A registry that lists AI agents has two jobs that are easy to get wrong: saying whose agent a record describes, and deciding which records may be shown. Version 1.8.0 of AGNTCY's Agent Directory, released on 15 October 2026, changes both, and each change is an idea worth copying even if you never run this software. Watch, and borrow the shadow-before-enforce pattern for any publish-time checks you build; do not adopt the record format on this evidence.
Identity claims that can fail
A publisher signs a claim about who stands behind a record using the project's command-line tool. A background job then checks the claim against the subject's current keys, across DNS, HTTPS, did:web, did:key and SPIFFE (different ways of proving "this key belongs to this name"). The result can be read back or used to filter search. The release notes say the useful part plainly: "A rotated key or revoked certificate flips a claim to failed on the next run." A claim is not a one-time stamp; it is re-earned every time the checker runs. Claims that use the Agent Name Service are trusted once a listed transparency log attests the agent's certificate.
Rules you can try before they bite
Operators can write content rules in OPA (Rego) or CEL, two policy languages, and the node evaluates each record as soon as it is pushed. Search and fetch can be switched from off to shadow, which shows what a rule would hide without hiding anything, and only then to enforce. Once enforced, "excluded records are withheld from search, pulls, the peer RPC and publication", while named auditors can still read the withheld records through a new audit service. A dry-run command lets you test a rule on real records first.
What else is in the release
Other changes are mostly housekeeping: two maintenance jobs move into the reconciler, runtime workloads can be listed by more attributes, listing is faster, and the command-line tool is on WinGet. Upgrading is not free: the release removes the naming service and its command, drops a database table on upgrade, removes one subcommand (the MCP server must now be installed separately), changes how registry credentials are granted (each syncing peer now needs its own rule naming its SPIFFE identity) and renames some settings.
What to do
Watch. The two ideas to take away: a signed claim that visibly fails when the key behind it changes, and a shadow mode that shows what a rule would hide before it hides anything. If you run this directory, read the breaking changes before upgrading.