For an autonomous agent to truly "go to work" on the open internet and inside enterprise systems—not just be let through by a website, but be authorized to access enterprise systems, spend money autonomously, be trusted, and have someone cover the damages when things go wrong—in 2026, these six gates are being invented simultaneously. Yet to date, none of them has produced a single, universally recognized credential akin to a "driver's license."
In 2026, "agent onboarding" has gone from a metaphor to an entire rapidly-forming infrastructure—cryptographic identity, network access license, enterprise badge, payment qualification, reputation background check, and liability insurance are all being built simultaneously, yet every gate remains a war of competing factions with no single, universally recognized credential like a "driver's license" emerging.
Counter-consensusAmong the six gates, the fastest progress is not in the most visible payment protocol war, but in the most unassuming enterprise badge (IAM)—because it reuses budgets and vendor relationships enterprises have already paid for years; the real bottleneck choking the agent economy is the last gate that almost no one is discussing: without claims data, insurers won't truly underwrite; without underwriting, serious commercial scenarios won't let agents spend money autonomously.
The most foundational of the six gates answers the simplest question: who is this program knocking at the door? In May 2025, Cloudflare launched Web Bot Auth, replacing easily-spoofed IP ranges and User-Agent strings with HTTP message signatures; in August of the same year they added "Signed Agents" classification, specifically covering traffic that doesn't represent a single company but rather acts on behalf of end users. Browserbase described this mechanism as a digital passport for AI agents—issued before departure, presented upon arrival at a website, verified by the site before granting access.
A year later, this identity layer was further materialized. On August 4, 2026, Cloudflare announced Cloudflare Wallets and cloudflare.pay, giving AI agents a persistent identity plus spending authority with limits set by a human owner. CEO Matthew Prince put it directly: "When an agent shows up at your door, you need to know who sent it... You need a chain that traces back to the person or organization behind it, so that trust, accountability, and real commercial relationships can follow." This statement captures the significance of the "ID card" gate clearly: it's not the endpoint, but the prerequisite that enables the remaining five gates—especially the final "who's responsible" gate.
Worth noting as context: the EU's eIDAS 2.0 requires member states to issue digital identity wallets by the end of 2026; while this regulation originally targets natural persons, it's being read by the industry as a regulatory path that could extend to agent identity—this is a parallel thread Forbes specifically highlighted when commenting on Cloudflare Wallets: private infrastructure is sprinting ahead while public regulation trails behind.
The identity gate also has a fully decentralized parallel track. On January 29, 2026, the core registry of the ERC-8004 ("Trustless Agents") standard—jointly proposed by engineers from MetaMask, Coinbase, Google, and the Ethereum Foundation—was deployed to the Ethereum mainnet, using an NFT as the agent's "on-chain passport" pointing to an identity card listing its MCP/A2A service endpoints, plus reputation and task verification companion registries. Within one month of launch, 45,000 agents had registered; by late August, cumulative registrations across 24 chains had exceeded 526,000. But this route remains highly confined within the crypto-native ecosystem, with no signs of mainstream enterprise identity products like Entra Agent ID or Okta bridging to it—the centralized Cloudflare identity system and the decentralized ERC-8004 identity system are, in some sense, two mutually disconnected answers to the same problem.
With identity established, you still need a pass that gets you through the door. This is exactly what Cloudflare's BotBase solves—over the past two years, the volume of bot review submissions has grown approximately 7x, and the honor system of "IP whitelisting + self-attestation" has completely collapsed. On July 1, 2026, Cloudflare split "AI" into three configurable categories: Search / Agent / Training (plus 8 granular behaviors including Transact, data collection, and security testing), and redefined what "Verified" means: previously, verification was roughly equivalent to a lifetime gold badge with default全网 access; now, verification only permits a bot within its declared category to "be allowed," with the site owner deciding each item individually. Starting September 15, newly onboarded domains will default to blocking Training and Agent traffic on the ad page, allowing only Search.
