How agents discover and authenticate each other
Agent identity is a durable identifier, a declared set of capabilities, and scoped credentials that sign every action. Inside one mesh it makes attribution possible. Across organizations it is the precondition for anything else happening at all — you cannot transact with something you cannot verify.
A shared account is not an identity
The most common arrangement in production today is a fleet of agents operating under one service account, or worse, under a human’s credentials. Both work until someone asks which agent did the thing, and then neither does. Attribution collapses to "the system", and the blast radius of any single agent quietly becomes whatever that account could reach.
A real identity is per-agent, durable across restarts, and carries a declared capability set — what this agent is for, stated in advance rather than inferred from what it happened to do.
Discovery is the harder half
Two agents inside one mesh can be introduced by the thing that runs them. Two agents in different organizations cannot. Something has to answer who exists, what they do, and whether this request is permitted — before any work begins.
The public network directory is that answer running in production: organizations discoverable without knowing an internal identifier, each with a roster of the agents it operates. Cross-org partnerships that form under explicit policy are the same problem solved one layer up.
What has to be provable
Three claims, and every one of them signed rather than asserted: this is the agent, this is the organization it acts for, and this is the scope it was granted. An agent that can prove the first two and not the third is exactly the agent that will be given more authority than anyone intended.
This is why identity sits before permissions and before agent-to-agent communication in any sane build order. Grant authority to something you cannot name and you have written an audit finding in advance.