A vendor-donated identity spec for AI agents just changed ownership and outgrew its original name. In March 2026, Vouched donated its Model Context Protocol - Identity (MCP-I) framework to the Decentralized Identity Foundation, where it's now overseen by the DIF's Trusted AI Agents Working Group. The framework has since been renamed KYA-OS — Know Your Agent Operating System — a name change meant to signal that its scope now extends past MCP tool-calling into agent identity generally. The technical core hasn't changed: KYA-OS still uses W3C Decentralized Identifiers and Verifiable Credentials to let two parties cryptographically verify each other's agents and human principals without needing to have coordinated in advance. That last part is the actual value proposition. Most of the identity tooling shipping this year — Okta's Agent SSO, Microsoft's Entra Agent ID, Auth0's Auth for MCP — assumes both sides already have a relationship: an admin console, a directory, a pre-negotiated trust boundary. KYA-OS is aimed at the harder case, a travel-booking agent authenticating itself to an airline's system, a hotel's system, and a payment processor's system, none of which have ever heard of it before and none of which share an identity provider. The move to DIF matters more than the rename. A spec that lives inside one company's product roadmap gets adopted only as fast as that company sells it. A spec stewarded by a working group with multiple identity vendors at the table has a shot at becoming something downstream services actually check for, the way TLS certificate validation became universal because it sat in a standards body rather than a single vendor's SDK. Whether that happens here is unresolved — reporting on the space describes the spec as still in active community development with production implementations still sparse. The context worth keeping in mind: OAuth 2.1 answers who an agent is, not who authorized it or what it's allowed to do on someone else's behalf, and existing card-network and API-gateway infrastructure wasn't built to ask that second question at all. Multiple identity-management writeups from the last quarter converge on the same complaint — the protocol layer for delegated agent identity is arriving faster than anyone expected, but the operational discipline to actually enforce it, revoke it, and audit it hasn't caught up. A renamed, foundation-owned spec doesn't close that gap by itself. It does put a name on the piece of the stack that's supposed to close it, and gives it an address other than one company's github.