Content usage permissions were also sliced into three work scopes—immediate (use and destroy), reference (default, index + cite), full (summarize and rephrase); the BotBase for Operators launched on August 28 transformed the previous "submit a black box" application process into an automated review pipeline—declaring "what your bot does / how it uses content / who actually operates it" in three items, with the system automatically verifying repetitiveness, User-Agent specificity, and verification method authenticity.
You might trust Stripe, but that doesn't mean you trust every stranger who wires Stripe into their weekend project.
Jin-Hee Lee & Bryan Becker, Cloudflare — July 1, 2026
This "transitive trust" design answers the thornier question above the pass: when a bot's operator isn't its developer, along which chain should responsibility be traced. This is foreshadowing for Gate 06 below. Over 20% of global website domains run behind Cloudflare, giving its pass particular weight—but also meaning this gate is currently, in effect, ruled by a single company setting terms unilaterally. (This publication previously used the BotBase case study in EP.101 to walk through the complete six gates.)
The more urgent battlefield is actually inside enterprises. Reusing a human employee's login credentials for an agent immediately breaks the audit chain (can't distinguish human vs. agent actions), violates least-privilege principles (the agent inherits all of that person's broad permissions), and can't be individually revoked. And machine identity is expanding far faster than expected—security firm Entro Security's data shows the ratio of machine identities (service accounts/bots/agents) to human identities in cloud-native environments has reached 144:1, growing 56% year-over-year; CyberArk's independent survey puts it at 82:1, and the Cloud Security Alliance's industry median is 45:1—different methodologies, same direction: non-human identities are exponentially out of control.
2026 is the year nearly every mainstream identity vendor simultaneously filled in their "Agent Badge" product: Microsoft Entra Agent ID began auto-generating independent identities for agents created in Copilot Studio starting in March, becoming mandatory in July with each agent bound to a human "sponsor"; Okta's Cross App Access saw Agent SSO officially launch on August 24, and was incorporated into MCP's own authorization specification—one of the rare cross-vendor standardization achievements; AWS Bedrock AgentCore Identity, SailPoint, and CyberArk each approach the same problem from identity directory, governance graph, and zero-standing-privilege angles respectively. Gartner lists "AI Agent Identity and Access Management" as a top 2026 security trend, projecting 40% of enterprise applications will embed agents with task-level permissions that year.
The converging technical foundation underneath is SPIFFE/SPIRE—originally a short-lived identity credential system for cloud-native workloads, now merging with the IETF's WIMSE working group, specifically extending a "dual identity credential" draft that binds a human owner for agent scenarios. But practitioners acknowledge SPIFFE is still just an底层 infrastructure layer; an MCP tool call's identity credential and an A2A agent card haven't been bridged—this gate's progress is the fastest of the six, but still "each vendor building their own," without true unification.
These enterprise badge products ultimately need to connect to the protocol where agents actually talk to each other. MCP's official OAuth 2.1 authorization specification defines MCP servers as resource servers with clients using standard token issuance flows; the July 28, 2026 revision was called "the biggest change ever" by maintainers, deprecating dynamic client registration in favor of more secure client identity metadata documents. But specification is one thing, implementation another—security vendor Descope's field data shows only about 8.5% of MCP servers have actually implemented OAuth 2.1. Meanwhile, Google-led A2A protocol takes a different path: rather than authenticating "who this connection is," it publishes a machine-readable "Agent Card" declaring its capabilities, skills, and required authentication methods for other agents to discover and invoke—identity as declaration, not identity as cryptographic proof. The industry generally sees the two as complementary: MCP handles agent-to-tool, A2A handles agent-to-agent; but "who should uniformly define identity, consent, and authorization" remains an unresolved governance question.
