The International Telecommunication Union is stepping into the agent identity mess. On July 9, 2026, it announced a new effort to develop international frameworks for the identity and trustworthiness of autonomous AI agents. The initiative could help a bank, platform, government service, or company distinguish an authorized agent from an impersonator, and could also shape which agents those institutions let operate at all. The formal vehicle is the Focus Group on Trust and Identity for Humans and Agentic AI, which will study common terminology, identity and trust architectures, agent discovery, credential interoperability, lifecycle models, security criteria, and benchmarks, building toward a roadmap for future standards. It reports to ITU-T Study Group 17, the security standardization arm of the ITU. Its first meeting is set for Paris in November 2026, with a second in Geneva in January 2027 — so this is a slow-moving standards process, not a shipping spec. What makes this worth flagging isn't the timeline, it's the framing. The hard part isn't whether agents need better credentials — they clearly do — it's who gets to issue those credentials, which organizations are obligated to recognize them, how much they reveal about the agent or its principal, and who holds revocation power. A narrow-scope credential system lets an agent prove it has limited authority for one action without exposing anything else about who it works for. A badly designed one turns into a global admission gate for software agents, with a small cluster of platforms, governments, or identity vendors deciding which agents count as legitimate. This lands in the middle of a crowded field: NIST's CAISI opened its own AI Agent Standards Initiative in February, the Decentralized Identity Foundation is stewarding the MCP-I/KYA-OS spec donated by Vouched in March, and Microsoft, Cisco, and CrowdStrike have all shipped agent-identity products this year layered on OAuth, SPIFFE, and DIDs. The ITU effort is notable mainly because it's the first attempt to pull this into a single international body rather than leaving it to vendor consortia and national agencies working in parallel. Whether ITU-T Study Group 17 becomes the forum that actually settles issuer authority, or just adds a fourth competing framework to the pile, won't be clear until the Paris meeting produces a working document. For now the practical advice for anyone building agents today hasn't changed: stop reusing human credentials, and scope every agent's authority to a specific task, resource, and duration rather than waiting for a global standard to arrive.