Fifty agent wallets. That is the sample my team reverse-engineered in 2025, and thirty percent of them were running coordinated order flow through decentralized exchanges โ same block, same size, same slippage tolerance, wallets that had never once interacted socially. The number that reached the EU policy drafts was two hundred million euros in annualized distortion. But the finding I keep returning to is smaller and duller: not one of those fifty could prove, cryptographically, who had authorized it to spend. Every wallet was a bearer instrument with a personality.
Which is why the AGNTCon ledger โ the week of October 21, 2026, when six vendors shipped six pieces of agent infrastructure and called it a stack โ reads less like a milestone and more like an audit trail of a market that has decided to charge rent before it decides to agree.
What actually shipped: NVIDIA published OpenShell, a reference architecture and documentation set for confining agent execution at what the company calls the silicon level. Rhapsody shipped Guardian, an audit-trace product a regulated clinical buyer can purchase today. Okta put Agent Identity into pre-GA. Proof and Circle demoed a two-part payment handshake โ x402 for settlement, x401 for credential gating โ on a show floor. Sierra and Meta published PAP v0.1, a draft protocol with two very differently motivated parents. That is the entire factual surface of the week, and every item on it maps one-to-one to a vendor announcement. No third-party test. No named customer. No procurement figure. When a ledger has no independent entries, it is not a ledger; it is a press kit with column headers.
The historical rhyme is not subtle. OAuth took years to move from a scratch protocol to something a bank would deploy, and it crossed that line only when the delegation problem โ can a third party act for a user without holding the user's password โ was solved by profile rather than by product. SAML federated universities before it federated enterprises. Each cycle produced the same shape: one open protocol, a long tail of proprietary extensions, and a middleware industry that monetized the gap. The agent stack is at the extension stage now, and the middleware has already arrived wearing a governance costume.
Reconstruct the week as layers and the gap becomes geometric. Execution confinement sits at the bottom, owned by a chip vendor. Above it, policy enforcement โ intercepting a call and swapping in a short-lived credential โ exists as a pattern, not a protocol. Identity and credentials sit at pre-GA. Audit and compliance is the only layer you can actually buy. Payment settlement is a demonstration. And interoperability, the layer that would let any of these talk to any other, is a draft with two corporate signatures and no reference implementation.
The phrase 'silicon-level' deserves more skepticism than it received. There is no product in which a policy engine lives inside a GPU. What the phrase compresses is almost certainly one of three things with three different business meanings: confidential-computing isolation inside a trusted execution environment; a policy enforcement point offloaded onto a DPU; or hardware-grade tenant separation across an interconnect domain. All three can be honestly described as silicon-level. Only one creates a moat that survives an open standard. The ambiguity is the strategy โ a reference architecture that is free, documented, and open is a demand-generation asset for the license behind it, and every deployment it wins is a line item in a per-GPU annual contract.
The identity layer has the same costume problem, in reverse. 'Replace the credential on every call' is not new; its technical equivalent is token exchange plus rich authorization requests plus workload identity, all ratified years ago. The unsolved part is not the swap. It is transitivity. When agent A acts for user U and calls agent B, which calls tool T, what is the subject of the final call? Whose consent is bound to it, and how does B verify that binding without a round trip to U? No approved profile answers this. That is the actual reason interoperability is still a slide, and it is a reason the ledger never states. Nobody published a P99 figure for per-call credential exchange either, which matters more than it sounds: an agent making forty tool calls per task cannot absorb a hundred milliseconds of token minting per hop before the economics turn negative. Nobody published an audit schema; if traces are not aligned to an open telemetry convention, cross-vendor aggregation is a slide too. And nobody named who holds the root of trust.
Note the asymmetry the framing flattens. x402 is an open HTTP-402 settlement protocol with real on-chain flow behind it; the proprietary piece is x401, the credential challenge layered on HTTP-401 semantics. The payment rail is therefore the most interoperable component of the week, not the least. Settlement wants to be universal because float and fees scale with volume. Identity wants to be proprietary because per-agent subscription pricing collapses the moment a competing provider can mint the same token. Two layers, two opposite incentives, one headline treating them as equivalent.
The structural omission is bigger. MCP ran in the same building, and its ecosystem has been absorbing authorization directly into the protocol rather than waiting for a third-party identity framework. If that absorption completes, the standalone value of an agent-identity product compresses toward zero โ you do not buy an identity provider for a protocol that ships its own. Every vendor in that hall knows this. It explains the pre-GA timing better than any readiness story does.
And nobody discussed discovery, which is the brick the whole wall sits on. Interoperability presupposes that I can find your policy endpoint, your credential types, your capability declarations โ the equivalent of a discovery document or an agent card. Discovery is the cheapest layer to build and the easiest to monopolize, because whoever owns the registry defines who is findable. Build the registry, and the standard becomes a formality. Nobody at AGNTCon shipped a single registry, and that is the omission with the longest half-life.
Which brings the economics into focus. Six vendors, six incompatible ways to get paid: hardware plus license, vertical compliance SaaS, per-workload identity subscription, settlement spread, outcome-based platform fees, distribution and advertising. Not one of those models requires a unified standard. Most are damaged by one. Fragmentation is not a coordination failure; it is the rational optimum for everyone currently holding a toll booth โ and the toll prices against the expected loss from a single bad agent action, not against compute. That is why audit traces became a product before policy did. Compliance is the only buyer that reads risk exposure instead of ROI.
Then there is the line about builders buying bridges instead of interoperability, delivered as a verdict. Arbitrage isn't the spread here; it's a cultural audit of value. Every middleware market of the last twenty years โ enterprise service buses, integration platforms, workflow connectors โ existed precisely because standards were absent, and their aggregate value ran into the tens of billions. Buying a bridge is the normal condition of a maturing stack, not evidence of its failure. We didn't get a standard. We got six invoices, and an integration layer that will be priced at whatever switching cost turns out to be.
The contrarian read, and the one I would defend in front of a fund: the cost of the delay is not the waiting. It is the duplicate purchasing. Enterprises hedging against lock-in will run two or three stacks in parallel proof-of-concept through the fourth quarter, which means the budget does not sit idle โ it gets spent twice on half-integrated systems. That is agent debt, and its economics are enterprise-ERP economics, not SaaS economics. Once a governance stack is wired into CI/CD and a compliance workflow, migration cost rises superlinearly with integration depth. The buyer who understands this stops asking which stack wins and starts treating the integration layer itself as the position. In my audit work, the wallets that survived scrutiny were never the ones with the best model. They were the ones that could reconstruct their own authorization chain after the fact.
By the first quarter of 2027 the question will not be which layer shipped. It will be who owns discovery, and whether the delegation profile arrives from a protocol consortium or from the identity vendor with the largest installed base. Watch the plugfests โ or their absence. A stack that never publishes a cross-vendor interoperability test is not immature. It is comfortable.
