The Delegation Gap
The session layer is hardening. The accountability layer is still missing.
An AI agent submits a contract on your behalf. The counterparty accepts it. A month later, there’s a dispute — you didn’t authorize that clause. Your agent did.
Who signed the contract? Legally, on paper, you did. Technically, an autonomous process did. Verifiably, at the moment of submission? Nobody can say.
This is not a legal thought experiment. It’s the default state of every serious production agent deployment right now. The tools exist. The workflows are live. The accountability infrastructure is not.
The agentic web is coalescing around three protocols that get described, casually, as identity layers: Anthropic’s Model Context Protocol (MCP), Google’s Agent-to-Agent protocol (A2A), and IBM’s Agent Communication Protocol (ACP). Each has a real implementation and growing adoption. None of them answers the question the counterparty actually needs answered.
That question is: which verified human delegated this action, and is that delegation still valid right now?
What the three protocols actually do
Let’s be precise, because imprecision is doing real damage in the space.
MCP standardizes how a language model connects to external tools and data sources. A client talks to an MCP server, and the server exposes capabilities the model can invoke. MCP solves capability discovery and invocation. It says nothing about who the model is operating on behalf of.¹
A2A is Google’s specification for agents to communicate with other agents across organizational boundaries. Two agents speak A2A to each other, negotiate tasks, pass state, hand off work. A2A solves inter-agent coordination. It says nothing about whether the humans behind either agent are real, verified, or still delegating.²
ACP is IBM’s protocol for agent orchestration — similar motivation to A2A, different implementation, same layer. Agents talk to agents through a standardized envelope. ACP solves the plumbing. It says nothing about the principals.³
All three operate at the session and access layer. They answer: what is this agent allowed to talk to, and in what format? Those are real problems and the protocols solve them well enough to build on.
The question the world outside the agent cares about — is there a real human being with real stakes accountable for this action — lives one layer up. That layer is missing.
The principal-registration illusion
The clearest attempt to fill the gap is what a small cluster of identity vendors have started calling Know Your Agent, or KYA. Beltic is the most visible: verify the principal (the human or business deploying the agent), bind that verification to a W3C Verifiable Credential, and let the agent carry the credential forward into whatever MCP/A2A/ACP conversation it needs to have. Trulioo and PayOS are building adjacent versions. The implementations are real; Beltic ships a public npm package and documentation.⁴
What these solve is principal registration at deployment time. The agent carries a credential that says: a verified human onboarded this agent.
What they don’t solve:
Whether the principal is still in control at the moment of action. Credentials are issued; delegation chains mutate silently.
Whether the human who authorized the agent is still the one directing it. Credential theft, session hijack, and internal handoffs all break the binding.
Whether the authorization granted at deployment is still valid at 2pm on a Tuesday. Real-time revocation is not in the spec.
Whether a real person is in the loop for high-stakes actions, or whether the agent is running autonomously on an authorization granted months ago.
Principal registration is necessary. It is not sufficient. A verified-at-onboarding credential is the agentic-web equivalent of a one-shot KYC check, and the deepfake economy has already taught the identity industry what one-shot verification is worth against a committed adversary.
Why the gap widens as the protocols mature
There’s a tempting argument that this is early and will resolve itself. MCP is stabilizing. A2A and ACP will converge or specialize. Once the session-layer protocols are solid, the identity-layer protocols will follow.
I don’t think that’s how this plays out.
The session-layer protocols are getting locked in, and the tendency of the ecosystem is to paper over the missing layer with whatever marketing-friendly term is available — “the credential the agent carries,” “the trust score from the provider,” “the platform policy for agent behavior.” Each of those is a substitute for the thing that isn’t there.
As MCP/A2A/ACP adoption accelerates, every high-consequence action routed through an agent becomes a data point in a ledger that can’t be reliably attributed to a specific human. Contracts, transactions, communications, legal actions — the accountability debt compounds. The longer the gap stays open, the harder it is to retrofit.
And the gap is a fraud vector, not just a trust vector. An adversary who compromises the session layer — phishing a credential, hijacking an authenticated channel, spoofing an agent identity — inherits whatever authority was bound at enrollment, with nothing checking at the point of action whether the original human is still party to the transaction.
The protocols don’t catch this because it’s not their job. They weren’t designed to.
