For a few years now, AI agents have been initiating payments, bookings, and account changes with no standard way for the receiving service to ask who authorized the action. This month a company called Proof released x401, described as an open, issuer-neutral protocol addressing that gap. Proof frames the problem simply: agentic payment rails launched without settling who issues the credential behind an agent's actions, leaving services no reliable way to distinguish a legitimate delegated purchase from a compromised or impersonated one. Their pitch is architectural rather than incremental — the company notes that HTTP got a payment status code back in 1997 but never got an identity one, and x401 is meant to fill that specific hole. Alongside the protocol, Proof is shipping Proof digital ID, described as the first live implementation on x401, intended to attach a verified human identity and authorization to individual agent actions. The timing lines up with a broader shift the industry has been documenting. A recent survey of protocol activity between March and July 2026 found the agent identity problem moving from theoretical concern to concrete specification work: the A2A project shipped its v1.0.0 stable spec in March, dropping legacy OAuth implicit and password flows in favor of Device Code and PKCE support, adding mTLS, and — notably — formalizing signed Agent Card verification using JWS and JSON Canonicalization, replacing what had been self-declared, unverified metadata. Separately, the MCP-I framework (donated to the Decentralized Identity Foundation in March and since renamed KYA-OS) uses DIDs and verifiable credentials to let a downstream service verify an agent and its human principal without prior coordination between the two parties. What all of this converges on is the same missing layer: authentication proves an agent is who it claims to be, but it doesn't answer who authorized it, what it's allowed to do on someone's behalf, or whether a service three hops downstream can verify that chain at all. x401 is one more entrant trying to close that specific gap at the payment layer rather than the general-purpose identity layer, which is a narrower and possibly more tractable target — commerce has clear settlement points where a credential check is unavoidable. Whether x401 gets adopted beyond its launch partner is an open question; issuer-neutral protocols live or die on whether competing platforms actually plug into them rather than building their own walled equivalents. Worth watching over the next few months rather than treating as settled.