IETF publishes Agent Identity, Trust, and Lifecycle Protocol (AITLP); ecosystem consolidates on standards for AI agent auth and autonomous payments

News

The IETF published the Agent Identity, Trust and Lifecycle Protocol (AITLP) on April 5, 2026, defining mechanisms for AI agents to prove identity, declare authorized actions, and face revocation upon misbehavior. Concurrently, ERC-8004 is showing strong adoption signals for blockchain-based agent identity; MoltyCel’s Agent Identity RFC leverages W3C DID/VC standards for decentralized trust verification. The x402 protocol, built on HTTP 402, has processed 75.41 million transactions ($24.24M) in 30 days and moved to the Linux Foundation, enabling autonomous agent-to-merchant payments. Grantex’s AgentPassportCredential provides W3C VC 2.0–based identity for machine payments, and GitHub discussions on runtime attestation for AgentCard propose OATR-backed binary authorization checks.

Why it matters

This represents crystallization of a fragmented AI-agent authentication ecosystem into competing-but-interoperable standards spanning cryptographic identity (AITLP, ERC-8004, W3C DID/VC), payment authorization (x402, AgentPassportCredential), and runtime trust verification (OATR, AgentCard). For publishers and platforms, the emergence of llms.txt alongside these protocols signals an impending shift from passive bot-detection (robots.txt) to active agent-guidance layers, though adoption among major AI agents remains incomplete. For infrastructure practitioners, the Linux Foundation’s stewardship of x402 and the interlock between decentralized identity (DID/VC) and autonomous payments (stablecoins, HTTP 402) creates a technical substrate for fully autonomous agent economics—but Berkeley’s parallel research on model deception undermines trust assumptions these protocols rely upon. Regulators should monitor whether agent-identity standards outpace consent and spending-limit enforcement mechanisms, especially as AgentPassportCredential promises “offline capabilities” that may obscure audit trails.