On July 27, three separate announcements converged on the same unsolved problem: when an AI agent acts for you, how does anyone downstream know it's really you, acting with real authority, without handing the agent your actual credentials? 1Password published a design for its Claude integration built on what it calls a zero-exposure architecture. When Claude needs to log into a site, 1Password shows the user which credential is being requested and why, then, after biometric approval, injects the credential directly into the page. Claude never sees the vault item, password, or one-time code, and access is scoped to the task and ends when it's done. CTO Nancy Wang framed the distinction plainly: the fix isn't handing agents your secrets, it's letting a user give an agent permission to use a credential without letting the agent see it. Separately, Dai Nippon Printing rolled out a digital identity function for AI agents making proxy purchases, built on its CATRINA distributed ID platform and using verifiable credentials so that only agents authorized by a user can transact on that user's behalf and authority. And the Linux Foundation announced the operational launch of the x402 Foundation, a new open-governance body created by Coinbase to steward x402, a protocol that embeds payment capability directly into HTTP so agents, APIs, and applications can exchange payments as part of normal web interactions. The Foundation already has roughly 40 member organizations, including Amazon Web Services, Google, Mastercard, Stripe, and Visa. What's notable isn't any single piece, it's that the three fit together into distinct layers rather than competing for the same job. DNP addresses an agent's authority to buy on a user's behalf. 1Password addresses the agent's authority to access the account needed to buy, without ever exposing the underlying secret. x402 addresses the transaction itself, once authority and access are both established. That separation matters because most agent-security failures so far have come from collapsing these layers into one: an agent inheriting a human's full session, or a card network unable to tell an agent-driven purchase from a human one. Splitting identity, authority, access, and settlement into separately governed, separately auditable pieces is a more defensible architecture than treating agent trust as a single monolithic credential. None of this is finished. There's still no universal standard for how an agent proves, across organizational boundaries, which layer it's operating at and what it's actually been delegated to do. But the shape of the stack — who the person is, what they authorized, what credential the agent used, and what money moved — is now visible in production systems rather than white papers.