiency, is a system in which the question who signed is always answerable. Not by a vendor. Not by a committee. By a person, named, with authority that can be traced and withdrawn.
The countdown is a distraction from that work. The work itself is the only thing worth counting.