Agent Identity Standards 2026: Identity Without the Record Is Half a Control
The new wave of agent identity work answers who is acting. It still leaves the harder question, what did they do, largely unanswered.
2026 is the year agent identity stopped being a research footnote. Within a few months the major platforms shipped credentials for autonomous software, scoped delegation tokens, consent flows modelled on OAuth, and registries so one agent can prove to another that it is what it claims to be. The direction is correct. An ecosystem where agents transact, sign contracts and move money cannot run on shared API keys and implicit trust.
But identity answers one question and quietly leaves a larger one open. It answers who is acting. It does not answer what happened. A credential proves an agent is authorised to read a ledger, send a payment or amend a record. It says nothing, by itself, about whether the agent did exactly that, did something adjacent, or did something it should never have been allowed to do. Authorisation is a gate at the door. It is not a camera in the room.
The gap the standards leave
Every serious identity proposal this year is strong on issuance and weak on aftermath. They specify how a credential is minted, scoped, presented and revoked. Almost none specify how the actions taken under that credential are recorded in a way the credential holder cannot later edit. That asymmetry matters, because the party most able to tamper with the log is precisely the party whose identity the log is supposed to hold to account.
Consider the failure that actually keeps operators awake. An agent presents a valid credential, performs an action inside its permitted scope, and the outcome is wrong. The credential checks out. The authorisation was real. The dispute is now entirely about what was done, in what order, against what state, with what inputs. If the only record of that sequence lives in logs the operator controls and can rewrite, the identity standard has delivered a clean alibi rather than accountability. Knowing who held the pen is not the same as having the signed, dated, unalterable page.
Why the record has to be the hard part
A useful test for any agent governance claim is simple. Could the operator, after the fact, quietly change the story and have no one able to tell? If the answer is yes, the control is decorative. Identity standards pass the issuance half of this test and fail the record half, because a log you can edit is not evidence. It is a draft.
Closing the gap needs three properties that identity alone does not provide. The record must be sealed at the moment of action, not reconstructed later from telemetry. It must be signed by something the operator cannot impersonate or backdate. And its existence must be provable to an outside party without handing that party the operator's private systems. Get those three right and identity finally has a counterpart. You know who acted, and you can prove what they did.
How Mickai closes the other half
Mickai is a Sovereign Intelligence Operating System (SIOS). It runs fifty specialised AI brains, twenty-five domain and twenty-five operational, on the operator's own hardware, fully offline-capable. The brains are where the agents live. The accountability is built into the substrate beneath them, not bolted on by a third party.
Every consequential action a Mickai brain takes is written to the Open Audit Record (the OAR). Each entry is sealed and signed with FIPS 204 ML-DSA-65, the published NIST post-quantum signature standard. Mickai did not invent that standard. It adopts it, so the seal on a record from today still verifies under the cryptography expected to outlast current public-key schemes. The record is created at the moment of the action, by the substrate, which means the operator cannot quietly rewrite the page after the fact. Identity says who. The OAR says what, sealed.
Permanence is handled separately and deliberately. Pantheon is Mickai's own sovereign, Bitcoin-anchored Layer 1, with a native token, PAN, on a fixed supply of five billion. It anchors a hash commitment of the record to Bitcoin, so the existence and integrity of an entry can be proven against the most heavily secured public timestamp available, without exposing the record's contents. Pantheon does not move Bitcoin and is not a Bitcoin Layer 2. Anchoring is not spending. What goes to Bitcoin is a fingerprint, not the file.
What this means for the standards conversation
None of this competes with agent identity standards. It completes them. Adopt the credentials, the scoped delegation, the consent flows. They are the right way to answer who is acting and to revoke that answer when it goes wrong. Then pair them with a record that is sealed at source, signed with post-quantum cryptography, and anchored for permanence, so that who is acting is matched by an honest, independently checkable account of what was done.
Mickai's approach is documented rather than merely asserted. The architecture is the subject of 101 filed UK patent applications, around 2,234 claims, owned by Mickai LTD, with named inventor Micky Irons. Filings are evidence of how the record, the signatures and the anchoring fit together. The point they make is the same one the standards bodies will reach eventually. Identity without the record is half a control. The other half is the part you cannot edit.
The agents are coming, and they will carry credentials. The operators who fare best in the disputes to come will be the ones who can show, not just claim, exactly what their agents did. Build the identity layer. Then build the half that proves the record. Mickai already runs on both.