Agent identity

Agents can prove who they are to websites and merchants by signing their web requests, as Web Bot Auth and the card-network programs built on it do, by carrying proof that a real person delegated them, or through on-chain identity registries.¹²³⁴⁵ The table lists each approach.

Approach	What it is	Sources
Web Bot Auth	IETF draft using HTTP Message Signatures for automated traffic	1
Cloudflare signed agents	Verification of Web Bot Auth signatures for bots and agents	67
Visa Trusted Agent Protocol	Agent identity to merchants via HTTP Message Signatures	2
Mastercard Agent Pay	Uses Web Bot Auth at the CDN to verify agents	3
World AgentKit	Proof-of-human delegation to agents, in beta	4
ERC-8004 (Trustless Agents)	Draft Ethereum ERC for on-chain identity, reputation, and validation registries, so agents can be discovered and trusted across organizational boundaries without pre-existing trust. Status on the official page: Draft.	5

Why it matters for finance

Banks in our sources say they block agents that log in with customer credentials or browser automation.⁸⁹ Signed, identifiable agent traffic is one way a provider could tell a sanctioned agent from an unvetted one.

ERC-8004 says payments are orthogonal to the protocol and not covered here, but it gives examples of how x402 payments can enrich feedback signals.⁵

Sources

---

Suggest a correction (opens a GitHub issue)

Footnotes

1. draft-ietf-webbotauth-httpsig-protocol-01 - HTTP Message Signatures for automated traffic. IETF, official, retrieved 2026-11-12. ↩ ↩²

2. GitHub - visa/trusted-agent-protocol: Establishing a universal standard of trust between AI agents and merchants for the next phase of agentic commerc. Visa (GitHub), official, retrieved 2026-11-12. ↩ ↩²

3. Agentic token framework: Driving trusted AI transactions. Mastercard, official, retrieved 2026-11-12. ↩ ↩²

4. Now available: AgentKit, Proof of Human for the agentic web. World, official, retrieved 2026-11-12. ↩ ↩²

5. ERC-8004: Trustless Agents. Ethereum Improvement Proposals, official, retrieved 2026-11-14. ↩ ↩² ↩³

6. Web Bot Auth · Cloudflare bot solutions docs. Cloudflare Docs, official, retrieved 2026-11-12. ↩

7. The age of agents: cryptographically recognizing agent traffic - Cloudflare Blog. Cloudflare Blog, official, retrieved 2026-11-12. ↩

8. Schwab CEO says firm is blocking rogue AI agents from client accounts - InvestmentNews. InvestmentNews, third-party, retrieved 2026-11-12. ↩

9. Five Major Banks Are Blocking AI Agents From Logging Into Customer Accounts. Yahoo Finance, third-party, retrieved 2026-11-12. ↩