Two authorities are moving to require that AI agents carry verifiable identity, and five vendors launched products in one week claiming to supply it. Every credential on offer is scoped to one vendor's tenant or one company's controller, which is precisely what an independent verification requirement rules out.
The week of 1 September 2026 produced a legislative proposal, a payments protocol leak and five product launches that all used the same word. The word was identity. Two authorities are now moving to require that AI agents carry verifiable identity: the Stop Rogue AI Act introduced in the U.S. House by Representatives Josh Gottheimer and Mike Lawler, and the agent registry reported as part of the National Payments Corporation of India's Unified Agentic Protocol. This report asks one question about both. Can the requirement be met by anything a buyer can purchase today?
The answer is no, and the reason is structural rather than a matter of product maturity. Every credential on offer is scoped to one vendor's tenant or one company's controller. The mandates are written in cross-organisational terms. A federal agency asking a contractor to prove which agent took an action is asking a question that crosses an organisational boundary, and every identifier in this market stops at that boundary. The incident behind the bill makes the point better than the bill does: for five days in July 2026, Hugging Face could see 17,600 attacker actions and could not identify the actor, because the agent had crossed from one company's estate into another's.
Two evidentiary problems shape the analysis and both are stated up front rather than buried. The bill has no publicly retrievable text, so the clause-level timetable every trade summary repeats traces to a single reprinted article rather than to a source anyone can check. The NPCI registry has no primary source at all, resting on a wire report sourced to three people who could not be named while NPCI declined to comment. Where a vendor names a mechanism in its own documentation, that is recorded as fact. Where a press release asserts a security property without naming one, it stays a vendor claim no matter how many outlets repeated it.
Three things are in scope and everything else is deliberately excluded: the agent inventory, naming and cryptographic verification provisions of the Stop Rogue AI Act as its sponsors describe them, the agent registry reported as part of NPCI's Unified Agentic Protocol, and the identity claims made by endpoint, identity and desktop governance vendors between 1 and 10 September 2026. No third-party estimate appears anywhere, because the only research-firm figures on agent population trace back to vendors with a reason to make them large.
The Microsoft Learn page for Entra agent identities states that agent identities "don't have credentials of their own" and authenticate only through federated identity credentials issued by an agent identity blueprint. The blueprint is the object that holds the certificates, keys and secrets. The agent is a service principal that a credential-holding template is authorised to impersonate. That is a delegation model. It is good engineering, because a compromised agent has nothing local to steal, and it is a different thing from an identity the agent can prove on its own.
The same documentation states that agent identities "can only be issued tokens in the Microsoft Entra tenant where they're created" and "can't access resources or APIs in other tenants." Blueprints can be multitenant and create tenant-local identities elsewhere, which moves the template rather than the proof. So the answer to "is this agent what it claims to be" is "ask Entra." That is a single-provider assertion, which is the exact construction the bill's reported language singles out as insufficient.
The engineering post introducing agentdesktop states that the client identifier in its short-lived token is "an asserted client label" rather than cryptographic proof, and that "another process with access to the same local user boundary could request a different allowed label." The post names SPIFFE identity documents as future work for process attestation. Device and user are cryptographically bound; the agent is not. A vendor writing that down on launch day is more useful than any competitor's assessment of it, and the same gap exists in every competitor that stayed quiet.
The one-year deadline for organizational inventory and verification requirements, and the eighteen-month FAR Council deadline running from publication of the NIST standards, appear in an Inside AI Policy piece reprinted on Representative Lawler's website. The sponsors' own release contains four capability bullets and no dates. Searches of Congress.gov and both sponsors' offices returned no bill number and no legislative text at the time of writing. A reader budgeting against a date should know the date was read off a reporter's summary of a document nobody outside the sponsors' offices has seen.
SPIFFE issues cryptographically verifiable identifiers, and the trust domain inside a SPIFFE identifier is self-asserted, with no registry above it, no allocation authority and no revocation mechanism in the specification. Two organisations can both run spiffe://payments and nothing objects. OAuth client credentials identify a registered client, unique to one authorization server, rather than a running process. The Model Context Protocol authorization specification makes authorization optional, casts the agent as an OAuth client acting for a human resource owner, and encourages dynamic client registration, which produces identifiers that are ephemeral by design. X.509 is the only one of the four with a naming hierarchy and a revocation path, and it says nothing about agents.
