AI agent identity: GoDaddy, Google, Cloudflare’s trust chain
GoDaddy, Infoblox, Google and Cloudflare have demonstrated an open reference architecture — the “Chain of Trust” — that lets AI agents complete transactions across independent online platforms using internet standards that already exist. The companies unveiled it at GovWare 2026 during Singapore International Cyber Week, developing it with Singapore’s Infocomm Media Development Authority, based on principles in IMDA’s Model AI Governance Framework for Agentic AI.
The problem it addresses is becoming urgent. As people use AI agents to search for products, compare prices and complete purchases on their behalf, a merchant needs to know whether the agent acting for a buyer is genuine, authorised and trustworthy. Today, most platforms answer that question in closed, incompatible ways, leaving businesses with little visibility into how another platform verified an agent. The chain is an attempt to make that verification open, layered and checkable by anyone. For businesses, the significance is straightforward.
When an autonomous agent buys on someone’s behalf, the transaction has no human at the keyboard, so the trust that normally comes from a person clicking ‘buy’ has to reconstruct in code. AI agent identity — proving which agent acts, for whom, and with what authority — is the foundation that reconstruction rests on, and it is the gap this architecture means to fill.
The problem: who verifies an agent?
AI agent identity is harder than it sounds. A website presents a certificate and a user decides whether to trust it; an AI agent acting autonomously across many sites needs a durable identity that any counterparty can verify, plus proof of what it may do and on whose behalf. A merchant accepting a purchase from an agent wants three things: that the agent is who it claims to be, that a human authorised this specific transaction, and that a record exists if something goes wrong.
Closed systems struggle with all three, because each platform’s verification is invisible to the next. That is the gap the Chain of Trust targets — not by inventing a new central authority, but by composing existing standards into a sequence of independent checks. That is why this is a problem of trust, not authentication alone. A login proves a user is present; an agent may act for hours without a human watching. A merchant therefore needs a verifiable chain — identity, authorisation and a record — that survives the absence of a person. Closed systems break that chain at every platform boundary, which is the fragmentation the architecture targets. AI agent identity is the thread that has to hold across those boundaries.
How the chain works
The architecture has seven layers, each mapped to an open standard. Discovery uses Agent Resources Discovery or DNS-based lookup to find which agents exist and where they run. Identity establishes a registered identity anyone can verify from public evidence — via the Agent Name Service and SPIFFE for each running instance — rather than a certificate an agent presents in a single session. Authorization establishes who controls an agent and what it may do, using OAuth. Communication uses A2A and MCP to let agents reach tools and one another. Payment carries the person’s signed authorization and the agent’s identity into checkout, using the Agent Payments Protocol (AP2) and the Universal Commerce Protocol (UCP). Traceability records what happened in an append-only log with a signed receipt. And trust turns a verified identity into an evidence-based score computed from public attestations rather than self-description.
The layering matters because each check is independent. Passing discovery does not imply a verified identity; a verified identity does not imply a valid payment mandate; and a valid mandate does not imply that the agent is trustworthy. By keeping the layers separate and verifiable on their own, the architecture prevents a single weak link from being treated as proof of the whole — a design that mirrors how mature security systems avoid single points of trust. For AI agent identity, that separation is the difference between a claim and a check.
Most Independent Documentation
The AP2 layer is the one with the most independent documentation. AP2 defines signed “mandates” — a checkout mandate and a payment mandate — that give a merchant cryptographic proof that a shopping agent has authority to complete a specific purchase, and AP2 works with UCP by design. That is the mechanism behind the release’s claim that a person “sets what an agent may buy and how much it can spend,” and that merchants and payment providers can check every purchase against it.
