Trust used to belong to the object.
For centuries we trusted things: the paper, the seal, the letterhead, the wet signature, the ID card in a wallet. We trusted the carrier and inferred the subject behind it. And we did so largely by perception , does this look official, does this feel right, would a forger really go to that much trouble.

That is exactly what the Transactional Trust Model I developed is meant to change. It is deliberately technology agnostic, which is why it has lost none of its validity: it does not describe a technology, it describes what trust actually requires.

• Identity: Who am I dealing with?
• Integrity: Is the information correct and unaltered?
• Liability: Is the statement binding and legally enforceable?

Applied to individuals, to #organizations, and to the third column: devices, software, IoT, and AI. All of it held together by a governance framework.

Two things happen when these elements are digitised properly. First, trust is decoupled from the object and bound to the subject: not to the document, but to whoever issued, signed and stands behind it. And second, counterintuitively, trust becomes less subjective. What used to be a gut feeling about a look-and-feel becomes something verifiable, provable and revocable. Digitisation does not dilute trust. Done right, it objectifies it.

Which brings us to the third column.

The third column is no longer a footnote

When I built the model, «devices, software, AI, IoT» was the forward-looking part. Today it is the busiest column in the matrix.

AI agents belong there; they are not a new category, and they do not need one. But they put more stress on that column than any sensor or connected device ever has. The reason is simple: a device sends data, an agent makes decisions on behalf of someone.

An agent searches, negotiates, buys, books, signs and escalates. At machine speed, around the clock. And in most deployments today, nobody on the receiving end can say who deployed it, what it is allowed to do, or who answers for it when it gets things wrong.

The new default is distrust. For agents, that is not a bug. It is the only rational starting position, until they can prove otherwise.

Four questions every counterparty must be able to answer

1. Who is the agent? A stable, verifiable identifier, not a user-agent string and not an IP address, both of which can be spoofed in seconds.
2. On whose behalf does it act? Which person or legal entity owns it, deployed it and stands behind it.
3. What is it allowed to do? Mandate, scope, limits, validity period.
4. Who is liable when it goes wrong? The delegation chain has to end with someone who can be held accountable.

If one of these four is unanswered, there is no transactional trust. Identity is the anchor for the other two elements: without it, integrity and liability have nothing to attach to.

Why this matters, beyond the obvious

Blocking everything is not a strategy. Bots already account for roughly half of internet traffic, and AI-driven requests are growing faster than human ones. Without a way to tell a legitimate agent from a scraper or an attacker, the only remaining defence is to block indiscriminately, which punishes exactly the agents we want to do business with.  

Ownership creates accountability. An agent identity that is not cryptographically bound to a person or a legal entity is worthless. The value is not the agent’s name, it is the verifiable link to the party behind it.

Delegation chains are the hard part. Agent A spawns Agent B, which calls Agent C at a third company. Every hop has to carry a traceable chain back to the original mandate. A one-time login at the start of a workflow proves nothing about what happens twenty steps later.

Identity without authority is a name badge without a job description. We solved this in the analogue world long ago: signing authority, procuration, entries in the commercial register, powers of attorney. The digital equivalent for agents, a machine-readable, verifiable mandate with limits, is still missing almost everywhere. Could the swiyu Trust Register evolve into such a trust anchor for AI agents?

Lifecycle and revocation at machine speed. Agents are created and retired in seconds, not in HR cycles. Being able to switch an identity off – instantly and verifiably – matters as much as being able to issue one.

No auditability, no trust. Disputes, chargebacks, supervisory reviews and litigation all depend on reconstructing afterwards who did what, under whose mandate. In regulated industries, anything that cannot be proven ex post cannot be trusted ex ante.

Privacy argues for agent identity, not against it. The same principle applies as for people: disclose exactly what the situation requires, no more. «Authorised agent of a supervised Swiss financial institution, mandate limited to CHF 10,000» is a far better answer than full exposure, or than no answer at all.

Trust is bidirectional. We tend to ask how a merchant verifies an agent. The reverse question matters just as much: how does my agent verify that the shop, the bank or the counterparty agent is genuine? Phishing at machine speed is not a hypothetical risk.

And finally, adoption. Trust in AI-driven financial decisions remains low. In the US, only around one in five people say they would trust AI with them (businesswire.com). The bottleneck for agentic business models is not model capability. It is trust. And trust is not built through better marketing, but through verifiable identity.

KYC has a younger sibling: KYA

Before 1989, global finance had no shared identity standard, which made illicit money very hard to trace. FATF changed that, and KYC became the entry control for the entire financial system.

Autonomous agents are at exactly that point today. Hence KYA – Know Your Agent: verify an agent’s origin, its owner, its permissions and its accountability before it transacts, and monitor it while it does.

This is no longer theory

The building blocks are being assembled right now:

• Web Bot Auth, an emerging IETF standard proposed by Cloudflare, authenticates agent traffic with cryptographic HTTP message signatures instead of spoofable headers.
• Visa’s Trusted Agent Protocol (launched October 2025 with Cloudflare) and Mastercard Agent Pay build on it, so a merchant can verify both the agent and its delegated payment authority.
• Microsoft Entra Agent ID gives every agent its own managed identity inside the enterprise directory.
• NIST has begun work on AI agent standardisation; the IETF published a first agent identity framework draft in March 2026; the MCP-I / KYA-OS specification was donated to the Decentralized Identity Foundation, built on DIDs and Verifiable Credentials.
• Singapore’s cyber security agency already names identity spoofing as an explicit threat and highlights trusted agent registries as an important control.
• From August 2026, parts of the EU AI Act introduce transparency obligations for certain AI systems, including disclosure that users are interacting with AI where applicable.

The risk is no longer that nothing happens. The risk is fragmentation: every platform issuing its own agent ID, in its own silo, with no interoperability, repeating precisely the mistake the industry made with human digital identity for twenty years.

And Switzerland?

On 28 September 2025 the E-ID Act was accepted by 50.39 per cent. Switzerland is therefore building a state-backed trust infrastructure for people.

One logical next step would be: verified identities for legal entities, and on that basis credentials for the agents those entities deploy. The chain is straightforward, a state-verified person acts for a verified organisation; the organisation issues its agent a credential with a mandate, limits and a revocation path. A Swiss bank could then prove that its agent really is its agent, and a customer could verify it in seconds.

That is not a compliance burden. It is a competitive advantage, and one Switzerland is unusually well positioned to build while others are still arguing about standards.

The bottom line

The model has not changed, because it never depended on the technology. Identity, integrity, liability, for individuals, for organisations, and for everything that acts on their behalf.

Agents do not earn trust by being intelligent. They earn it by proving who they are, on whose behalf they act, what they are allowed to do, and who answers for them.

The internet is not a lawless zone. That does not stop being true because the counterpart is made of software.