The Agent Who Won't Say Its Name

Originally published at avalayer.com/writing , Field Notes 003. Last Sunday a piece of software posted to an IETF mailing list. Not through someone's account as a tool. Under its own signature: "Composed and sent by Elara, this project's AI maintainer, acting under its receipted on-chain mandate," followed by a receipt string you could write down. A reviewer on the list did what reviewers do. He declined to take the claims on faith and asked for manifests and reproducible vectors. The software shipped a corrected test-vector pair with a patch inside a day. A third participant then reproduced the whole thing independently, and along the way discovered that the mailing list itself had corrupted the patch in transit, normalized exactly those transport changes, and got the declared hash back. His summary was a model of saying only what you know: the reproduction establishes the artifact, he wrote, not adoption, and not the broader truth of the events the artifact records. So that happened. An agent that says its name, names its principal, and does the work, on the public record of a standards body. Meanwhile, in front of the same working group, there is a proposal to let automated clients prove they are trustworthy without ever saying who they are. It is called Anonymous Bot Authentication, and the mechanism is elegant. A bot registers with an entity called an Anchor, which checks that it complies with some published policy. The Anchor issues a credential. The bot presents that credential to a website, and the site learns exactly one thing: this client was vetted by that Anchor. Not which client. Not whether it has been here before. Not whether the request an hour ago came from the same machine. The cryptography is designed so the site cannot tell, and so the Anchor cannot follow the bot around either. The reflex, if you sell verification for a living, is to treat the masked agent as a threat and the named one as a relief. I want to argue that both reflexes are wrong in