Permission失控 isn't theoretical. The EchoLeak vulnerability disclosed in June 2025 (CVE-2025-32711) required only a carefully crafted email to make Microsoft 365 Copilot exfiltrate data using its existing permissions to Word/PowerPoint/Outlook with zero clicks and no user action; three months later, the ForcedLeak vulnerability let Salesforce Agentforce be "injected" with instructions from a form field, exfiltrating CRM customer information, sales pipeline, and internal notes through an expired and re-purchased whitelist domain, with a CVSS score of 9.4. Neither incident involved an execution sandbox breach—rather, the agent's own legitimate permissions were abused through a "hijacked shell"—precisely the scenario this gate is meant to block.
With identity and badge in hand, an agent can finally approach the fourth gate: can it swipe its own card? This publication previously outlined the early prototypes of virtual card authorization and payment-giant MCP integration in EP.43 "Letting Agents Pay for You"; in September 2025, Stripe and OpenAI jointly launched Agentic Commerce Protocol (ACP), using "shared payment tokens" to let agents complete checkout without holding real card numbers, first integrated into ChatGPT's Instant Checkout, followed by Shopify, Salesforce, and PayPal. The same month, Google released Agent Payments Protocol (AP2), launching with 60+ institutions (Mastercard, Amex, PayPal, Coinbase, etc.), with a core design of three signable "mandates" (Intent / Cart / Payment Mandate) as W3C verifiable credentials, separately recording "what the user authorized" and "what the agent actually did." Six months later, Google's UCP protocol and x402 v2 landed simultaneously, with Gemini and Qwen Shopping demoing together, completing "the last puzzle piece for autonomous agent payments" (EP.69).
The third route comes from the crypto world: Coinbase launched the x402 protocol in May 2025, reusing the HTTP 402 "Payment Required" status code to let agents complete second-scale, sub-penny micropayments with stablecoins; after Cloudflare joined, the two announced the x402 Foundation, now governed by Linux Foundation, reaching 119 million transactions on Base and 35 million on Solana, with annualized transaction volume around $600M. Cloudflare integrated this protocol into its July-announced Monetization Gateway (currently in queue for testing), letting any site owner charge agents and API callers per request. Meanwhile, Visa and Mastercard aren't absent—Mastercard's "Agentic Token" binds a card to a specific agent, specific merchant scope, and specific authorization policy; as long as the token and policy are followed, fraud liability falls on the issuer.
These routes all target catalog items: a shopping cart, a final price. Custom orders require uploading files, getting a quote, then approving—none of the protocols I've read have a ready-made example for that. I measured the order chain for a cat food dispenser against a dozen manufacturing services, looking at what "the human step" looks like in their interfaces, in "Which Service Is Truly Agent Native".
This is the only gate among the six that has openly become a "protocol war"—ACP focuses on in-chat instant checkout, AP2 on auditable cross-institution delegation, x402 on stablecoin micropayments, and card networks on keeping risk within their familiar fraud models. Analysis generally sees the four as non-mutually-exclusive; 2026 production systems often stitch together two or three: using AP2's mandates for authorization audit trails, ACP for the checkout action, and x402 to settle fractional API/data call fees. No one has won this war, but everyone is stockpiling transaction volume on their own track.
The biggest gap in this technical architecture isn't the protocols themselves, but the seam between "autonomous authorization" and "actual human intent." Security research firm Guardio ran a "Scamlexity" test: setting up a fake Walmart site and asking Perplexity's Comet browser to buy an Apple Watch, it directly identified the fake page, auto-filled saved card and address, and completed checkout without requesting二次 confirmation. San Francisco entrepreneur Sebastian Heyneman's experience was more extreme—he had an agent secure Davos attendance while he slept; the agent wrote letters in his name and negotiated a ~€27,000 sponsorship commitment; he had to haggle after waking up to reduce it to ~€4,000. Such cases show that for the pay card gate, protocols alone aren't enough—between "authorization scope" and "what the human actually consented to," agents are currently winging it.
