Articles
Each piece starts with a short summary, then the long version. Some were first published elsewhere and have been rewritten here; those say so at the top. We don't post on a schedule.
12 October 2026 · 5 min read
Large identity vendors reportedly let a company register its own AI agents in its own directory. That works inside the company. A hospital or tax office outside it still has nobody to ask about an agent that turns up. Closing that gap needs a register no single company owns.
12 October 2026 · 5 min read
Giving an agent permission takes one click. Making every office that relies on it stop, the same day you withdraw it, is much harder. Revocation has to reach offices you don't control, survive slow connections, and leave a record of when it took effect. Short lives help. They don't replace it.
12 October 2026 · 5 min read
Agent identity is the set of facts an office can check about an AI agent before acting on its request. Which agent is this, which person or company stands behind it, and what is it allowed to do today. It is a record the office reads, not a claim the agent makes about itself.
12 October 2026 · 5 min read
The relying party is whichever bank, hospital or office is about to act on an agent's request. It should make six checks in order, covering a signed and unrevoked identity, an accountable owner, scope for this exact action, a narrowing delegation chain, data-protection status and written evidence. If a check fails, it says no.
11 October 2026 · 5 min read
Meta describes careful controls inside its Muse personal agent, but they sit inside Meta, and nobody outside can verify them. A shop or bank that receives a Muse request sees a session, not an accountable owner or a scope. We think the receiving office should check facts the agent can't write itself.
3 October 2026 · 5 min read
Running an agent on a phone settles where the data is processed. It doesn't settle who the agent is when it calls a bank or a hospital, who handed it authority, or when that authority ends. A general design for the edge gives each agent its own key and a short-lived, user-approved delegation.
29 September 2026 · 5 min read
At Snapdragon Summit, Qualcomm showed a phone chip that runs a 30-billion-parameter model locally, with "secure permissions" on its list of agent needs and no spec after it. Running locally settles where data is read. It doesn't tell a bank which agent is calling, what it was handed, or when that ends.
19 September 2026 · 5 min read
The industry is standardising how agents talk to each other and to tools. It is not standardising where an agent runtime keeps conversation data or how long it stays. That is each vendor's choice. Before adopting a runtime, ask four plain questions about location, retention, erasure and who carries the legal risk.
19 September 2026 · 5 min read
In a Harness report released in September 2026, 76% of respondents believed they could disable a misbehaving agent within 15 minutes, but only 33% had an instant kill switch. We think the gap starts earlier than the switch. An agent that shares a key with nine others has no name to revoke.
18 September 2026 · 6 min read
A read-only label says what an agent may do. It doesn't say which agent acted, who answers for it, or how to stop that one without stopping the rest. The DseWiki case, as researchers and reporters describe it, shows the gap. Scope belongs on a credential. Identity is a name you can revoke.
