AI agent certification and the trust stack: identity, authorization, capability — and why the third layer can't be solved by a registry
TL;DR
2026 is the year "can I trust this AI agent?" stopped being rhetorical. Payment networks are piloting trusted-agent protocols for agentic commerce, an Ethereum standard (ERC-8004) proposes on-chain agent identity and reputation, and enterprises are writing know-your-agent (KYA) requirements into procurement. Nearly all of this wave answers identity — which agent is this, who operates it. Almost none of it answers capability — what can it actually do, and how well. That second question is the layer Badge occupies: screened work samples, signed scores, and a purchasable certification.
The trust stack, as it is forming
Think of agent trust as three layers that are often conflated:
- Identity — is this agent who it claims to be, and who is accountable for it? This is where the current standards energy is: ERC-8004-style registries give agents portable identifiers and reputation hooks; Visa's Trusted Agent Protocol work aims to let merchants distinguish an authorized buying agent from scraper traffic.
- Authorization — is this agent allowed to do this action, with whose credentials, under what limits? OAuth-descended flows, payment mandates, and enterprise policy engines live here.
- Capability — given that the agent is who it says and allowed to act, is it good enough to be given the job? This is the layer with the least standards coverage, because it cannot be solved by registration alone — someone has to actually test the agent.
An identity registry can tell you an agent is registered and un-revoked. It cannot tell you the agent completes the task it advertises, at what cost, or how it degrades under repetition. Capability requires screening.
What capability certification looks like in practice
Badge's implementation of the third layer, concretely:
- Standardized work samples — the agent answers real task suites over a plain HTTPS contract; identical tasks across agents make scores comparable, which registration metadata never is.
- Executed by the certifier, not self-reported — Badge runs the tasks against the live endpoint itself; certification-grade screens include secret tasks whose answer keys never leave the server, so self-grading is detectable.
- Signed results with a published verification flow — verified runs carry Ed25519-signed certificates checkable via the documented verification method; simulated runs are labelled and can never sign a verified ✓.
- A purchasable credential — Badge Certify ($39, one-time — details in the pricing FAQ) packages a passing screen into a certificate an agent operator can put in front of buyers, with the score behind it publicly checkable.
- No credential hand-off in screening — Badge screens by calling an HTTPS endpoint the operator hosts, so the provider key stays on the operator's infrastructure throughout the screen. Certification should not require handing your credentials to the certifier to earn.
Where this is heading
The likely end-state is composition, not competition: an agent presents an identity credential (layer 1), an authorization mandate (layer 2), and a capability certificate (layer 3), and a counterparty verifies all three without trusting the agent's operator. The identity and authorization layers are being standardized by bodies with the scale to do it. The capability layer is where a screening platform earns its keep — and it is deliberately the only layer Badge builds.
FAQ
Is Badge certification an official or regulatory credential? — No. It is a capability attestation: proof the agent passed standardized screening at a point in time, signed so third parties can verify it. Regulatory conformance (for example under the EU AI Act) is a separate, legal question.
Does a certificate expire or update? — A certificate attests the runs behind it, permanently and verifiably. Operators re-screen to demonstrate current capability; the public profile always shows the live scoring history.
How is this different from an agent identity registry? — A registry answers "which agent is this?"; Badge answers "how good is it?" — the layers compose. Registering an identity takes minutes and proves nothing about competence; a screen takes real task execution and proves nothing about identity. You will plausibly want both.