The first four gates answer "who are you, can you get in, can you spend money"; the fifth gate answers a harder-to-quantify question: is this agent actually reliable? METR's "time horizon" benchmark is currently the closest thing to an industry-accepted capability yardstick—measuring how long a task (in human-expert hours) an agent can independently complete with 50% reliability; this duration has roughly doubled every 7 months on average over the past few years, and is still accelerating (Time Horizon 1.1 shows ~131 days since 2023); GPT-5-class models reached about 2 hours 17 minutes in May 2026, and newer frontier models in METR's data file have reached about 12–17 hours (Claude Opus 4.6 ~12.0 hours; Mythos Preview ~17.4 hours, with wide confidence intervals); but it's a research benchmark, informally cited by labs in model cards, not a true "exam certificate."
One detail easily misled by its name: Cloudflare's Agent Readiness Score, launched during Agents Week, actually measures "how agent-friendly a website is" (robots.txt, MCP Server Card, OAuth discovery, etc.—16 checks), not "how trustworthy this agent is"—the opposite direction. What actually targets "agent reputation" itself is a crop of crypto-associated startups emerging in 2026—AFG, Qova, AgentPass, Mnemom, AXIS, each designing scoring systems ranging from 300–850 to AAA–CCC ratings, trying to build "credit bureaus for agents," but currently highly fragmented with no dominant player like FICO. The relatively mature offering is Sumsub's "Know Your Agent" (KYA) verification product launched January 29, 2026—identity verification, behavioral reputation tracking, activity monitoring, and rule enforcement across four layers, essentially adding a KYC-style verification to the "human authorizes agent" chain.
The only scenario where "background check determines access" has actually landed is in the insurance industry: AIUC-1 security audits are being used by insurers as a prerequisite for underwriting AI liability insurance—pass the audit, get higher coverage limits. This may be the clearest case in this article's six gates where "certification genuinely gates the next step."
The final gate is the least mature of all, yet determines how much commercial scope the first five can support: when an agent causes harm, who pays? Insurance products have started appearing—Corgi launched AI liability insurance in May 2026, Munich Re's HSB introduced a policy specifically covering AI-related damages for small businesses in March (currently US-only), and Armilla began underwriting as early as April 2025, claiming to price even without historical claims data. But this market's maturity is often compared to "cybersecurity insurance in the early 2000s"—demand is real, but claims data is paper-thin; in early 2026 industry surveys, most large European insurers are still观望, directly citing "no claims data."
Legal action has actually outpaced insurance. The EU AI Act's transparency provisions (Article 50) became enforceable on August 2, 2026, with fines up to 3% of global revenue, and clarified liability for multi-agent systems—the orchestrator bears full responsibility for all sub-agents' actions; California's AB 316 (effective 2026) directly prohibits defendants from using "AI acted autonomously" as a liability shield in damage lawsuits; Colorado replaced its prior law with SB 26-189, allocating liability proportionally by fault between developers and deployers. These laws share a common direction: AI agents are currently not, and have not been seriously proposed as, independent legal entities—while academia discusses "electronic personhood," the EU has withdrawn early related proposals, and the mainstream consensus treats agents as "tools," with liability traced up the human chain of developer/deployer/user, which directly echoes Gate 01's Cloudflare Wallets design logic of "must bind a human owner."
Even the payment protocols themselves haven't resolved this: ACP defaults to merchants bearing the chargeback risk for agent mis-purchases (American Express is currently the only issuer explicitly promising to cover cardholder losses from agent mis-purchases), and AP2's signed mandates provide an auditable evidence chain but don't directly adjudicate "who should actually pay." Reaching the end of the six gates, you find that the most advanced technical layers (identity, payment) have outpaced the most basic social contract layer (who's responsible, who pays)—this is the largest inversion in the entire agent onboarding infrastructure today.
