Imagine every AI agent carrying a lifelong number that never changes when its software, owner or credentials do, the way a domain name outlives the server behind it. That is what the Agent Identity Registry System proposes, in revision 04 of an IETF draft dated 25 September 2026. It is an individual, Experimental submission, and it asks for something big: one global registry and, for its strongest trust levels, specific hardware. Ignore it for now; revisit if several vendors say they accept these identifiers.
What it is
Each identity is a URN (a standard naming format) in a new aid namespace, for example urn:aid:global:id-qkckh-xxtcw-cxbvp-gpskg. The identifier is meaningless by design: it carries "no issuer, no date, no sequence, no vanity value". Human-readable handles can point to it, but they are a separate, commercial layer. Anyone can resolve an identifier through a public lookup profile built on RDAP (a web service for looking up registration data), and registrars hand out sender-constrained OAuth tokens naming the identifier, so a service can check that the caller holds the key it claims.
How it works
The draft defines five trust tiers. Think of them as how hard it is to copy or fake the key behind the identity:
- Sovereign: a TPM 2.0 chip (the security chip in many computers), with the maker vouching for it. Strongest.
- Portable: a smart card or security token.
- Enclave: keys inside a hardware enclave, without a claim that one physical unit means one identity.
- Virtual: a key protected by a cloud provider or hypervisor.
- Declared: a software key with no hardware assurance.
The draft stresses that a tier describes "properties of the proof mechanism, not the behavior or worthiness of the identified entity". Three roles share the work: a governance authority sets policy and keeps the list of accepted hardware, a single registry operator runs the global database that guarantees uniqueness, and competing registrars check enrolment evidence and issue tokens.
What it costs
The price is concentration and hardware. The draft calls the single registry "singular but not unaccountable", relying on escrow and succession rules. Relying parties must trust whichever registrar checked an enrolment. Lose the only hardware behind a strong identity without a backup device, and control "cannot be re-established through AIRS", which the draft presents as deliberate. And the registry is "not a behavior or reputation authority": an identity cannot be revoked, erased or reassigned, so a permanent number tells you it is the same agent, not that it deserves trust.
The draft lists an implementation at 1id.com and two relying parties, MailPal.com and geek.au. I read the first two thirds of a long text and not the section that describes them, so I cannot say how real that adoption is. The draft expires on 29 March 2027.
What to do
Ignore for now. The idea of an identifier that outlives any one operator is worth understanding, but it needs a global authority and new hardware habits that nobody has agreed to. Revisit if several vendors say they accept these identifiers.