Let’s talk about the invoice that got paid because the machine on the other end had perfect ID.
On the ninth of October, a freight forwarder in Rotterdam lost about one and a half million euros. Not to a hack. Not to a leaked password. To an invoice that looked exactly like every other invoice, from a supplier agent that checked out.
Here’s the part you already own. That company runs an AI procurement agent. Normal thing in 2026 — you give it authority to read supplier mail, match invoices, and release payment under a limit. Three weeks before the loss, somebody registered an agent on one of the new trusted-agent payment rails. A name, a business identity, a wallet. All real. All verifiable.
Then they sent an invoice with a change of banking details.
The agent did its job perfectly. It checked the credential. The credential was genuine. It matched the supplier’s name. It came from a registered agent on a rail that was built, specifically, so machines could trust each other. So it paid.
Now picture the other end of that payment. A supplier who’s invoiced this company on the same terms for six years. He doesn’t know the money already left. He finds out when he calls to ask why he hasn’t been paid.
Every box was ticked. The cheque cleared. And nobody in that chain — not the agent, not the rail, not the platform in the middle — was asked the only question that mattered. Is this machine acting for the person it claims to be, and is it allowed to do this particular thing at this particular moment?
The easy read is “agents are dangerous.” That’s lazy, and it misses the whole lesson. Agents aren’t the story. Identity is.
We spent all of 2026 building an identity layer for machines that act on our behalf. Six rails, from Mastercard and Visa to Cloudflare and Coinbase. And it works. That’s the problem. It works so well that everyone, human and machine, started treating a verified credential as permission. It isn’t.
Authentication answers exactly one question: is this who it says it is. It says nothing — nothing — about whether the actor is allowed to do the specific thing it’s doing. A passport doesn’t let you into someone’s house. We wrote the passport and forgot the house.
Here’s what people are missing, and it’s the detail that gives the whole game away. Agent identity on these rails is optional. Cloudflare’s own words this year: agent identity is “completely optional” — a premium a business decides to buy, not a right you hold.
So follow the incentive. The attacker registers, because verification costs them nothing and buys trust. The small supplier down the road doesn’t, because it’s another form and another fee. The default is inverted. The fraudster walks in verified, and the honest party walks in anonymous. Any system where you have to pay to be trusted will fill up with the people who most need to be trusted and shouldn’t be.
And the second thing. That credential doesn’t carry a scope. It doesn’t say “this agent may redirect payment up to a limit, once, to an account already on file.” It says “this is a genuine agent.” Which every human and every model in the loop reads, wrongly, as “trust this.”
That’s a signature without a mandate.
So if you run an agent that touches money — or anything else that can’t be walked back — hear the operator lesson, because it’s the whole thing. Never let a verified credential stand in for authority. Require out-of-band confirmation for any change of payee, and confirm it through a channel you control, not the one inside the email that just arrived. Keep your own receipts, not the rail’s. And write the agent’s mandate down where a person can read it, not just where the model can.
Because the principle underneath is older than any of this technology. Proof of identity is not proof of consent. A credential tells you who’s knocking. Only a mandate tells you what they’re allowed to do, for how long, and on whose word.
And only consent you can revoke is consent at all. The machine can carry the papers. The human still has to be the one who decides what the papers mean.
You’ve got this.