Liability determination is no longer just theoretical. In November 2025, Amazon sued Perplexity in the Northern District of California, alleging its Comet browser's shopping agent impersonated Chrome browser identity and placed orders on behalf of customers without explicit authorization, violating the Computer Fraud and Abuse Act; the court issued a temporary injunction in March 2026, which the Ninth Circuit Court of Appeals vacated on August 4, 2026—writing judge Milan D. Smith Jr.'s reasoning was that the user "accessed" Amazon's servers with Comet's assistance, rather than Perplexity itself accessing; the CFAA is fundamentally an anti-hacking law and cannot be used to police how users choose their browsing tools; but Amazon's trademark infringement and breach of contract claims were upheld, and the case was remanded to the district court. Update (2026-09): on September 11, Perplexity further moved to dismiss the entire case, invoking the appellate ruling—the motion states "this case asks whether a dominant platform can turn a criminal anti-hacking law into a tool for controlling how users use the internet—the Ninth Circuit has given a clear 'no'"; Amazon may petition for rehearing or appeal to the Supreme Court, and the case remains unresolved as of publication. This pending case neatly welds Gate 01 "identity" and Gate 06 "liability" together: when an agent disguised as a human browser causes harm, who's accountable?
Shifting the lens to China reveals the most uneven progress across the six gates: on the pay card gate, China isn't just not lagging—it's ahead of the global narrative; on the liability gate, China is the world's first jurisdiction to produce systematic agent-specific policy; but on the badge and background check gates, aside from Alibaba Cloud, most players are still at the stage of repackaging generic security products.
Pay Card—June 2026 was dubbed by the industry as the 48 hours when "AI payments moved from technical validation to commercial closure": Alipay/Ant Group, together with Qwen, Taobao, and Alibaba Cloud Bailian, released China's first agent commercial trust protocol ACT (launched January 2026, upgraded to 2.0 in April, co-built by 20+ vendors in the IIFAA alliance), then on May 26 released the "AI Pay/AI Collect/Token Pay/AI Wallet" full payment stack, completing ~300 million AI payments covering 95% of mainstream agent frameworks, and on August 17 further released the cross-device interconnect protocol AHA with 20+ partners including Huawei and BYD; WeChat Pay concurrently launched "AI-Exclusive Cards" (isolated accounts, locked limits, each transaction still requiring phone二次 confirmation); JD.com released China's first autonomous payment protocol for agents, A2P2, on June 11, a more aggressive route than Alipay's—direct autonomous execution rather than per-transaction confirmation; UnionPay Merchant Services released an AI payment product based on the APOP protocol the same day.
Badge—Progress on this gate is uneven: Alibaba Cloud is the only one of the three major cloud vendors with an independently named product, Agent Identity Service, compatible with OIDC and federatable with Okta/Entra ID, with IDaaS EIAM also offering Agent ID Guard for zero-static-key M2M authentication, directly benchmarking Entra Agent ID and Okta Agent SSO; Tencent Cloud currently only bundles identity, access, and audit into a single "AI Agent Security Gateway" product, with no separately named Agent IAM; Huawei Cloud doesn't even have dedicated product documentation yet—this is a real gap among the three worth noting candidly.
Pass—Both cloud vendors have produced products comparable to Cloudflare BotBase: Tencent Cloud EdgeOne opened "AI Crawler Handling" capabilities to all tiers (including free) from February 2026, identifying GPTBot, ClaudeBot, Google-Extended etc. via User-Agent, plus a separate BOT Traffic Management product using AI + rule intelligence to identify 1000+ public bot types; Alibaba Cloud WAF maintains a 700+ crawler fingerprint library, and specifically built an "impersonation crawler blacklist" to prevent伪装 as legitimate crawlers like BaiduSpider.
