Open AI agent identities move from concept to governance-ready standards

Vint Cerf, the co-creator of TCP/IP, is backing a new standard called DNSid that gives AI agents verifiable identities rooted in existing domain name infrastructure. For AI builders, this matters because every autonomous agent operating outside a walled garden currently lacks a trusted way to prove who it is, what it can do, and who is responsible for its actions. The DNSid proposal, developed by Innovation Labs (a subsidiary of Identity Digital), ties each agent identity to an internet domain name using cryptographic proofs, making it possible to audit an agent's registration and authority over time.

What happened

Vint Cerf joined Innovation Labs as an advisor to help define open identity standards for AI agents, shortly after leaving Google following a 20-year tenure. Innovation Labs, a subsidiary of the DNS registry company Identity Digital, is testing DNSid with several unnamed hyperscalers and identity companies. The company has also submitted an Internet-Draft to the IETF proposing an open architecture framework for durable AI agent identity built on existing DNS infrastructure.

Why AI builders should care

Most AI agents today operate in proprietary systems. As agents begin to act autonomously across the open internet, they need a standard way to answer three questions: What authority does this agent have? Where did that authority come from? Who is accountable for its behavior? DNSid addresses these directly by linking agent identities to domain names with cryptographic proofs.

For builders shipping multi-agent systems, third-party agent integrations, or marketplace workflows, this standard could become the trust layer for agent-to-agent communication. Instead of building ad-hoc authentication for every external agent, teams could rely on a shared DNS-based identity registry.

Practical implications

If DNSid gains adoption, the practical impact for AI builders will show up in several ways:

• Verifiable agent provenance: Any agent claiming to represent a company can be checked against that company's DNS record. A shopping agent saying it works for a retailer can cryptographically prove its registration.
• Auditable agent logs: Every registration is recorded with cryptographic proofs, enabling audit trails for compliance, insurance, or dispute resolution.
• Cross-provider interoperability: Cerf emphasized that agents from different providers must interwork, and that user demand drives protocol adoption, just as it did with TCP/IP. Builders who align with open identity standards early may find it easier to connect with external agent networks.

Innovation Labs interim CEO Allie Kline stressed that the proposal does not include broader AI business plans or ownership of registration data, addressing the concern that a single company would control agent identity data.

Caveats

While the direction is significant, the standard is still early stage. DNSid has been submitted to the IETF as a draft, but it is not yet a final protocol. The big-name hyperscalers testing it remain unnamed, so there is no public confirmation of production-level adoption. The governance model for agent identities, including who can register agents, what commitments registrants make, and how identities can be revoked, is still under discussion. Cerf himself noted that the questions around agent authority and accountability are thorny. Builders should monitor DNSid as a potential standard, but avoid betting on it as a hard dependency until concrete adoption commitments emerge.