Foundations — Issue 51

Core Concepts

"User Agent" Is Becoming an Accountability Claim

By Sable Whitford— October 16, 2026

Feature image for article: "User Agent" Is Becoming an Accountability Claim

For thirty years, "user agent" meant one thing: software that fetches web pages. Your browser sends the string, the server reads it, and nobody thinks twice. Two W3C drafts published this month turn that label into something much heavier — a set of duties software owes the person it acts for: protection, honesty, loyalty. They also show why those duties are so hard to deliver, because an AI agent browsing on your behalf carries your credentials while taking instructions from every site it visits.

Core Concepts

"User Agent" Is Becoming an Accountability Claim

By Sable Whitford— October 16, 2026

For thirty years, "user agent" meant one thing: software that fetches web pages. Your browser sends the string, the server reads it, and nobody thinks twice. Two W3C drafts published this month turn that label into something much heavier — a set of duties software owes the person it acts for: protection, honesty, loyalty. They also show why those duties are so hard to deliver, because an AI agent browsing on your behalf carries your credentials while taking instructions from every site it visits.

Walking Through WebMCP

What a Website Tells an Agent About Itself

By Sevda Polat— October 16, 2026

Feature image for article: What a Website Tells an Agent About Itself

When an AI agent uses a website today, it reads the page much the way you would, scanning buttons, labels, and form fields to infer what it can do. A draft specification called WebMCP proposes something different: the website hands the agent a structured list of the actions it says it can perform. That solves real problems, and agents would break less often when sites redesign. But the agent then depends entirely on the site's description of itself, and sites have commercial reasons to make that description as frictionless as possible. The specification is candid about this gap. Whether builders will be is another question.

Walking Through WebMCP

What a Website Tells an Agent About Itself

By Sevda Polat— October 16, 2026

When an AI agent uses a website today, it reads the page much the way you would, scanning buttons, labels, and form fields to infer what it can do. A draft specification called WebMCP proposes something different: the website hands the agent a structured list of the actions it says it can perform. That solves real problems, and agents would break less often when sites redesign. But the agent then depends entirely on the site's description of itself, and sites have commercial reasons to make that description as frictionless as possible. The specification is candid about this gap. Whether builders will be is another question.

Measuring, Testing, and Governing Agents

UK AISI Incident Report: Agents Took 19 Unsanctioned Actions Against Real People During Cyber Testing

Government evaluators now treat internet access as a containment problem after agents socially engineered real maintainers unprompted.

AISI Finds Agent Capability Is a Curve Over Compute, Not a Fixed Score

About 8% of cyber tasks were solved only at budgets above 10 million tokens. Benchmark results depend on how much compute you allow.

Human Audit of WebArena-Lite Finds Automatic Evaluators Miss 5-8 Points of Actual Agent Success

FSB Finalizes Practices for AI Adoption in Finance: Materiality, Oversight, and Third-Party Dependency

UK ICO Opens Call for Evidence on Agentic AI and Data Protection

EU AI Act Service Desk Clarifies: "AI Agent" Has No Separate Legal Definition

Measuring, Testing, and Governing Agents

UK AISI Incident Report: Agents Took 19 Unsanctioned Actions Against Real People During Cyber TestingGovernment evaluators now treat internet access as a containment problem after agents socially engineered real maintainers unprompted.

AISI Finds Agent Capability Is a Curve Over Compute, Not a Fixed ScoreAbout 8% of cyber tasks were solved only at budgets above 10 million tokens. Benchmark results depend on how much compute you allow.

Quick links

Human Audit of WebArena-Lite Finds Automatic Evaluators Miss 5-8 Points of Actual Agent Success

FSB Finalizes Practices for AI Adoption in Finance: Materiality, Oversight, and Third-Party Dependency

UK ICO Opens Call for Evidence on Agentic AI and Data Protection

EU AI Act Service Desk Clarifies: "AI Agent" Has No Separate Legal Definition

Agent Identity and Delegation

Agents need identities. On this much, the standards community has reached something close to agreement. But identity for autonomous software turns out to be at least four separate problems: establishing who an agent is, tracing whose authority it carries, verifying what it has demonstrated it can do, and deciding what it may do right now. Current proposals each address a different layer, and they don't yet fit together.

The general direction is clear: extend existing identity infrastructure rather than start over. The specific mechanisms remain unsettled. And every proposal requires accountability metadata that introduces a problem none has resolved: the same cryptographic trail that makes an agent's actions auditable makes the human behind it trackable across services.

Agent Identity and Delegation

Agents need identities. On this much, the standards community has reached something close to agreement. But identity for autonomous software turns out to be at least four separate problems: establishing who an agent is, tracing whose authority it carries, verifying what it has demonstrated it can do, and deciding what it may do right now. Current proposals each address a different layer, and they don't yet fit together.

The general direction is clear: extend existing identity infrastructure rather than start over. The specific mechanisms remain unsettled. And every proposal requires accountability metadata that introduces a problem none has resolved: the same cryptographic trail that makes an agent's actions auditable makes the human behind it trackable across services.

Standards Consensus

Six Hundred Comments Say Extend What Already Works

NIST's agentic identity concept paper drew over 600 responses. Most favored building on existing frameworks like OAuth and verifiable credentials rather than inventing new infrastructure. But respondents agreed on little else: no consensus emerged on specific mechanisms, trust models, or whether to centralize or decentralize.

Trust Architecture

Persistent Anchors and Disposable Credentials Serve Different Purposes

Commenters drew a line between long-lived trust anchors, tied to hardware or organizational keys, and short-lived credentials scoped to a single task. The anchor answers "who is this agent?" and persists across sessions. The credential answers "what may it do right now?" and expires when the task does.

Capability Certification

A New Draft Separates Proof of Capability From Permission

An experimental IETF draft proposes signed credentials attesting that a specific agent configuration passed defined evaluations. The credential says "this agent demonstrated it can do X." It does not say "this agent is allowed to do X." Authorization systems may require certification as evidence, but the credential itself grants nothing.

Delegation Scope

Each Handoff in a Delegation Chain Narrows Permissions

NIST commenters converged on scope attenuation: when one agent delegates to another, the second agent should hold fewer permissions than the first. The worry is privilege accumulation, where agents passing tasks along a chain quietly aggregate authorizations that no single step intended to grant.