[dispatch] Re: Durable identity for autonomous agents and robots - request for DISPATCH guidance

[Chris Drake <[e-mail]>]

Hi Blake,

Yes - 14.3 lets an agent prove it uses hardware-backed security, without identifying itself (for example - an MTA might spam-score and rate-limit emails with these sigs more favorably).

This series is a foundation, deliberately limited in scope: if relying parties wanted to build useful zero-knowledge applications on it to grant even more useful privacy-preserving, yet still abuse-preventing assurances, that is easily layered on.

What use case did you have in mind?  If any site sees agent identifiers at all, it's almost always going to be in the context of an already-logged-in-user: the site already knows who their customer is, and usually their email and often phone number too.

Choosing to reveal an identity is usually a decision to enjoy the benefits of being willing to be identified: higher limits, less anti-abuse friction, reputation accumulation, legal compliance, insurance, audit, ...

Kind Regards,
Chris Drake


Wednesday, November 4, 2026, 10:10:59 AM, Blake Morrison wrote:

BM> Hi Chris,

BM> Section 14 of the registry draft says the identifier can indirectly
BM> expose the user. I think every site that sees it can still join up
BM> what that person's agent does. draft-morrison-acts-for-01 has the same
BM> problem with its agent key.

BM> Is 14.3 meant to be the answer to that?

BM> Blake


BM> _______________________________________________
BM> dispatch mailing list -- [e-mail]
BM> To unsubscribe send an email to [e-mail]