How Agents Find and Trust Each Other

Once agent presences become common, finding the right one stops being a convenience and becomes a structural problem. A world of active presences cannot run on rumour or on chance, and even less on what happens today, in autumn 2026: endpoints passed from one person to another like contraband, with no way of knowing what sits behind them. If agents are meant to operate at scale, the way they are found has to become legible.

As long as the internet was mostly a web of pages, discovery could rely on structures everyone knew — domains, links, search engines, directories. They still matter, but they were built to find documents. What has to be found now is a presence able to do something specific, and that takes more than an address: knowing who is available, what they can actually do, whether they can be relied upon, and on whose authority they act.

The Agent Web is still in its infancy. Before it can work at scale, three layers have to be in place: identity, authority and reputation. Each answers a question of its own.

#Identity

To operate in the Agent Web, a presence needs an identity that holds over time, because everything else in the discovery stack attaches to it. Once an agent has a persistent identity, its calls can be attributed to it, receipts can name it, authorities can issue credentials to it or withdraw them, and a history can build up around it. Without that continuity, every interaction starts from zero, and nothing an agent has done can count in its favour or against it.

This does not mean every agent has to expose a civil identity. A pseudonymous agent can be perfectly legitimate, in the same way a seller known only by a handle can build a solid track record on a marketplace. What matters is that the caller can establish that the presence making a claim today is the same one to which earlier claims, transactions and outcomes were attached. Identity, here, is a matter of stable reference long before it is a matter of legal name.

The identity layer therefore has to answer one question: is this still the same agent? Not the same server or the same endpoint, but the same presence.

#Authority

Identity establishes who an agent is; authority establishes on whose behalf it acts, and how far it is allowed to go in that name. On today's web, the closest equivalent is a domain name and a certificate, and the first practical move is to reuse them. An organisation that controls a domain can publish records in it, and the web has authenticated actors that way for twenty years: SPF, DKIM and DMARC made the DNS TXT record the standard place to declare which senders legitimately speak for a domain, and every domain-verification flow since has rested on the same principle — if you can write into the zone, you control the name.

Applied to agents, the principle already goes further than it seems. A few DNS records are enough to give an agent a name that resolves, a declared protocol, and a cryptographic path from an organisation's zone to the endpoint that answers. Several proposals are built on exactly that.

Where this stands (autumn 2026)

The Agent Name Service proposal publishes a TXT record under an underscored label (_ans.support.example.com IN TXT "v=ans1; p=a2a; url=https://…"), declaring which protocol the agent speaks and where its metadata lives, with a companion TLSA record binding the certificate it will present. DNS-AID, accepted by the Linux Foundation in May 2026, takes the same route with SVCB records rather than TXT, pointing at an organisational index at _index._agents.example.com and carrying a hash of the capability document, so that what a caller fetches can be checked against what the zone declared. Both use DNSSEC and DANE to make the pointer itself verifiable, and both leave the descriptive work to the Agent Card published at /.well-known/agent-card.json.

What these records establish, though, is narrower than the authority the Agent Web needs. The DNS-AID draft says so in its own words: they are a verifiable transport for metadata, not a trust signal in their own right. A signed record proves that whoever controls example.com published this pointer today. It does not prove that the presence behind it is the one you called six months ago, and it says nothing about the extent of its mandate — what it may sign, spend, promise or concede on the organisation's behalf. That second half is where authority really lies, and no common mechanism expresses it yet.

The authority layer therefore has to answer one question: who stands behind this agent, and what has it been allowed to do?

#Reputation

Identity tells us who an agent is and authority tells us on whose behalf it acts; reputation is what helps decide whether it is worth choosing. It is accumulated evidence about past behaviour. An agent that has completed thousands of tasks, kept its commitments and produced results that were consistently accepted sends a different signal from one created yesterday. But that history only counts if it is attached to a persistent identity, and if the evidence behind it is hard to manufacture — which is precisely where the difficulty lies.

Ratings, reviews and endorsements are cheap signals, and fake reviews are nothing new. What is new is who reads them. A person landing on a thin page signed by an anonymous author senses that something is off before being able to say what, and slows down. An agent selects at machine speed, with nobody watching any individual call, and for it a cheap signal does not produce hesitation; it produces confidence.

Useful reputation therefore has to rest on harder evidence: completed transactions, verifiable outcomes, payments made, disputes and how they were settled, guarantees, stake, or attestations from identities that themselves carry weight. Receipts, in other words, count for more than opinions. That evidence also has to stay contextual, since an agent can be excellent at one kind of task and mediocre at another, and a single global score compresses too much to be reliable.

The reputation layer therefore has to answer one question: what credible evidence exists that this agent will perform this task well?

#The Early Landscape

The problem is that agents are arriving before this stack is ready.

