Your AI Agent Has No Passport: Identity Is the Missing Layer in Agent Architecture
aiarchitectureorchestrationenterprise

Your AI Agent Has No Passport: Identity Is the Missing Layer in Agent Architecture

Within days of customers handing their banking credentials to AI assistants, Citigroup and Bank of America moved to restrict agents from touching client accounts at all (Source: Financial Times, 2026).

·6 min read·Yano.AI Research

Within days of customers handing their banking credentials to AI assistants, Citigroup and Bank of America moved to restrict agents from touching client accounts at all (Source: Financial Times, 2026). Schwab went further and started blocking outside AI tools that try to move money (Source: Bloomberg, 2026). The interesting question is not whether the banks are being conservative. It is what their infrastructure teams understood architecturally that most agent builders still have not.

Infographic

The Web Just Closed the Door

Content delivery is where the shift showed up first. Cloudflare gave every customer a one-click switch to block AI crawlers in July 2025, and more than one million customers took it (Source: Cloudflare, 2025). Within a quarter, reputable sites blocking AI scrapers had climbed from roughly 23 percent in September 2023 to nearly 60 percent by May 2025, with the average blocking site forbidding about 15 crawler identities at once (Source: Technology Checker, 2026).

The traffic split explains why operators felt free to say yes. Cloudflare Radar data for Q3 2026 put 47.62 percent of AI crawler requests in the training category and only 3.66 percent in the live user fetch bucket (Source: Cloudflare Radar, 2026). A large share of the "AI traffic" was never a user at all.

Meanwhile the enforcement layer is thin and inconsistent. Only about 37 percent of the top 10,000 domains on Cloudflare even publish a robots.txt file, and GPTBot is disallowed in just 7.8 percent of the files that do exist (Source: Cloudflare, 2025). The default posture of the open web toward machines is still silence, and silence is not a security control.

Why Silence Is the Worst Possible Default

An agent that hits an unguarded endpoint cannot prove who sent it or who authorized it. So the receiving side falls back on heuristics: user-agent strings, IP reputation, request shape. Every one of those is trivially spoofed. When abuse eventually arrives, the operator cannot distinguish your legitimate automation from a scraper wearing the same headers.

This is why blocking-by-default felt reasonable to publishers. They had no identity layer to allow through, only a deny list to lean on. The fix is not a better prompt. It is a signed, verifiable statement of who the agent is and who sent it.

Identity as a Transport Primitive

The emerging answer is HTTP Message Signatures under RFC 9421, packaged as the Web Bot Auth ecosystem. An agent signs its requests with a public key, and the merchant or its infrastructure verifies that signature before deciding policy (Source: Cloudflare, 2025). Visa's Trusted Agent Protocol applies the same idea to commerce, authenticating agents to merchants through cryptographically signed HTTP requests (Source: Visa, 2026).

Three properties make this an architecture decision rather than a config toggle:

  • Attribution. A signature gives the counterparty a stable agent identifier that survives IP changes and user-agent edits.
  • Delegation. The signature can carry the human principal behind it, so authorization traces back to a person rather than to a service account nobody owns.
  • Policy. Once identity is verifiable, a deny list becomes an allow list. The operator can permit known agents and block the rest, which is the only model that scales past the first few abuse incidents.

Anthropic's move to put lawyers in the loop for agent-negotiated deals points at the same gap (Source: Financial Times, 2026). Contract formation needs an accountable counterparty, and accountability requires identity.

Signed identity answers "is this an authorized agent." It does not answer "did the customer agree to this specific action." Those are separate problems and conflating them is how platforms end up defending themselves in regulators' offices.

Philippine institutions already have the vocabulary for the second problem. BSP Circular 1122 established the Open Finance Framework in 2021, built on the principle that customer consent governs how financial data moves between institutions (Source: Bangko Sentral ng Pilipinas, 2021). The BSP Digital Payments Transformation Roadmap sets the broader target of digitizing 50 percent of payments and bringing 70 percent of Filipino adults into the formal financial system (Source: Bangko Sentral ng Pilipinas, 2023).

That 70 percent target matters for architecture. Every new adult brought into formal finance is a new principal who will eventually authorize an agent, and the consent record has to exist before that authorization does. A system that treats identity and consent as one field will lose one of them.

What to Build Before You Ship an Agent

Start with the boundary where your agent touches someone else's system, because that is where the deny lists are waiting for you. Instrument that call path with signed identity this quarter, not after the first partner blocks you.

Then separate the two records in your schema. One immutable row for who the agent is and who delegated to it. One scoped, expiring, per-action consent record with an audit trail a regulator could read. When a Philippine bank asks for evidence of customer authorization, the second record is what answers them, and no amount of transport-level signing substitutes for it.

FAQ

Why do websites block AI agents if the traffic is mostly training?
Because training fetches and user-initiated fetches look identical at the transport layer until identity is signed. Without a signature, operators cannot allow one category while refusing the other, so they refuse both.

Is robots.txt a security control?
No. It is a voluntary convention honored by cooperative clients. Only about 37 percent of top domains publish one, and it carries no cryptographic claim about who is requesting (Source: Cloudflare, 2025).

Does signing requests let an agent bypass rate limits or abuse controls?
No. Signing establishes identity, which is what makes targeted rate limits and per-caller accountability possible. Without identity, the only available controls are blunt global blocks.

What does this mean for fintechs building on Philippine payment rails?
Design consent as a first-class service with its own storage and audit trail, not a boolean in the user profile. Consent scope, expiry, and revocation need the same engineering rigor as any financial ledger.

Key Takeaway

The agent architecture question of this cycle is not which model to call. It is what your agent proves when it arrives at someone else's door, and what record you keep of the human who sent it. Identity signing closes the first gap, consent records close the second, and the banks that blocked agents early already understood both.

Which gap does your agent architecture close first: proving who the agent is, or proving who authorized it?

Sources

Sources — external references open in a new tab.