The demonstration
The GovWare demonstration simulated an agentic purchase of a flight from Madrid to Singapore, among agents that did not know each other in advance and did not run on the same platform. The buyer agent ran on AWS, the seller agent on Cloudflare Workers, and the mandate authority and verifier on Google. A person approved the purchase with a passkey; an approval service issued signed mandates; the buyer agent found a seller through DNS and the discovery layer; it checked the seller’s identity against the public log and its trust score against the person’s minimum requirement; and the purchase completed over UCP with payment through Stripe. The demo also included rogue scenarios — a look-alike seller and forged credentials — which the chain stopped before a transaction occurred, with every step written to an inspectable log.
That the same chain ran across three clouds is the point: because each layer uses open standards, the architecture is not tied to one vendor’s system. It is a claim about portability as much as security. The simulation is a useful proof of concept, but its limits are worth stating. A demonstration run by the architecture’s own authors, over a mock purchase, cannot establish that the chain holds under real adversarial pressure at scale, and the rogue scenarios it blocked were designed by the same teams that built the defences. That is not a criticism so much as a boundary: a demo shows the design is coherent, not that it is battle-tested.
Why open standards matter
The strategic choice here is to build on infrastructure the internet already runs on. Reusing DNS for discovery and SPIFFE for instance identity means the trust layer inherits the internet’s existing, widely deployed naming and identity foundations rather than requiring a new one. “We don’t need to rebuild the internet for AI agents,” said GoDaddy’s chief strategy and legal officer, Jared Sine, in the release — a line that captures the architecture’s philosophy.
There is also a governance logic to the open approach. A closed verification system concentrates the power to decide which agents are trusted in one company, which is a poor fit for a global, cross-border payments system. Distributing that decision — to businesses, governments and anyone who can check a public log — aligns with how the internet’s trust infrastructure already works, and with the accountability principles IMDA’s framework sets out.
But the open-standards framing is also a competitive position. Agentic commerce is a contested field, with rival protocols emerging from platform vendors, payment networks and AI companies, all competing to define how agents pay and prove who they are. A reference architecture backed by four significant companies and a national regulator is an attempt to shape that market — and the market looks large, with the release citing a McKinsey estimate of $3 trillion to $5 trillion in global consumer purchases facilitated by AI agents by 2030. Whoever’s standards win a market that size has influence over it.
What to watch
For the companies, the test is adoption: whether DNS operators, registrars, identity providers, payment networks and platforms actually implement the architecture, and whether it interoperates with rival protocols rather than fragmenting alongside them. For businesses, the practical question is whether open verification of AI agent identity reduces the risk of transacting with agents, and whether it becomes something they can rely on rather than a demo. And, for regulators, the appeal is a governance-aligned architecture that keeps control distributed — the IMDA involvement suggests Singapore sees agent identity as a public-interest concern, not only a commercial one.
What the announcement does and doesn’t establish
It establishes an open reference architecture, a cross-cloud demonstration, a set of mapped standards and an invitation to adopt. It does not establish production deployments, adoption timelines, a business model or independent security testing, and the demonstration was a simulation rather than live commerce.
The honest summary is that four companies and a national regulator have proposed a sensible, standards-based answer to a real problem: as agents start spending money, someone has to be able to verify who they are. Reusing DNS and existing identity standards is a pragmatic choice, and the layered design — each check independent — is sound. But this is a reference architecture and a demo, not a deployed system, and the agentic-commerce standards race is far from settled.
For readers, the practical takeaway is to watch the standards, not the announcement. AI agent identity will turn on what registrars, payment networks and platforms implement over the next year or two, and on whether the competing protocols converge or fragment. The Chain of Trust is a credible entry in that contest; it is not yet the answer. The value will show up when merchants, registrars and payment networks implement the chain, not when a company demonstrates it.
Editor’s Note: This article draws on the GoDaddy/Infoblox/Google/Cloudflare release, the Agent Payments Protocol (AP2) specification and Google’s announcement, IMDA’s Model AI Governance Framework for Agentic AI, and independent protocol comparisons. The architecture, the demonstration and its results are as described by the companies; the market projection is a McKinsey estimate. No production deployments or timelines were disclosed. No interview was conducted.