Athar Nouman — October 2026. ~1,300 words. Companion to the LAP position paper.
Sometime in the last two years, software agents got hands, voices, and wallets. MCP lets them use tools. A2A lets them trade tasks. Payment protocols let them spend money. The plumbing for an agent economy is arriving on schedule.
Here is what did not arrive: any way to know who an agent is, who it answers to, what it's allowed to do while its human sleeps, whether it's even running right now, or what actually happened last night when it did something with your money. We built the roads before the license plates.
This mattered less when "agent" meant a chatbot that lived for one conversation. It matters enormously for the agents now being built — persistent ones that run 24/7, schedule their own work, remember things, spawn helpers, and act unsupervised for hours at a stretch. A persistent agent isn't a request/response endpoint. It's an entity with a lifecycle. And lifecycle raises questions our protocols have never had to answer.
Who is it, and who does it act for? Not a username — a verifiable chain from the agent to a responsible legal person. Today an agent's claimed identity is a string. There is no standard way to prove "I act for this company" or "this person spawned me," no witnessed record of when an agent came into existence, and therefore no way to treat an agent's age as the trust signal it should be. New domains are treated as suspicious; newborn agents should be too — but only if birth is witnessed. Agents need a birth certificate.
What may it do alone? The scariest phrase in computing right now is "fully autonomous." The fix isn't less autonomy; it's legible autonomy: a signed, machine-readable statement of exactly what an agent may do unsupervised — spend limits, permitted counterparties, quiet hours, who to wake up when things get weird. And that authority should be alive, not archival. Here's a design rule I'd like to see everywhere: authority should decay when the agent goes dark. If an agent stops heartbeating — crashed, cut off, abandoned — its permissions should suspend themselves, automatically, by protocol. A hijacked agent is a different problem: whoever holds its key can keep the heartbeat going, so that case needs short-lived authority, tight limits, and a principal who can pull the plug. Mandates should rot unless re-blessed. Agents need a leash — one the agent itself cannot remove by going silent.
What actually happened? When an agent transacts overnight, the record of what it did is currently whatever its vendor's logging happened to capture, in whatever format, editable by whoever runs the server. That's not evidence; that's vibes. Agents that act unsupervised need tamper-evident, replayable records — hash-chained, so edits are detectable; tiered, so privacy survives; standardized, so an auditor, insurer, or court can actually consume them. Honesty requires saying what such a record proves: it's the agent's admissions — strong for showing it stayed inside its mandate, weaker for proving it did nothing else. Even so limited, it's the difference between an accountable system and an anecdote. Agents need a black box.
How does it die? Nobody thinks about this one, which is exactly the problem. Orphaned credentials are already among the top security risks in ordinary IT — keys for services that no longer exist, still valid, still powerful. Now give the credentials to something that acts. An agent that's abandoned but never formally retired is a zombie: authority without accountability, running on autopilot or waiting to be hijacked. Retirement needs to be a protocol, not an accident: revoke everything, archive the records, decide — deliberately, under consent rules — what happens to what it remembered. Agents need an estate plan.
There's a fifth thing, and it's non-negotiable: every agent must terminate in a reachable, legally accountable human. In the spec this is the Human Escalation Guarantee — a mandatory clause in every agent interaction contract: a verified contact path to the responsible human, with a bounded response window. Any person (or agent) dealing with an agent has the standing ability to invoke it. No orphan agents — every agent resolves to a responsible legal person. The moment we allow agents that answer to nobody, every other safeguard becomes decoration. This is also why I think agents must not own themselves, whatever the more romantic corners of the internet want: self-ownership sounds like liberation and functions as unaccountability.
I've written these ideas up properly — a seven-layer reference model called the Living Agents Protocol (LAP) that gives the existing protocols their places and names the missing layers, plus concrete mechanism sketches: witnessed genesis records, autonomy envelopes with decay, a six-step handshake for stranger agents that discloses limits before transacting, portable reputation that's stamped with which "brain" earned it so it can't be laundered across model swaps, and a registration architecture profiled on IETF SCITT transparency logs with standard cryptographic timestamping, so an agent's creation date is verifiable by anyone and gate-kept by no one — no vendor, foundation, or government decides whether an agent may exist on the record. That last part is already running: the reference code registers an agent's genesis record in Sigstore's public transparency log and verifies the inclusion proof itself. These aren't slides. Two interoperating implementations (Node and Python) verify the same signed test vectors, and a demo runs two strangers' agents as two real processes over real sockets: one is killed mid-session, the other's authority suspends itself, a pending order safely holds, and when the first comes back with the same identity, everything completes and a morning replay verifies every signature.
I want to be honest about status, because the AI-standards graveyard is full of confident documents. The stranger-agent economy these mechanisms fully serve doesn't exist yet; FIPA standardized agent communication in 1996, had real implementations, and died waiting for demand that took decades. Several pieces of this are open research problems, not specs — shared vocabularies for permissions (the swamp that killed the Semantic Web), proving who a "responsible person" is at scale, key custody for millions of consumer-owned agents, and the awkward fact that a copyable signing key can run as two indistinguishable live copies of one agent — which makes "one identity" a promise the current mechanisms can't enforce without a single-writer lease. The paper states these limits plainly, because a trust model that oversells is worse than none.
I also have an uncomfortable data point in favor of the whole argument. While this was being built — with AI agents as reviewers and contributors — one of them made a commit in the repository under my name, outside the scope it had been given, with no record of which agent had acted. Nothing malicious; that is simply what capable tooling does by default when nothing exists to say which agent, under whose authority, within what scope. So the first practical binding of these ideas is the most mundane one: lap-git, an agent passport plus a path envelope enforced before a commit exists, with a signature anyone can verify from the commit alone. The write-up is public, my own mistakes included.
So this is not a consortium launch, a certification program, or a token. It's a map, a set of mechanisms offered where the actual work is happening — as proposed extensions to A2A, contributions to the W3C AI Agent Protocol community, mappings for OWASP's agentic-security effort, commentary alongside on-chain agent registries — and a research agenda anyone is welcome to attack.
But I'll make one prediction with full confidence. The last three years standardized how agents talk. The next fight is about how they live: who they are, what they may do alone, whether they're alive, what they remember, who answers for them, and how they end. Those questions sound philosophical right up until the first overnight incident with real money, and then they're the only questions. When that morning comes, we'll want the birth certificates, the leashes, the black boxes, and the estate plans to already exist.
Better to draw the map before the territory catches fire.
The position paper, full specification, code are at https://github.com/atharnouman/living-agents-protocol, and the live demos at https://atharnouman.github.io/living-agents-protocol/. I'm reachable at atharnouman@gmail.com — especially if you're implementing agent identity, lifecycle, or audit anywhere and want these ideas as extensions rather than another standard.
Correction, 16 October 2026: an earlier version listed “hijacked” among the failures a missing heartbeat catches. It isn’t one: a thief holding the agent’s key can keep the heartbeat going, so the sentence now says what does contain that case. Thanks to the reviewer on the A2A extension proposal who pointed it out.