A Boston-based company called Proof has released x401, an open protocol aimed at a specific gap in agentic commerce: when an AI agent shows up to buy something or call an API, how does the service on the other end know which human actually authorized it? As AI agents become the main engine behind automation and act on behalf of unidentified humans, Proof built x401 to let websites and APIs verify the identity and authority behind an agent's actions before it completes a transaction. The mechanism is credential-based rather than tied to a single payment network. The protocol enables services to request credentials confirming information such as identity, organizational affiliation, signing authority or other trusted claims before allowing an agent to complete an action. Proof describes it as issuer-neutral, meaning organizations pick which identity providers and assurance levels they'll accept rather than being locked into one verification stack. This lands in a crowded but immature field. Card networks have their own answers — Mastercard's Agent Pay binds cardholder, agent, and mandate scope into a single Agentic Token verified at checkout, while Visa has taken a different architectural route with its own Trusted Agent Protocol. Meanwhile standards bodies are converging from the identity side: the Decentralized Identity Foundation now stewards a framework (originally MCP-I, renamed KYA-OS) that uses DIDs and Verifiable Credentials so a downstream service can verify an agent-to-human delegation chain without prior coordination between the parties. What distinguishes x401's pitch is the framing around HTTP itself — the argument that HTTP got a payment status code in 1997 but never got an identity one, and that gap is what the protocol is meant to close. Proof's companion implementation, Proof digital ID, is positioned as the first live deployment on top of the spec, intended to attach a verified human identity and authorization to every agent action, not just payments. None of this settles the underlying problem yet. The same week's coverage of agent identity work makes clear that even the more mature efforts, like MCP's own July 2026 specification revision, treat delegation and authorization as unfinished business rather than solved infrastructure. What's notable this week is less that x401 solves the problem than that it's another concrete, spec-plus-SDK entry in a field where, as of a few months ago, most of these proposals existed only as papers. The spec is published and SDKs are available now, which puts x401 in the small set of agent-identity proposals that can actually be tested rather than just read.