Proof, a Boston-based identity company, launched x401 last month — an open, issuer-neutral protocol built to let any website or API ask for and verify the identity behind an AI agent before letting it act. The design is intentionally narrow: a service states what it needs (verified identity, age, membership, organizational affiliation, signing authority, or proof of humanness), the agent presents a matching credential, and the service checks the issuer, the claim, the scope, and the specific action before proceeding. What's notable isn't the cryptography — it's the separation of concerns. Identity establishes who or what an agent represents; authorization establishes what it's permitted to do. x401 binds those two into a single provable statement without forcing every website onto one credential scheme or one identity provider. Any conforming issuer can deliver x401-compatible credentials, and any agent can present them — but each service still decides for itself which issuers and assurance levels it trusts. This matters because the agentic web has a payments layer (x402) and is accumulating identity approaches from every direction: Mastercard's Agent Pay tokens, Visa's Trusted Agent attestation headers, Google's AP2 verifiable-credential mandates, and W3C DIDs for crypto-native agents. Each anchors trust differently — card network, acquirer, issuer-signed credential, or self-sovereign document — and none of them talk to each other cleanly. x401 is pitched as the missing authorization layer that can sit alongside these rather than replace them, and Proof says it's submitting the spec to the FIDO Alliance's agentic authentication standards workgroup, which is the more meaningful signal than the launch itself. A protocol going to FIDO means someone intends for browsers, OS vendors, and relying parties to eventually implement it as a baseline, not a vendor add-on. The open question is adoption asymmetry: a protocol that lets services pick their own trust anchors is flexible, but it also means the useful floor of "which claims will actually be honored" gets set by whichever large relying parties (Google, Microsoft, the card networks) decide to recognize. Until a few of those commit, x401 is a well-specified option sitting next to several other well-specified options, waiting for the market to consolidate around one.