Who verifies the verifier? Indicio on the race to give AI agents an identity

The agentic commerce boom analysts have forecast can’t happen safely on today’s infrastructure, according to a whitepaper from Seattle-based decentralized identity company Indicio. The company makes it case in Identity, Commerce, and the Agentic Web, published on September 8, 2026.

The problem is what a credential proves. AI agents typically authenticate with API keys or bearer tokens, which carry a shared secret proving possession of a string, not identity. Steal the key, and you become the agent. Indicio’s answer is to extend the decentralized identity infrastructure it has built for humans to agents: signed credentials that can be independently verified, combined with machine-readable trust lists that help strangers establish trust on first contact.

Why now

The paper arrived during a regulatory opening. The same day it was published, FinCEN and four other regulators issued a joint statement permitting banks to accept verifiable credentials for KYC, which Trevor Butterworth, Indicio’s VP of Digital Strategy & Governance and author of the whitepaper, cited as a way for banks to establish “who do we trust to vouch for this buyer.”

The commercial expectations are large. Bain puts U.S. agentic commerce at $300–500 billion by 2030, while McKinsey projects $3–5 trillion globally. But trust remains a bottleneck: a Gravitee survey of more than 1,600 technical leaders found 46 percent still authenticate agents with shared API keys, while 88 percent confirmed or suspected an agent-related security incident in the past year.

Money is already following the problem. NewCore raised $66 million for enterprise agent identity, Skyfire provides agent identity and payment credentials, and Catena Labs raised an $18 million seed for open-source agent identity protocols. The broader field spans payments, identity and enterprise governance.

Payments currently have the bigger ecosystem behind them, with initiatives including Google’s AP2/UCP, Visa’s TAP and Mastercard’s Agent Pay. Identity beneath those transactions is the gap Indicio is staking a claim to. Its move toward agents predates the whitepaper: it joined Nvidia’s Inception Program in October 2025 and took a NEC X investment the following month.

Where the opportunity lies for retailers

For retailers, verifiable identity could determine which businesses agents are willing to transact with. Sellers that can prove their identity, inventory and commercial terms through machine-verifiable claims become easier for buyer agents to trust.

Lower-cost credential verification could also make smaller or cross-border transactions economical while reducing fraud. DataDome found spoofed agent identities received a free pass on roughly 80 percent of sites tested.

Verifiable credentials could also let buyer and seller agents negotiate without revealing sensitive information. A retailer’s agent, for example, could confirm that a buyer is authorized to spend up to the amount needed for a purchase without learning the buyer’s actual spending limit. The seller could similarly enforce a minimum acceptable price without revealing that price to the buyer. The agents learn only that the conditions needed to complete the transaction have been met.

A novel approach to agentic authority

Most competitors solve this payments-inward: prove you can pay, then figure out identity. Indicio approaches the problem identity-outward, applying an architecture it already uses for humans, including biometric-bound, government ID-anchored credentials, to machines.

The choice of credential format is deliberate. Indicio supports mobile driver’s licenses under ISO 18013-5 and 18013-7, but argues that mDLs are designed around standardized driver’s-license data. VCs offer more flexibility when claims extend beyond those attributes, including richer interactions among issuers, holders and verifiers. Indicio’s position isn’t that one format replaces another, but that different credentials serve different jobs.

For AI agents, that distinction matters. An agent may need to prove not only identity, but who it represents, its capabilities and what authority has been delegated to it. Independent research from Technische Universität Berlin points in the same direction. Researchers built a multi-agent prototype using DIDs and VCs in which credentials encoded roles, capabilities and authorizations, and identified VCs as a mechanism for human-to-agent and agent-to-agent delegation.

The result is less a choice between mDL and VC than a division of labor. An mDL might prove an attribute about the person behind an agent; VCs can express the broader authority and trust relationships the agent needs to transact. The Berlin researchers demonstrated agents using such credentials to establish trust across organizational domains.

Consider a traveler telling an agent: “Book an aisle seat, don’t pay more than $1,500.” With Indicio’s model, the travel agent can verify the airline agent’s identity using a verifiable credential and a trust list. The airline agent can request proof of spending authority in return. A signed mandate binds the amount, counterparty and transaction together so it cannot be replayed.

The architecture separates reasoning from authority. The agent’s intelligence can run in the cloud, while the person’s key and credentials remain on their device. The agent requests authority and receives a signed mandate. If the device is offline, DIDComm can hold the encrypted request until it reconnects.

Butterworth calls AI agents “superhuman identities.” Unlike traditional non-human identities, they can act at machine speed across potentially millions of users. If authority remains centralized with an AI provider, he argues, a failure could create “staggering liabilities,” from unauthorized transactions to deleted databases.

His answer is to move authority to the edge. A user’s phone can “act as if it has an API,” with permissions and business rules enforced locally rather than giving unrestricted authority to the AI provider.

From proven to promised

Indicio’s roadmap starts with technology already deployed for humans. Its Proven platform issues and verifies W3C credentials and is used with airlines, airports and financial institutions for KYC and KYB, although those deployments are not themselves agent-facing.

Indicio has demonstrated an AI agent verifying a human credential without human review. The company used a Digital Travel Credential (DTC) containing an authenticated biometric to verify a person before granting access to a large language model in an implementation Butterworth described as its “first step.”

Existing credentials could also reduce authentication fatigue. Rather than asking users to authenticate every agent interaction, agents could present proofs derived from KYC or digital travel credentials, while users establish broader permissions governing what agents are allowed to do.

The architecture is intended to work across credential types. Butterworth said Indicio is building for interoperability so software can select the appropriate credential behind the scenes, whether an mDL, DTC or another format. He also pointed to selective disclosure and non-linkability as important for agentic commerce, including preventing sellers from using persistent identity information to personalize prices.

The more ambitious architecture remains ahead. Agent-to-agent mutual authentication, delegation and machine-speed trust establishment are part of the target model. Indicio has also built an early demonstration in which an agent presents multiple credential types to satisfy a user’s request, although at the time of the interview the company was still deciding whether it was ready to show externally.

That leaves a gap between what Indicio has demonstrated and the larger vision in the paper. It has shown that an agent can verify a human credential. The broader thesis depends on unfamiliar agents being able to identify each other, establish delegated authority and transact at machine speed.

Where this leaves us

The unresolved question is whether agent identity becomes part of the payment layer or a standalone trust layer. Payments platforms are moving quickly, while Indicio and other identity providers are betting that agents will also need portable ways to prove who they are and what they are authorized to do.

There is a more immediate privacy issue. Helen Garneau, head of marketing at Indicio, argued in the interview that users entering personally identifiable information directly into largely unregulated chat interfaces creates GDPR and liability risks for companies.

Butterworth’s warning goes further. He argues that centralized authority combined with agents operating at machine speed creates the possibility of a highly visible failure. His analogy is “a Three Mile Island event” for AI: a catastrophic, human-understandable failure that could trigger severe regulatory backlash.

Indicio has demonstrated the narrower proposition that an agent can verify a human credential. What remains unproven is the larger one: whether identity and authority can be pushed to the edge while supporting agent-to-agent commerce at scale. The race now is to build that trust layer before agents begin transacting at the scale their proponents expect.

Article Topics

agentic commerce  |  AI agents  |  biometrics  |  decentralized ID  |  digital identity  |  Indicio  |  verifiable credentials