Scored against the four capabilities in the sponsors' release, which are find and track, verify who built and operates, monitor in real time, and allow or deny or revoke, Microsoft, CrowdStrike, Okta, Solo.io and IBM all deliver most of what is asked within the estate they control. Not one of them lets a second organisation verify an agent's identity without asking the issuer. The mandates are written in cross-organisational terms and the products are built in single-tenant terms, and the distance between those two sentences is the whole report.
A bottom-up model for a mid-size prime with roughly 2,000 staff and 400 agent instances puts one-time work at about 745,600 dollars and annual running cost at about 538,000 dollars, at 185 dollars an hour loaded for engineering and 240 for compliance. Credential issuance is the largest single item at 222,000 dollars and the item most likely to be wasted, because it has to be rebuilt when a naming scheme arrives. The Department of Defense priced a CMMC third-party assessment at 101,752 dollars and explicitly excluded the cost of implementing the underlying controls. For agent identity nothing is already there, so a contractor budgeting from the published assessment figure will be short by roughly a factor of seven.
A scheme registry can compel a naming convention across hundreds of participants in a way no enterprise vendor can, and NPCI processed 24.51 billion UPI transactions worth 29.82 trillion rupees in August 2026 across roughly 700 live banks. If the Unified Agentic Protocol ships with a mandatory agent identifier, that identifier becomes the first namespace with real enforcement behind it, defined by a payments body rather than a standards body. The counterweight is UPI Circle, NPCI's existing delegated payments design, which enforces spending limits against a named human principal and needs a mandate ledger rather than cryptographic agent identity at all.
Five vendors made agent identity claims in the first ten days of September 2026. Read against their own documentation rather than their launch copy, they divide into products that manage an agent's access and products that prove an agent's identity, and the second group is smaller than the press coverage suggests. The column that decides the whole category is the last one: can a party outside the issuing tenant or controller verify this agent without asking the issuer. Every row answers no, and a reader who disagrees should name the product that breaks the pattern.
Creates a service principal with an object ID, display name, human sponsor and originating blueprint. The agent holds nothing; the blueprint holds the certificates, keys and secrets. Access packages, sponsor transfer through lifecycle workflows, blueprint-level Conditional Access and one-action disable of every agent from a blueprint are all real and well developed, behind a Microsoft 365 E7 licence or Agent 365 paired with Entra P1. Tokens issue only in the creating tenant.
Verifiable outside the issuer: no
The Falcon sensor discovers known and shadow agents on Windows and macOS and builds a live inventory of running and dormant agents with who deployed them, which finds agents no directory knows about. A 2 September blog says the Agentic Identity Provider gives each agent "a cryptographically verifiable identity" while naming no credential format, no mechanism and no standard, citing neither X.509 nor SPIFFE nor OpenID Connect. A buyer cannot test that claim and an auditor cannot either.
Verifiable outside the issuer: not disclosed
Generally available with an agent registry, identity-based policy controls, ephemeral per-request authorization and SPIFFE identity document issuance through the PKI and SPIFFE secrets engines in Vault Enterprise. SPIFFE identity documents are X.509 certificates, so the cryptography is published and testable. The limit is the trust domain: verification works for anyone holding the bundle, and bundles are distributed bilaterally by administrators. The same piece asserts a 100 to 1 machine-to-human identity ratio and cites no source for it.
Verifiable outside the issuer: within a federated trust domain only
Registers agents in Universal Directory as first-class identities with assigned human owners, issues short-lived credentials rather than long-lived tokens, and provides a kill switch with an audit trail. The Agent Gateway for securing tool calls is described as generally available. Cross App Access, the proposed OAuth extension for agent access across applications, carries a forward-looking disclaimer that features may not be delivered on time or at all. No credential format is specified on the page and no pricing is given.
Verifiable outside the issuer: no, Cross App Access is proposed
Released under Apache 2.0 on 3 September 2026. A daemon generates a private device key locally, stores it in the OS credential manager and submits a certificate signing request; the controller validates the user's SSO identity, assigns a device identifier and returns a client certificate, then issues short-lived JWTs naming the SSO subject, the device identifier and an allowed client label. Provider API keys stay at the gateway. The inventory is deliberately secret-minimizing, collecting no MCP command arguments, environment variables, HTTP headers or skill bodies.
