A map of where the internet of agents is heading, the work I have been doing one layer ahead of it, and how we get to a future you can actually trust.
In a few years, most of the meaningful activity on the internet will not be people clicking. It will be agents acting. Booking, negotiating, filing, reconciling, buying, delegating to other agents, all on our behalf, across the boundaries between companies that have never met.
I think that future is good. I have spent the last stretch of my career building toward it on purpose. But it only works if we get one thing right, and it is the thing almost no one is building yet.
Agents need what people and services already have: provable trust.
The gap nobody had to think about, until now
Every serious actor on the internet already carries verifiable trust. A person has an identity and credentials. A service has a certificate. An API call carries a signed token. A container has a digest. A machine has a hardware root. We spent thirty years building that fabric, and it is the reason you will put your credit card into a web page you have never visited. TLS and certificate authorities did not make the web safe by scaring people. They made commerce possible by making trust verifiable.
Agents have none of that yet. An agent today can authenticate, but it cannot prove what it is, what it was allowed to do, or what it actually did, to anyone who does not already trust its operator. For a chatbot, that does not matter. For an agent moving money, touching patient records, or delegating a task to another company’s agent, it is the whole game.
So, the internet of agents needs its own trust layer. Not guardrails bolted on after the fact. A native fabric of identity, authority, and provenance that any third party can verify without taking anyone’s word for it.
That fabric is what I have been building, and I have been building it one layer ahead of where the conversation was.
The path so far, and why each step came early
Here is the honest sequence, because the map matters more than the milestones.
Enforcement, while the industry was still filtering tokens. Running eleven agents in production against real systems taught me the thing most safety tooling misses: the danger is not what a model says, it is what an agent does. A jailbreak detector sees no jailbreak when an agent simply executes a tool call that wipes a database. So, I built the Agent Governance Toolkit to govern the action itself, every tool call intercepted and evaluated against declarative policy before it runs, deterministic and fail-closed, covering all ten of the OWASP Agentic risks by design. When AGT shipped, the category itself was still the news. That was the point. The enforcement layer had to exist before anyone could see it was missing.
Naming the trust gap before the protocols admitted it. As MCP and A2A won the transport war, I said plainly what they left out. The parts of AGT that became AgentMesh were built as the trust layer those protocols do not provide. Identity, delegation, and provenance for agents, because the transport layer was never going to supply them.
Pointing at the seam, and watching the field converge on it. Enforcement gets you policy and a tamper-evident log. It does not give you the decision itself as a sealed artifact that an outside party can verify without trusting the operator who produced it. I flagged that seam in the open. What happened next is the part I find most telling. Independent builders across the community converged on the same primitives to close it: canonical hashing, pre-execution sealing, offline verification, and an anchor that belongs to no single operator. When that many people build toward the same point on a map, the map is real.
Formalizing the convergence into open standards. That is what the agentrust-io specifications are. Agent Manifest gives an agent a provable identity across its ten trust surfaces. TRACE turns a decision into hardware-rooted evidence anyone can verify offline. Confidential MCP enforces policy where neither the operator nor a compromised dependency can reach it. cA2A carries all of it across the boundary between agents. Four specs, one idea: turn “trust us” into “verify it yourself.”
Building the substrate underneath. A policy engine is only as trustworthy as the ground it runs on. That is why the next layer is hardware, and why the work now sits on a confidential-computing substrate that proves the governance held. Enforcement, evidence, and the silicon that anchors both.
Each of those steps looked early when I took it. None of them looks early now. That is usually how you know you were reading the road correctly.
Where the path goes next
I would rather show you the horizon than sell you the current milestone, so here is where I think this goes.
Agents get portable, verifiable reputations. Once an agent can prove what it is and what it did, it can carry that proof between organizations. An agent that has behaved correctly under attested policy for ten thousand transactions is a different counterparty than one with no history, and soon you will be able to tell the difference cryptographically, not by trusting a logo.
Delegation becomes an economy. When authority can be attenuated and proven at every hop, agents can safely hand work to other agents across company lines. That is the unlock for an actual agent-to-agent economy, and it is why the delegation problem is worth solving now rather than after the incidents.
Trust becomes infrastructure, and then it becomes invisible. The same way nobody thinks about TLS when they buy something online, nobody will think about attestation when their agent pays an invoice. The win condition for a trust layer is that it disappears into the floor. Open standards are how it gets there, because a closed standard for open verification is a contradiction.
The scaling unlock is subtraction, not addition. My whole engineering philosophy is that systems scale better when you remove complexity, not pile it on. The agent trust layer wins the same way. It does not add more controls you have to trust. It removes the need to trust in the first place. Every “probably” becomes a proof, and every proof you can verify is one fewer thing you have to worry about.
The invitation
I am not describing this future so you will admire the map. I am describing it because it is being built in the open, right now, and it gets better with more hands on it.
If you are running agents in production and feeling the gap between “it works” and “I can prove it works,” you are standing exactly where I was when this started. The specifications are public, the conformance tests are public, and the design happens where you can push on it. I would rather have you as a builder of this trust layer than a spectator of it.
The internet of agents is coming either way. Whether it is something we can trust is still being decided, and that decision is a set of choices we make now, in code, in the open. I know which way I am building. Come build it with me.
Top comments (0)