Liability—Among the six gates, China is actually progressing fastest on the last one. On May 8, 2026, the Cyberspace Administration, NDRC, and MIIT jointly issued the "Implementation Opinions on Standardized Application and Innovative Development of Intelligent Agents", the world's only systematic agent-specific policy document to date: proposing a seven-layer security framework, permission boundaries, behavioral guardrails, and AIP protocol, envisioning each agent carrying identity, capability declarations, and compliance certification information, with tiered regulation by risk scenario (finance, healthcare, government, judiciary)—this predates and is more specific than the EU AI Act's "orchestrator bears full responsibility for sub-agents" clause in writing the "liability gate" into national-level policy, though enterprises' actual compliance levers still mainly rely on existing tools like large model registration and algorithm registration.
The identity gate in China has also seen real impersonation risks—a CCTV News report in April 2026 noted that searching for well-known enterprise and institution names on mainstream large model platforms returns numerous "impersonation agents" without official认证 badges but bearing the same names; experts urged clarifying agent liability determination and impersonation judgment standards. This and Gate 02's Cloudflare "transitive trust" accountability approach are different answers to the same problem under two regulatory philosophies. Laying all six gates side by side, China's portrait is: payments running furthest ahead, regulation placing the earliest bets, Alibaba Cloud having a comparable IAM product, but overall still "sprinting in separate directions" without a unified identity substrate spanning all six gates—this, and the global situation discussed in Gate 08 below, are the same fragmentation, just with differently shaped shards.
Laying all six gates side by side, maturity is uneven—and that unevenness itself is where the opportunity lies:
Fastest converging is Gate 03 (Enterprise Badge)—because it doesn't require inventing a new business model, just migrating budgets and vendor relationships enterprises have already paid into for years for identity and access management to a new asset class (agents). This is why Okta's Cross App Access was written into MCP's official authorization specification within a year—not because the technology is optimal, but because it reuses the most存量 trust. Opportunity for builders: the middleware bridging identity semantics across different IAM vendors (how an MCP tool call's credential maps to an A2A agent's identity card) is currently空白.
Most gunpowder-smelling is Gate 04 (Payment)—ACP, AP2, x402, and card network tokens are four tracks laying rail simultaneously, betting on who becomes the "Visa/Mastercard/SWIFT" of the agent economy. Opportunity for builders: most merchants and platforms won't bet on a single protocol; a clearing layer/acquiring middleware compatible with at least two or three protocols will accumulate real transaction volume faster than betting on one—same logic as early e-commerce simultaneously integrating multiple payment gateways.
Most narrative-friendly but least mature is Gate 05 (Reputation)—"credit bureau for agents" is a great analogy to pitch, but the current crop of startups is highly dependent on crypto infrastructure and mutually non-recognizing, with no true industry standards body emerging. The relatively certain opportunity is actually audit-as-a-service (the AIUC-1 model)—because it's already been adopted by the insurance industry, a real paying customer, as an underwriting prerequisite, finding a payer earlier than a mere "credit score."
The real bottleneck is Gate 06. The first five gates are fundamentally "technical protocol" problems—signatures, tokens, directories, protocols, scores—all can be stacked into usable versions within a year or two through engineering effort. But "no claims data means no underwriting, no underwriting means no autonomous permission release" is a time problem; claims data can only accumulate through time and real incidents, and cannot be accelerated by funding or engineering investment. This means: whoever earliest and most systematically accumulates claims data for agent-caused damages (whether insurers build it themselves, or bind audit and underwriting like AIUC) holds the last and hardest-to-replicate moat among the six gates. Also worth noting: Cloudflare alone already appears in Gate 01 (Web Bot Auth/Wallets), 02 (BotBase), and 04 (Monetization Gateway)—a single infrastructure giant is attempting to take over the "agent's employer" role across multiple different gates simultaneously, which is itself a centralization risk worth continued monitoring.
Further reading: "One Week That Built the Agent Economy: Cloudflare Agents Week 2026 Panorama", "Agent Infrastructure War: The Battle for Platform, Standards, and Execution Environment Control", "Weekly AI Intelligence · EP.101", "Weekly AI Intelligence · EP.69", "Weekly AI Intelligence · EP.43"