Verifiable outside the issuer: no, the client label is asserted
The most consequential document in this market is one almost nobody is reading. NIST's National Cybersecurity Center of Excellence published a concept paper, "Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization," on 5 February 2026, with comments closed on 2 April. It predates the bill by seven months, asks the same questions the bill would direct NIST to answer, and names a laboratory demonstration built from commercially available technologies as the deliverable. The practical implication is that the reference architecture will be assembled from whichever vendors turn up to the NCCoE lab, which is how a build project becomes a de facto standard. Vendors who ignore it and lobby the bill are optimising the wrong process.
For federal contractors facing FAR revisions, the sequencing follows from the shape of the cost model rather than its total. Inventory and tamper-evident logging are required under every plausible version of the standard, they produce operational value immediately, and no naming decision invalidates them. Spend the 266,000 dollars there and defer the 222,000 on credential issuance until the NCCoE demonstration names its components, because a contractor who builds a private agent PKI in 2026 is likely to rebuild it. Write the system security plan so the identity control is described as planned with a dependency on the NIST publication, which is defensible while the standard does not exist and indefensible after it does. Treat any vendor offering FAR readiness for agent identity in 2026 as selling against a document that has not been written, and ask in writing which specification their credential conforms to.
For CISOs inventorying non-human identities, your agent inventory and your service-account inventory are different lists, and merging them costs you the thing you need. Service accounts are enumerable from the directory. Agents are not, because a developer running an agent harness on a laptop creates no directory object, which is why an endpoint sensor finds agents an identity platform cannot see. Run discovery from the endpoint, reconcile it against the directory, and treat the difference as the number that matters. Then accept the harder point: for agents your people run locally, the strongest claim available today binds the device and the human, and your detection strategy should assume the agent identifier is self-asserted.
For identity platform product leaders, the competitive question for the next eighteen months is whether your credential can be verified by someone who does not use your product. Every vendor here has built a good single-tenant system, and the mandate wording is openly hostile to single-provider assertions. The first platform to ship cross-organisational agent verification with a published format will define the category, and the cheapest path there is X.509 with a real naming hierarchy rather than a proprietary token. The other move worth making this quarter is showing up at the NCCoE with working code. For payment scheme compliance officers, plan against NPCI's on-the-record statement that authentication and settlement stay deterministic and auditable, rather than against the registry reporting sourced to nobody. The mandate ledger and the dispute path are the work, agent-held keys probably are not, and an agent-initiated debit that a customer disputes has no existing liability rule.
The report closes with four scenarios on a two-year horizon and the tripwires that resolve them. The probabilities are subjective and are the least reliable content in it. The tripwires are the usable part, because anyone can watch them. A bill number and text published on Congress.gov would let the clause-level timetable finally be checked against its source. An NCCoE participant list or practice-guide draft naming commercial identity platforms would mean the reference architecture's components have effectively been chosen. CrowdStrike documenting the Agentic Identity Provider credential format would make the strongest identity claim in the market testable. Solo.io shipping SPIFFE process attestation in agentdesktop would put agent-level proof in an open implementation first. An NPCI circular specifying an agent identifier format would mean a namespace with enforcement behind it exists. And Entra agent identities becoming verifiable cross-tenant would weaken the structural objection this report is built on, which is the change that would move my position fastest.
This isn't a vendor summary. Every sentence is labeled by what stands behind it: verified fact, vendor claim, third-party estimate, my assessment, hypothesis, or scenario. Sources are numbered and clickable. Forward-looking sections use scenarios with observable tripwires, not forecasts. It's the same method behind every market assessment I write.
Twenty-six pages, built from public sources with no client brief and no interviews. Read it in the browser or take the PDF.
Each report here answers a real question, directed and researched against public sources and evaluated against a stated assumption, then delivered as Word and PDF. If you're weighing a platform, sizing a category, or defending a number to a board, tell me the decision behind it and I'll tell you honestly whether a report is the right tool.
Commission an assessment