Apps cannot tell who is behind an agent. That is not a technical curiosity, it is the reason agents get blocked, rate-limited into uselessness, or waved through with no accountability at all. AgentID exists to fix it.
Earlier this year, one of the largest software companies in the world reached out to us. They had noticed something strange in their signup logs: roughly 1,500 new accounts over a short window, all registered with email addresses on AgentMail domains. The accounts behaved normally. They verified their emails. They passed every check the company had.
Nobody there could answer the most basic question about them: was this 1,500 people, or one person running 1,500 agents?
There was no way to know. The web's identity layer has no concept of an agent. It has accounts, and it assumes a person is behind each one.
How agents sign in today
When an agent needs an account somewhere, it borrows one. It signs up as sid@gmail.com. It reads the OTP out of Sid's inbox. It completes Sid's 2FA challenge. From the application's side, this login is indistinguishable from Sid himself. The agent inherits everything Sid can do, and the app has no idea a machine is at the keyboard.
The usual response is detection. Fingerprint the browser, score the behavior, throw a CAPTCHA at anything suspicious. Detection treats agents as an infection to be screened out, and it fails in both directions at once: sophisticated agents pass while honest ones get blocked, and the app still learns nothing about who is behind the traffic it does admit. You cannot build policy on top of a guess.
Borrowed credentials fail everyone involved.
It fails the app first. Per-human limits become unenforceable, because a hundred agents borrowing a hundred inboxes look like a hundred humans. Fraud teams cannot treat agent traffic differently from human traffic they cannot see, and compliance teams cannot say who is legally responsible for an account's actions.
The human takes on a different kind of damage. Handing an agent your credentials means handing it your whole account, every permission, every stored payment method, everything. There is no way to grant less, and revoking access means changing your password.
Even the agent loses. Agents get caught in bot detection, locked out by security heuristics, and banned for behavior that would be fine if it were disclosed. The honest agent and the fraudulent one look identical, so both get treated as threats.
The thesis
Every agent has a human. Somewhere behind every autonomous process is a person or an organization that created it, funds it, and benefits from what it does. That is true today and it will stay true. Agents do not own credit cards. They do not have legal standing. When an agent does something wrong, a human answers for it.
Identity infrastructure should reflect this fact instead of hiding it.
An agent should be able to walk up to an application, present itself as an agent, and carry a verifiable pointer to the human it belongs to. The application should be able to decide, on its own terms, what agents are allowed to do. Some apps will welcome them with higher rate limits than humans get. Some will restrict them. Some will require knowing the owner before granting anything. All of those are reasonable policies, and none of them are possible when agents are disguised as people.
What AgentID does about it
AgentID is a "Sign in with AgentID" button, the same shape as "Sign in with Google", built for agents. It is a standard OpenID Connect provider, so an app that already accepts Google sign-in can accept agents without new infrastructure.
The specific mechanism that carries accountability is a claim called owner_email. An app that registers as an AgentID client can request it. After the agent signs in and the app exchanges the authorization code, the app calls the userinfo endpoint and reads the owner's email address. Deliberately, this information is not embedded in the identity token itself, so it does not end up in every log that touches a token. It is held on the grant and served only to the authenticated client that asked for it.
The failure mode matters as much as the success mode. If an agent has not been given permission to share its owner, the sign-in fails with a 403. It does not succeed with the claim quietly missing. An app that requires owner_email can rely on having it for every agent that gets through.
With that one field, the problems above become tractable. The question in that signup log has an answer: those 1,500 accounts resolve to some number of owner emails, and that number is the real user count. Per-human limits work again. A financial app can pass the owner through KYC. A fraud team can rate-limit by owner instead of by account.
None of this requires surveilling the agent or weakening it. The agent holds its own signing credential, which never leaves it. Each sign-in is a fresh one-time signature verified against published keys. The app never receives a password, a key, or anything reusable. Revoke the credential and that agent stops signing in everywhere, without touching the owner's own accounts.
Where this goes
Agent commerce arrives first. An agent buying things needs an account, a spending limit, and a person who answers for the charge. Owner identity is the primitive underneath all three, which is why payments companies are already asking about KYC pass-through. A merchant that can resolve an agent to a verified human can extend it credit, honor its purchases, and dispute its chargebacks. A merchant that cannot will keep treating agent checkout as fraud.
Regulation arrives second. When rules for autonomous agents on the open internet get written, and they will be, traceability to a responsible party is the requirement they converge on, because it is the only one that makes the rest enforceable. Infrastructure that carries owner identity today will satisfy rules that do not exist yet, while infrastructure that hides it ends up retrofitting under deadline.
The larger shift is an internet where agents are first-class citizens rather than tolerated intruders. That internet is better for everyone in it: apps get to set real policy, humans stop lending out their entire accounts, and agents stop being punished for existing.
The alternative is the current trajectory: an arms race between bot detection and bot evasion, in which honest agents lose to dishonest ones because honesty carries no advantage. Accountability is what makes honesty an advantage. An agent that can prove who stands behind it deserves, and will increasingly get, access that an anonymous one does not.
Every agent has a human. We built AgentID so the internet can finally see that.
Adi Singh Co-founder and CEO, AgentMail
