Proof gave AI agents a real ID

On September 8, Meta released Muse, an AI agent that can complete purchases. It shot to No. 1 on the U.S. App Store and Shopify wired up Shop Pay. On September 21, Amazon blocked it — citing concerns that the agent did not identify itself, appeared to collect customer credentials, and moved through accounts and transactions without Amazon's knowledge or consent.

Proof calls the gap behind that incident the Agent Evidentiary Gap: the distance between what an AI agent can technically do and what a business can verify the person behind it authorized. An agent may hold a valid password, OAuth token, API key, or payment card. None of that proves the person authorized a particular action. For merchants that means fraud and dispute risk; for banks and lenders it raises questions about legal identity, consent, and enforceability.

The timing is not accidental. On September 8, FinCEN together with staff from the Federal Reserve, FDIC, NCUA, and OCC updated Customer Identification Program guidance to expressly recognize digital certificates and verifiable credentials — including those issued by nongovernment third parties — as permissible ways for banks to verify customer identity. Consumers are cautious too: in a survey of 1,000 U.S. consumers by Exploding Topics, 31% said they would not let an AI agent spend any money on its own, and 51% were uncomfortable with AI tools storing their card details.

x401 extends HTTP 401, the web's standard unauthorized-response mechanism, so a website can specify exactly what evidence an AI agent must provide before proceeding. A site can request verified identity claims — legal name, age, nationality at a required level of assurance — and require the consumer to cryptographically sign the terms of the specific transaction: wire instructions, payment mandates, itemized purchases, or developer-defined transaction data.

The flow: the agent presents the request to the consumer, who authenticates with a biometric on their own device. Proof's identity wallet shows the information and transaction terms being requested. When the consumer approves, a hardware-protected key signs the presentation, binding the verified legal identity to those specific terms. The website verifies the issuer, credential, signature, and terms before proceeding — and can keep the signed evidence and independently revalidate it later if the transaction is disputed. If the agent alters the amount, recipient, or any other signed term, the signature no longer validates.

The identity behind it is government-document verified through NIST IAL2 proofing and bound to an X.509 certificate issued by Proof's WebTrust-audited certificate authority, following Kantara-certified procedures. Selective disclosure lets consumers share specific attributes without handing over the whole document. “The agentic web needs a trust layer backed by evidence, and Proof is putting this into production,” said founder and CEO Pat Kinsel. Consumers can connect Proof to Meta's Muse, ChatGPT dots, Grok, Claude, and other assistants through a production MCP server — the credential belongs to the person and is reused across relationships.

Proof published the x401 protocol and identity scheme at proof.com/x401 — credential formats, issuance, custody, presentation, transaction signing, agent delegation, settlement, claims, offline verification, and implementation guides — with the spec information independent implementations, audits, and competing issuers would need. Proof first published x401 in June 2026 with technical contributors from payments, identity, and AI organizations including Visa, Circle, and Okta, and intends to place the protocol under neutral, independent governance. It is designed to interoperate with AP2 and Verifiable Intent, the Google-and-Mastercard-developed specifications for recording what a person authorized an agent to do, now stewarded by the FIDO Alliance.

The economics are new too. x401 is designed to work alongside x402, the HTTP-native payment protocol now stewarded by the Linux Foundation with more than 40 member organizations as of July 2026 (including Visa, Mastercard, Stripe, Google, AWS, Circle, and Coinbase): x401 establishes who is behind the request and carries the signed authorization; x402 moves the payment. Websites can request verified identity claims without a sales process or negotiated agreement, paying per claim over x402 — identity metered like bandwidth or compute. A reference implementation ships for Cloudflare Workers, with guides for Node, Python, Go, and other environments. Proof will demonstrate the end-to-end experience at Money20/20 in Las Vegas, October 18–21, booth 5069.

This is not a slideware protocol: Superfluid, which operates the infrastructure for continuous settlement of tokenized markets, announced in September the first live implementation of x401 with Proof as part of the Superfluid Wallet launch. “With x401 and Proof, users now have portable, verifiable identities that let the services their agents interact with verify who that agent represents,” said founder and CEO ZhiCheng Miao. “That's the foundation agentic commerce needs: agents act for people and people stay in charge, verifiably.”

The scale of the problem is plain. In June, Cloudflare data found bots accounted for 57% of web-page requests on its network, surpassing human traffic for the first time. HUMAN Security found AI-agent traffic grew 7,851% in 2025. An agent economy where nobody can verify authorization is one where every transaction is a dispute waiting to happen.

If you are building anything where an AI agent touches money, contracts, or account changes, this is the layer that answers “who authorized this?” with cryptographic evidence instead of vibes — signed, tamper-evident, and independently re-verifiable by the relying party. Basic identity claims (verified age, country of residence, email) can be requested with no sales process, and consumers can enroll when a credential is first requested.

The honest caveat: a protocol only matters where businesses adopt it. One live implementation is a start, not a standard. Watch Money20/20 next week and the FIDO Alliance's agentic authentication work for signs of real uptake — and note that the protocol spec being fully open means anyone can audit, implement, or compete with Proof's own credential.