What the missing layer looks like
The layer the agentic web needs has four properties, each genuinely hard:
Persistent human identity. Continuously verified, not checkpoint-verified. Portable across platforms and sessions. Anchored to a real human with real stakes. This is the layer on-device biometrics can provide — voice processed locally, never transmitted, bound to the device’s authenticator.
Delegated-authority credentials. A machine-readable expression of what a specific agent is authorized to do, on whose behalf, and under what limits. Scope, duration, action types, value thresholds. Verifiable by any counterparty without contacting the issuer. W3C Verifiable Credentials are the right substrate; the schemas for agent delegation are not yet standardized.
Attestation at the point of action. When an agent takes an action that crosses a significance threshold, the counterparty receives a cryptographic proof that a verified human authorized this, that the authorization is current, and that the action falls within granted scope. Not a credential issued three months ago — an attestation produced now, against a live principal.
Real-time revocation. If the human revokes the agent’s authority at 2pm, the counterparty trying to verify at 2:01pm gets a denial, not a stale credential. This is where the existing identity stack is weakest. OCSP for certificate revocation is notoriously fragile; the agentic version has to be better.
None of these is blue-sky research. Each has partial precedents in existing infrastructure. Assembling them into a coherent protocol, with the interoperability MCP/A2A/ACP enjoyed, is the work.
The privacy problem sitting inside the solution
There’s a version of this that sounds dystopian: every action an agent takes in your name cryptographically attributed to your verified identity, creating an indelible record of everything done on your behalf.
That risk is real, and a design that doesn’t take it seriously doesn’t deserve adoption. The constraint that prevents it is architectural, not policy: the credential should prove accountability without creating surveillance. A counterparty should be able to verify that a verified human authorized this action without learning which human, and without generating a record that can be aggregated into a behavioral profile.
Zero-knowledge proof techniques make this achievable in principle. The engineering is hard. The alternative — either no accountability or total surveillance — is the choice we have to refuse.
Anyone building in this space who doesn’t have an answer for the privacy side is building the surveillance version by default. Consider that a direct warning.
My current work
At Helix.ID we are building human identity infrastructure. The specific piece we own is the first property above: persistent, portable, privacy-preserving human identity that doesn’t require storing biometrics anywhere outside the user’s device. Voice is the modality. WebAuthn passkey cryptography anchors the device. On-device processing keeps the biometric off any server. The user’s voiceprint is encrypted at rest with a key the authenticator derives fresh on every session; nothing useful leaks even if the storage is exfiltrated.
The shape of this in the agentic context is an agent-callable verify endpoint that returns a signed credential, a Human Trust Score, and a per-call cost — through an x402 / MPP payment envelope so the economic loop closes cleanly. The agent pays to verify the human behind another agent. Identity as a metered primitive, designed from the first line for the world where the caller is not a human.
That’s one piece. The delegation-authority credential format, and the real-time revocation infrastructure, are not ours to build alone. The W3C VC working group, the OpenID Foundation’s agentic AI identity work, and the DIF agent-authorization drafts are the venues where the missing pieces get specified or they don’t. The protocol layer has to be built in the open or it won’t be interoperable, which means it won’t be useful.⁵
The shape of the argument, one more time
MCP, A2A, and ACP are session-access protocols. They answer a real question about how agents communicate, and they answer it well enough to build on. They do not answer who is behind the agent, who delegated the agent’s authority, whether that delegation is still valid at the moment of action, or whether a real human with real stakes is accountable for what the agent just did.
The question they don’t answer is the question that determines whether the agentic web is trustable — and therefore whether it is something any serious counterparty will rely on for anything that matters.
Filling the gap is not a vendor job. It’s a protocol job. The existing KYA implementations solve the registration piece and I credit them for it. The attestation-at-action piece, the revocation piece, the continuous-presence piece, are open.
We have more work to do.
Sources
Anthropic, Model Context Protocol Specification.
https://modelcontextprotocol.io
Google, Agent-to-Agent (A2A) Protocol. https://google.github.io/A2A/
IBM, Agent Communication Protocol (ACP).
https://agentcommunicationprotocol.dev
Beltic Labs, KYA — Know Your Agent. https://docs.beltic.com/kya/getting-started/what-is-fact
OpenID Foundation, Identity Management for Agentic AI (2025). W3C Verifiable Credentials Working Group. DIF Agent Authorization work. https://openid.net/wp-content/uploads/2025/10/Identity-Management-for-Agentic-AI.pdf