They have read the moment correctly. The disagreement is architectural: identity as an input to a payment, or as a layer of its own.
In the space of a few weeks, three of the largest names in payments and identity reached the same conclusion: an AI Agent is only trustworthy if you can prove which human stands behind it. Visa introduced Trusted Agent Protocol and a registry-based trust model for verified AI Agents and service providers. Mastercard introduced Verifiable Intent as an open, standards-based trust layer. Experian launched Agent Trust, a "Know Your Agent" framework designed to bind verified consumers to authorized AI Agents.
They are right about the problem. The disagreement worth having is about where the answer lives.
Identity Built for the Checkout
Visa's directory tells a merchant which AI Agents Visa has vetted to transact on its rails. Mastercard's Verifiable Intent produces an audit trail a network and merchant can fall back on when a purchase is disputed. Experian's Agent Trust issues a token that scores an AI Agent's fraud risk in real time. Each is real and good at its job.
But each is built for the moment of payment, anchored to the relationship its issuer already owns: Visa's card rails, Mastercard's network, Experian's consumer file. The verified human behind the AI Agent is established in service of authorizing or disputing a transaction. That is identity as an input to a payment.
It works inside that context. The question is what happens outside it. An AI Agent that needs to prove its principal's jurisdiction to a regulator, its eligibility to a counterparty on another network, or its authorization to a service that takes no cards at all, is asking a question the payment layer was not built to answer.
The Shared-Standard Problem
It would be easy, and wrong, to call these closed silos. Mastercard open-sourced Verifiable Intent and built it to be protocol-agnostic. Visa's Trusted Agent Protocol is on GitHub. Experian's Agent Trust is platform-agnostic and already integrates with Visa's protocol. The market is partly converging, not only fragmenting, with Google's AP2 drawing more than sixty partners.
The gap is not openness. It is that all of these sit at the application layer, on top of existing commerce rails, each stewarded by the company that launched it and shaped by that company's risk model. There is no neutral identity primitive underneath them that an AI Agent can carry from one to the next. Convergence on a payment standard is not the same as a shared layer of who an AI Agent is.
What Sits a Layer Below
Concordium's bet is that the verified human-to-agent link is not just an add-on to a payment. It is an identity primitive, and it belongs at the protocol level.
On Concordium, identity is established when an account is created, for humans and AI Agents alike. The AI Agent carries a verified link to the human who authorized it, recorded on the Concordium Agent Registry, and can prove jurisdiction, eligibility, or authorization to any counterparty, on any network, from Ethereum to Solana, without exposing the data behind it and without routing through the company that issued the credential. The Identity Provider verifies the person once, and then the requested attribute travels wherever they or their agent go. The chain records what the AI Agent did. Neither knows what the other knows.
That is the difference between identity bolted onto a payment and identity built into the protocol. One is only as portable as a counterparty's trust in the company that issued it. The other is verifiable by anyone, decentralized, carried as a Verified by Concordium badge that travels with the AI Agent.
Visa, Mastercard and Experian have read the moment correctly: autonomous AI Agents need a verified human behind them. Where they have placed that link, inside the payment stack, is where it is most useful today and least portable tomorrow. The Agentic Economy will need a layer that no single network owns.
To us, the identity problem and the payment rails problem are one problem. The next question is what happens when an AI Agent needs to settle, and the rails it reaches do not recognize the identity it was built on.