On July 9, 2026, the International Telecommunication Union announced a new effort to develop international frameworks for the identity and trustworthiness of autonomous AI agents. The framing matters: this isn't a vendor shipping a product, it's a UN specialized agency trying to get ahead of a fragmentation problem that's already visible in the market — Mastercard Agent Pay, Visa's Trusted Agent Protocol, Google's AP2, and various DID-based schemes are all solving overlapping pieces of the same puzzle with different trust anchors. As of mid-July, the initiative does not require developers to register an agent, connect it to a government identity, or seek approval before running it locally. That's a meaningful design choice at this stage — it's exploratory, not a mandate. But early standards work has outsized influence on what comes later. Technical choices made before a system becomes mandatory can determine which identities are portable, which issuers get trusted by default, and which users face friction once institutions start adopting the framework. The practical gap the ITU effort is aimed at is real and already being exploited: there's no reliable way for a bank, platform, or government service to tell an authorized agent from an impersonator holding a stolen credential. A parallel IETF Internet-Draft on agent authentication and authorization is already grappling with a narrower version of the same issue — an agent might hold a technically valid credential while operating outside the task, time window, account, or spending limit it was actually issued for. Holding a credential and being authorized for the specific action are not the same thing, and most current agent infrastructure conflates them. The unresolved questions are less technical than institutional: who gets to issue these credentials, which organizations are obligated to recognize them, how much information a credential reveals about the human or organization behind an agent, and who has the authority to revoke it. A standard that lets an agent prove narrow, scoped authority for one action is useful. A standard that becomes a universal, broadly-trusted admission ticket is a different — and riskier — thing, and the difference will be decided in the next round of technical drafts, not in the press release. This is early-stage governance work, not a shipped protocol. But it's the first sign of a global standards body treating agent identity as its own category, distinct from human digital identity, rather than an extension of existing OAuth or PKI infrastructure.