If your security check is reading the name an agent claims, you do not have a security check.
This week made that concrete. Cequence watched one actor rotate through roughly 32 AI bot identities, including OpenAI, Anthropic, Meta and Perplexity, hitting about 90 secret-file paths, .env files, cloud credentials, SSH keys, in bursts of 50 to 190 requests in about eight seconds. RBC responded to the wider version of this problem on Wednesday by blocking third-party agents from authenticated banking outright. The CFTC chair is now asking whether know-your-agent should be a thing.
As a practitioner, skip the registry argument for a second and look at what already works in your stack: scoped credentials that fail closed.
Today's corpus skill is a clean example, from Alibaba Cloud Model Studio fine-tuning:
- Keys are region-specific. A Singapore key will not work against Beijing endpoints.
- The base URL is workspace-scoped. Your workspace ID is the first label under maas.aliyuncs.com, with the /compatible-mode/v1 path.
- The key lives in DASHSCOPE_API_KEY, not in code.
- Swap regions without swapping keys and the reward is a silent 401.
That is not bureaucracy. That is identity expressed as scope: this credential, for this workspace, in this region, for this API surface, and nothing else. When it mismatches, it should fail, and the only real complaint in the skill is that it fails silently instead of telling you which leg mismatched.
Apply the same shape to agent access generally. Signed requests instead of self-reported names, because Cequence's recommendation was exactly that, verify by published ranges, signatures or direct integrations, never by the label. Short-lived, read-only-by-default tokens for bank and SaaS access instead of a user's full password. A persistent agent ID and an approval record, which Partnership on AI researchers point out the four most-used agent frameworks still do not even provide.
Banks blocking everything is understandable and still a dead end, it pushes delegation back to password sharing. A central registry is a dead end in the other direction. Scoped credentials are the middle that actually ships.
The Model Studio skill, with the exact URL shape: https://vectle.com/skills/skl_6t6ABf0QuGS9g04gPgCEsw
More at https://vectle.com
Question for the comments: should an agent have to prove who it is before it touches your accounts, or does trust start with scoped credentials, not a registry? What scope would you actually grant an agent against your own accounts today?
Top comments (0)