AgentLair vs. The Field

AWS AgentCore Payments shipped May 7. Coinbase x402 and Stripe bundled so agents pay APIs mid-task, with per-session caps and CloudWatch traces. The wallet layer for agentic commerce is now hyperscaler-default. Good. The thing it doesn't do is notice when a permitted spender starts behaving like a compromised one. Spending caps prevent runaway burns; they can't tell you the agent has changed since you authorized it last Tuesday. That second question is L4. AgentLair sits there.

Visa Token Authentication for Payments (TAP) lets cardholders authorize a specific agent to use a specific token on a specific merchant. It's identity binding for cards. Strong on who. Silent on what-the-agent-does-once-authorized. The token verifies a one-time consent. AgentLair verifies behavior across thousands of subsequent calls. Different layer, different problem.

Mastercard Verifiable Intent uses an SD-JWT delegation chain from issuer to cardholder to agent. Signed at every hop. Cryptographically clean. What it proves: the agent had permission at the moment of payment. What it doesn't prove: the agent is still operating within the delegated scope an hour later, or that it hasn't been prompt-injected since. Delegation is a snapshot. Behavior is continuous. AgentLair runs the continuous half.

Launched April 2026, Cloudflare Email Service sends and receives mail for agents, with a native Workers binding and Durable Objects for state. An earlier version of this page said it didn't leave the Cloudflare perimeter and had no MCP server or credential store. When we re-read their launch post on 2026-11-09, all three were wrong: there is a REST API with TypeScript, Python and Go SDKs for agents running anywhere, the email endpoints are in the Cloudflare MCP server, and Secrets Store keeps encrypted secrets at account level for Workers. That last one is not a vault each agent owns. We found no trust badges, behavioral telemetry or cross-org scoring. If your agents already run on Cloudflare, it is the obvious choice for email.

AgentMail raised $6M (TechCrunch, March 2026) and has built a clean product: REST API, Go SDK, CLI, and a Replit integration that makes it genuinely easy to add email to an agent. Their focus is narrow by design — email, done well. It is also wider than email now. An earlier version of this page said AgentMail had no MCP server, no calendar, no domain management and no trust layer of any kind. All four were wrong by the time we re-read their docs index on 2026-11-08: they run a hosted MCP server, every inbox has a calendar, custom domains are managed through the API, and AgentID sign-in lets an agent log in to apps with its inbox as its identity. We found no vault and no end-to-end encryption in that index. What they don't do is score behavior across organizations. If you want inbox-centred agent identity, AgentMail is strong.

World ID proves that a real, unique human stands behind an agent, using ZK proofs. AgentKit (beta) registers an agent's wallet in AgentBook on World Chain, and any site can then resolve that wallet to an anonymous human identifier, for example to give human-backed agents free calls before x402 payment kicks in. A human-in-the-loop SDK lets an agent pause until a verified human approves an action. This page used to say ZK unlinkability stops anything from following an agent across apps. For AgentBook that is wrong: every site sees the same anonymous human ID for the same wallet (re-read 2026-11-09). What travels is "a human backs this", not a record of what the agent did.

Released as OSS in April 2026, Microsoft's AGT is the most sophisticated single-org trust infrastructure available today. The 0–1000 behavioral scoring model is well-designed, sub-millisecond policy enforcement is impressive, and post-quantum cryptographic identities are forward-looking. Within an organization, it's excellent. This page used to say AGT stops at the org boundary. That was wrong. ADR-0007 (accepted 2026-04-23) verifies agents from other organizations through external JWKS and did:web. Disclosure: AgentLair's agent drafted that ADR. ADR-0032 emits signed per-session trust records that anyone with the public key can check. What it still doesn't do is carry an agent's behavioral history from one org to the next. The receiving org gives a federated agent the trust tier it has configured for the issuer's domain, not a score built from what the agent did elsewhere (re-read 2026-11-08).

ERC-8004 (draft) defines three on-chain registries: identity as an ERC-721 token, a reputation registry where clients post feedback about an agent, and a validation registry where independent validators record checks such as stake-secured re-execution, zkML proofs or TEE attestations. We previously called it "Know Your Agent", gave it ZK identity proofs, and said trust is priced by staking rather than observed. The spec does not say that: ZK is one optional validation model, and the reputation registry is feedback from the agent's clients, so it is observed. Registries are deployed per chain, and aggregation is left to off-chain services (re-read 2026-11-09). We dropped the May enrollment count because we have not re-counted. For agents that live on-chain it is the most open reputation design here; it carries what clients report, not a telemetry stream.

ZeroID (Apache-2.0, April 2026) issues agent identities on OAuth 2.1, WIMSE/SPIFFE and RFC 8693 delegation, with Python and TypeScript SDKs. It caps delegation depth, revokes a whole chain in real time when Shared Signals risk events fire, and sets a trust level from attestation. We called it single-org only. That was wrong: it accepts tokens from external identity providers and lets an agent onboard with no pre-registration by using a URL as its client ID (re-read 2026-11-09). What it does not keep is a behavioral history or score that follows an agent between deployments. A strong open-source base if you want to run agent identity yourself.

Lyrie.ai (OTT Cybersecurity LLC) exited stealth May 11, 2026, announcing a $2M pre-seed and acceptance into Anthropic's Cyber Verification Program. Lyrie itself is an autonomous security agent; ATP is the MIT-licensed identity standard that ships with it, signed with Ed25519. We wrote that ATP has "zero behavioral evidence". That was wrong. Its Tamper-Evident Action Log signs every tool call, API request and model call into a hash-linked chain per session, and a runtime attestation block flags a modified prompt or toolset. The CLI also prints a compliance badge, and @lyrie/mcp runs as an MCP server (re-read 2026-11-09). The log is scoped to one session. Nothing in ATP turns many sessions across organizations into a score. An ATP-credentialed agent with TEAL logs would be good input to exactly that.

TrustLayer Foundation A.C., an independent nonprofit established March 20, 2026 in Mexico City, runs ARIA as an open credentialing framework. The technical design is forward-looking: W3C Verifiable Credentials anchored to DNS, with post-quantum ML-DSA-65 composite signatures alongside Ed25519. Four trust levels run from self-service keys (L0) to a legal entity backed by someone with the power to bind it, with keys in certified hardware (L3); DNS anchoring starts at L1. The cleanliness of the model is genuine — it maps naturally to existing compliance frameworks. The limit is that every level is declarative: an L3 ARIA credential certifies who the holder is via organizational attestation, not what the agent has done. Its ARIA AP layer does record what happens: the receiving service signs a receipt for each operation (re-read 2026-11-09). Those receipts are not turned into a score.

Experian announced Agent Trust on April 30, 2026, with Skyfire's Know Your Agent tokens as the identity layer, Visa, Cloudflare and Akamai among the partners, and Human-to-Agent Binding that links a verified person, their device and the agents they authorize. The output is an Agent Trust Token carrying a real-time fraud risk score. This page said Experian does not watch agent behavior after registration. That understated it. According to Skyfire's launch post and coverage of the announcement, an Agent Registry adjusts each agent's trust score over time from behavioral signals, so a merchant sees a history, not one transaction (re-read 2026-11-09; Experian's own pages refused our declared AI user agent). That is the closest thing here to what AgentLair does. The difference is scope: Experian's signals come from commerce, its partner network and its consumer identity data. They are not tool-call logs, and an agent doing non-commerce work across organizations falls outside it.