Agents can act. Someone has to be answerable.
Updated 12 October 2026
The short version
AI agents are starting to book, buy and file things for us. When one of them does something, a person or a company has to answer for it. Today, a hospital or a bank that receives a request from an agent usually can't check who sent it, what it was allowed to do, or whether that permission was withdrawn last week. We're setting up a non-profit to work on that gap, in the open, with the people who will have to rely on the answer.
Three cases
These are made-up cases. They aren't reports of real incidents. Each one ends where we think the useful question starts.
A surgery slot
A hospital gets a message at nine in the morning from an agent. It says it acts for a patient and wants to move Thursday's surgery slot to Monday. The scheduling system has a rule that requests from known apps are fine, and this one is from a known app. But which patient is it acting for? Did that patient ask, or did someone's agent mix up two appointments? The hospital can see an app name. It can't see who stands behind it.
The open question: who should the hospital have been able to ask?
A GST return
A small business gives an agent access to its accounting software to prepare the monthly GST return. The agent files it. One figure is wrong, and the notice turns up six weeks later. The business remembers saying "draft". The software vendor says the permission screen said "file". Both could be telling the truth.
The open question: where is the record of what the agent was allowed to do, and who else can read it?
A loan, applied for three times
An agent that helps people compare loans sends applications to three banks for the same customer. Each bank pulls a credit report, which can lower a score. Each bank sees one application and has no way to see the other two. The customer thought they agreed to a comparison.
The open question: how would a bank know the three requests came from the same agent, for the same person, and what that person actually agreed to?
Why now
Three things are true at once.
First, as we understand Indian law today, an AI agent is software and not a person. If that's right, a human or a company answers for whatever the agent does. That's a question for lawyers, and nothing here is legal advice.
Second, regulators are paying attention. The Reserve Bank of India published the report of its FREE-AI committee in August 2025 (the press release is on the RBI site). MeitY has been working on AI governance guidance as well, which we haven't read closely. We haven't seen either one answer the question of how an outside party checks an agent, though we've only read parts of them.
Third, the agents are already here. Banks, hospitals and tax offices will keep getting requests from them, whether or not anyone has built the checking.
What exists today
Other people are working on this, and some of it is good. We describe other products from public reports and their own documents. We can get things wrong, and we'll correct them when we do.
Enterprise directories. Microsoft's Entra Agent ID, reported to be generally available around April 2026, and similar offerings from Okta and Ping, let a company register its own agents in its own directory, much as it registers laptops and staff. Inside that company this is useful. What we haven't seen is a way for an outside party, such as a hospital, to check an entry in a bank's directory.
A platform's own controls. Meta has described a product called Muse that asks the user to confirm certain actions during a session. As described, that is a control inside Meta's platform. We haven't seen a way for someone outside Meta to check it.
A payments registry. NPCI has reportedly started on a registry for payment agents (reported in September 2026, with RBI approval still pending). We think that's good news. As reported, it starts with payments.
Doot. A proposal published in February 2026. We haven't read it closely enough to describe it, so we won't describe it from a summary.
NANDA AgentFacts. Another effort in this area, built around descriptions an agent publishes about itself. We see it as a peer and not a rival, and we haven't compared the two closely yet.
Where the gap sits
Each company checks its own agents well enough. The trouble starts at the boundary: the hospital outside the bank's directory has nothing to look at. That boundary is the part we're working on.
Read this diagram as text
- Company A has a wall around its own agents, and trusts only the agents inside it.
- Company B does the same on the other side.
- Between the two walls sits a shared register, run by its members and not by any one company.
- Both companies can look an agent up in the register, so each can check the other's agents.
How they compare
Each row is a question a relying party would ask. Our own column says "planned" wherever that's the truth, which is most places. The other three columns are our reading of public material, not a test, and the vendors' own documents win if they disagree with us.
| Question a relying party asks | Enterprise directory | A platform's own controls | Payments registry | Saakshya (planned) |
|---|---|---|---|---|
| Can a hospital outside the issuing company check this agent? | Inside its own tenant, yes. Outside it, we haven't seen a way. | No. Checks happen inside the platform. | Reported for payment participants. Beyond payments, unknown. | Yes, that's the point. Spec not yet published. |
| Does it tell me which person or company is answerable? | The tenant knows. The relying party outside doesn't. | The platform knows. | Reported: unresolved. | Yes, every credential names an accountable owner. Planned. |
| Does it say what the agent may do for this task? | Permissions exist inside the tenant. | Per-session user confirmations, as described. | Starts with small payments, reported. | Task-scoped credentials. Planned. |
| Can permission be withdrawn today, and will I see it? | Within the tenant, yes. | Within the platform. | Unknown. | Revocation checked on every request. Planned. |
| Will there be evidence later I can show a regulator? | Tenant logs; sharing them is the tenant's choice. | Platform logs. | Unknown. | Evidence the relying party keeps itself. Planned. |
| Does it work across sectors? | Not sector-specific; not cross-organisation. | One platform. | Payments. | Health, tax, finance, government services. Planned. |
| Does it carry DPDP-relevant fields? | We haven't seen this. | We haven't seen this. | Unknown. | Planned. |
| Who sets the rules? | The vendor. | The platform. | NPCI, with RBI, reported. | A member-run non-profit, planned. Not incorporated. |
| Is the spec open and royalty-free? | Vendor terms. | Not applicable. | Unknown. | Intended. Licence drafted, not executed. |
| Does it exist today? | Yes. | Yes, inside Meta. | Reported as in progress. | Reference code exists. No members, no published spec. |
If you work on one of these and we've got your product wrong, write to contact@saakshya.org and we'll fix it. Last checked 12 October 2026.
What we are not
We aren't a regulator. We aren't a government body, and nobody in government has endorsed us. We aren't a vendor selling a product. We're setting up a non-profit, the Saakshya Bharat Foundation, and it isn't incorporated yet.
Here is what isn't done:
- There are no members. Nobody's seat is confirmed.
- There's no board.
- A reference implementation exists, but the specification isn't published. It's being prepared for open publication.
- The royalty-free licence is intended, drafted and not signed.
- Fees aren't set, and nothing is due from anyone.
Saakshya is independent of NPCI, UIDAI, MeitY and every company named on this page.
What we'd like to happen
A shared check that works across companies and across sectors, built once, in the open, and run by a body that no single company controls. We'd like enterprise directories and payments registries to be able to issue and check the same credentials. Not to be replaced by us.
If you run a bank, a hospital or an agent platform and you'd like a say in how this gets built, tell us you're interested or write to contact@saakshya.org. If you think this page gets something wrong, tell us that too. It's the quickest way for it to get better.