A notable identity-layer development moved from a single vendor into open, multi-stakeholder governance this year, and coverage of it is still fresh enough to matter this week. In March 2026, Vouched formally donated the Model Context Protocol - Identity (MCP-I) framework to the Decentralized Identity Foundation (DIF), where it is now stewarded by the DIF Trusted AI Agents Working Group. The spec has since been renamed KYA-OS (Know Your Agent Operating System) to reflect its scope beyond MCP alone. The technical bet is straightforward: MCP-I / KYA-OS uses decentralized identifiers (DIDs) and verifiable credentials (VCs) to enable cryptographically secure verification of both agents and their human principals, without requiring prior coordination between parties. That last clause is the part worth sitting with. Most enterprise identity work for agents today, including Microsoft's Entra Agent ID, solves identity within a single organizational perimeter. A travel-booking agent acting across airline, hotel, and payment systems needs something that works across organizations that have never met, and that's the gap DID/VC-based frameworks are built to close. The framework organizes around four basic questions every service should be able to answer about an incoming agent request: who the agent is, who authorized it, what it's allowed to do, and on whose behalf. OAuth 2.1 answers the first question well; it does not answer the harder ones about authorization chains and downstream verification without prior coordination. That's precisely the gap MCP-I / KYA-OS targets. It's worth being honest about maturity here. This is early-stage work — the spec is in active community development, and production implementations are sparse. Handing a framework to a standards body like DIF is a meaningful signal about intent to avoid vendor lock-in, but it doesn't by itself make the spec production-ready or widely adopted. The pattern is familiar from other infrastructure transitions: donation to a neutral steward often precedes real interoperability by a year or more, if it happens at all. Still, the direction is consistent with what's happening elsewhere in agent identity — Singapore's IMDA framework requiring verifiable digital identity for agents, NIST's AI Agent Standards Initiative, and payment networks building agent-specific attestation layers. The common thread is that generic service-account treatment of agents is being replaced, piece by piece, with dedicated identity and authorization primitives built for cross-boundary delegation.