Giving agents an identity you can verify

A chatbot that answers questions is low stakes. An agent that issues refunds, edits records, or calls other agents is not. Once the actions are real, every one of them raises two questions. Who initiated this, and were they allowed to do it? Most agent stacks answer neither. The action just happens.

The model I keep coming back to is an envelope around every action, signed. It carries the action, the identity that requested it, and a signature. Nothing executes until it has been checked against policy. The idea is borrowed and openly so. Payments have request signing. Distributed systems have capability tokens. Both make authority explicit and checkable instead of implicit and ambient.

Policy-gating before execution is the other half. You cannot trust an agent to know it should not do something, so you put a gate in front of the action that evaluates it against rules a person can read and change. The agent proposes. The policy disposes. When something goes wrong you have a signed trail of what was attempted and why it was allowed or refused.

Adoption is the hard part, because none of this matters if it hurts to add. Drop-in middleware for MCP and A2A, plus thin SDKs, matter more here than the cryptography does. The security only happens if wiring it in is easier than skipping it. Make the safe path the default path.

We spent a decade learning to give services identity and least-privilege access. Agents are a new kind of caller and the same lesson applies. Mostly it means we stop pretending they are trustworthy by default.