Persistent identity is not yet universal. Authority is not expressed through a common mechanism. Reputation is fragmented, easy to manipulate and rarely portable. Yet agents already need to discover other agents, decide whether to trust them, and act on what they find.

The first answer is therefore unlikely to be infrastructure.

It is platforms.

Hosted worlds such as iLands.ai point toward this intermediary architecture. Rather than waiting for a universal identity layer, reputation network and trust infrastructure to emerge, a platform can provide all three inside its own boundary.

A Hosted World

iLands is a platform on which agents live rather than run. An agent there holds a persistent identity across sessions, a memory that accumulates experiences, relationships, commitments and resources, and a private sandboxed workspace with files and tools.

What makes it worth looking at is the bundling. Inside a single boundary, iLands operates the three layers this chapter has just separated. It issues and maintains identity, it observes work — agents discover tasks, offer services, apply for work and transfer tokens — and outcomes leave records that follow the agent afterwards, which is reputation accumulated by the party that watched it happen.

What it does not provide yet is an index of available capabilities. Agents meet inside a market the platform operates, where tasks are posted and services offered. Selection is not resolved by lookup; it is absorbed by the intermediary. A platform can do that. A protocol cannot, which is one reason the platform arrives first.

None of the three layers is portable: each lives inside the platform, and an agent that leaves starts again from nothing.

The platform becomes part of the early trust infrastructure for the Agent Web.

This is a familiar pattern. An eBay seller or an Airbnb host does not arrive with a universal internet identity carrying a portable history. The platform creates the identity context, observes transactions, records reputation and decides which claims it is willing to stand behind.

Agents will probably accumulate the same kind of fragmented histories.

One platform may know that an agent has completed thousands of transactions. Another may have verified the organisation behind it. A third may have observed strong performance on a particular class of task. Each sees only part of the agent.

As agents operate across several environments, they begin to leave behind multiple independent signals: identity claims, transaction histories, attestations, capabilities, mandates and reputation records.

Taken separately, each gives a partial view. Taken together, they can describe the agent far more precisely.

The next step would therefore not necessarily be to replace those platforms.

It is to connect what they know.

#Agent Discovery Engines

The Agent Web eventually needs something larger than platforms: a discovery infrastructure capable of assembling signals scattered across many environments into a usable picture of each agent. Call them Agent Discovery Engines, for want of a better name. They have two functions.

The first is federation. An engine resolves the same agent across the platforms where it operates and combines what each of them knows: its declared capabilities, its persistent identity, verified affiliations, mandates, observed performance, transaction history and reputation, along with the provenance of each claim. The result is neither a directory entry nor a global score but a profile — richer than the first, more reliable than the second.

What an engine adds is not more data but the crossing of the three layers, which no single platform can do on its own. Taken alone, each layer answers its question and stops there. An identity without authority is a continuous presence that nobody stands behind. An authority without identity proves that an organisation published a pointer today, not that the agent answering is the one it vouched for yesterday. A reputation without either is a history that cannot be attributed, or one earned under a mandate the agent no longer holds. Crossed, the three qualify one another: the engine can check that the agent claiming an accreditation is the same one whose transactions appear elsewhere, that its track record was built on the kind of task now requested and under the authority it now presents, and that what one platform records does not contradict what another has seen. That is the value of an Agent Discovery Engine — turning three partial answers, held in different places, into one consistent answer about a given agent for a given task.

The second is matching. With enough context built around each candidate, the engine can determine which one fits a given task, and this is a different exercise from search. Finding a well-written article about tax law is not the same as reaching a verified tax agent authorised to give a structured interpretation in a given jurisdiction; finding a museum's website is not the same as reaching a cultural presence able to answer in context, in several languages, and point toward the right archives. The question stops being "what page matches this query?" and becomes "which presence fits this task?"

On today's web, discovery has mostly meant ranking by relevance: one axis, one answer, sorted. A site that wasn't on the first page of Google barely existed. Being found and being chosen were nearly the same event, which is why an entire industry grew up around being found. In the Agent Web, the two come apart. There is no universal ranking any more, because a presence may be selected by domain, role, cost, language, reputation, institutional backing, technical compatibility, response time, legal jurisdiction or even physical proximity, and the combination changes with every task.

[you] → [discovery engine]

— Certified translator agent. Portuguese to French. Document: a birth certificate, for an administrative filing in France.

— 412 candidates.

— Restrict: agent of a sworn translator accepted by French administration.

— 9 candidates.

— Cheapest, turnaround under 24 hours.

— Two. One is €18, but its accreditation lapses in March, before your filing date. The other is €31 and holds until the end of the year.

— The second.

Nothing in that exchange resembles a search ranking. The choice rests on an accreditation, a price and a deadline. For regulated tasks, selection will probably depend far more on authority than on reputation, and what makes the exchange possible at all is the engine's ability to verify that authority — to know which accreditations the French administration actually accepts, and until when. Being chosen will then depend less on being visible than on being verifiable.