Proof, an identity infrastructure company, has launched x401, an open protocol that gives websites and APIs a standard way to ask an AI agent to prove who authorized it before it acts. The company describes it plainly: x401 is an open, issuer-neutral protocol that lets any website or API ask for and verify the identity behind agents. When a server needs proof, it returns a 401 response with a challenge specifying the required credential type and accepted issuer, and the agent's client presents a cryptographic credential proving a verified human authorized the action within an approved scope. The design deliberately avoids picking a single identity winner. A service can ask for verified identity, age, membership, organizational affiliation, signing authority, proof of humanness, or another trusted claim, and the agent presents a compatible credential while the service verifies the issuer, claim, scope, and action before proceeding. That separation lets one protocol support many forms of authority without forcing adoption of a single identity provider or credential model. The first live implementation, Proof ID, is a W3C Verifiable Credential issued after IAL2 identity proofing, signed by a WebTrust-audited Certificate Authority and bound to a key the user controls — putting a chain of custody behind agent actions that currently doesn't exist in any production spec. The gap this targets is real: agentic payment rails went live without settling who issues the credential linking a transaction back to a verified human, leaving fraud and impersonation as open problems industry-wide. What makes this more than a vendor announcement is the standards path. Proof says it will submit x401 to the FIDO Alliance's agentic authentication standards workgroup, the same body that in April formed an Agentic Authentication Technical Working Group drawing on contributions from Google's AP2 and Mastercard's Verifiable Intent. That puts x401 in direct company with the payment-specific approaches already circulating this year — Mastercard's Agent Pay tokens, Visa's Trusted Agent Protocol attestation headers, and Google's AP2 — each of which anchors trust differently (card network, acquirer, or issuer-signed credential) but all of which are converging on the same underlying question: how does a merchant or service distinguish a legitimately delegated agent from a scripted impersonator. x401's bet is that identity should be a general HTTP-layer primitive rather than something bolted onto each payment rail separately. Whether it gets adopted depends on whether FIDO's working group and competing efforts like AP2 treat it as complementary infrastructure or a rival spec. Either way, the fact that a company is proposing a new use of the 401 status code — one HTTP has carried since 1997 without an identity equivalent — signals that the accountability gap in agentic commerce has become urgent enough to warrant standards-track attention, not just individual vendor patches.