One of the clearer identity-layer moves this year happened quietly in March: Vouched handed its MCP-Identity framework to a standards body rather than keeping it proprietary. In March 2026, Vouched formally donated the Model Context Protocol - Identity (MCP-I) framework to the Decentralized Identity Foundation, where it is now stewarded by the DIF Trusted AI Agents Working Group. The spec has since been renamed KYA-OS, or Know Your Agent Operating System, signaling that its scope now extends beyond MCP integrations specifically. The technical core hasn't changed: KYA-OS still uses Decentralized Identifiers and Verifiable Credentials to let agents and their human principals be cryptographically verified across organizational boundaries, without requiring the two parties to have coordinated in advance. What matters here is the governance shift, not new cryptography. A framework that started as one vendor's contribution to MCP now sits inside a neutral standards body with its own working group, which is the difference between a feature and infrastructure other companies can build against without betting on a single vendor's roadmap. The framework organizes around four questions any service should be able to answer before trusting an agent action: who is the agent, who authorized it, what is it allowed to do, and what is the scope of that delegation. That's a useful frame because it separates identity (who) from authorization (what), which most of the ad hoc agent-auth schemes shipping right now conflate. A travel-booking agent acting across an airline, a hotel, and a payment processor is the canonical case this is meant to solve — three separate trust domains that currently have no shared way to verify a delegated agent's authority without falling back to shared API keys or brittle OAuth hacks. This sits alongside a broader pattern from the first half of 2026: MCP itself moved to the Agentic AI Foundation under the Linux Foundation, and its governance body grew fast — within four months, the AAIF reached 170 member organizations, more than double CNCF's membership at the same stage. Identity specs following that same path toward neutral governance is worth watching, because it's the structural precondition for interoperability, not the interoperability itself. KYA-OS still needs adoption by relying parties — the airlines, hotels, and processors in that example — before the four-question model becomes something enforced rather than merely specified.