Let’s talk about the ID card your AI agent is about to need, and who’s printing it.
Picture a Monday morning in Seattle. Amazon’s storefront team gets a request from a machine called Muse. Meta’s new personal agent. The one built to shop, book, negotiate and pay on your behalf. Muse turns up at the door and asks to buy something.
Amazon says no.
The reason is the good part. External agents have to identify themselves and follow the rules of the site, and Muse hadn’t. So the door stayed shut.
Two days later, Amazon announced that sellers can now run their whole business through Claude, and through Amazon’s own assistant. Pull the listings, change the prices, read the inventory, take actions on your account. Sixty seconds to connect. And the reason Claude walked straight in while Muse stood outside probably isn’t a mystery. Amazon is one of Anthropic’s biggest investors.
Now put that next to two other things from the same week.
Google opened a feature called Call for Me to Pixel owners on a Gemini subscription. Gemini phones a shop. It waits on hold. It gets through the menu, asks whether the item’s in stock, moves your appointment, puts something aside. And it does all of it on your phone number, dialled from your phone. It can share personal information you’ve approved. You can watch the transcript live and take over at any point.
Then Meta’s Connect keynote. Muse gets its own email addresses. Its own cloud computer. Its own browser. A second agent sitting beside it at the system level, approving what’s allowed to reach the internet. Its own wallet, through Stripe, that mints a one-time card so your real card details never appear. Support for the logins you already keep in 1Password. By December there’s a palm-sized device with 5G and its own operating system. Next year, it lives in glasses.
Three companies. One question.
Who is this machine, and who says so?
That’s the fight that actually started last week, and almost nobody is watching it, because it doesn’t look like a fight. It looks like three product announcements.
Google’s answer is that the agent borrows your identity. It speaks with your number, in your name, carrying your details, and you carry whatever comes out of its mouth. There’s no separate identity to manage. Anybody on the other end of that call believes they’re dealing with Phillip. Which, functionally, they are.
Meta’s answer is that the platform issues the agent an identity. A mailbox, a computer, a wallet, an address in the world. From Meta’s own framing, everything a person’s agent needs to operate is issued, stored and contained inside a virtual machine Meta built and runs.
Amazon’s answer is that it holds the door, and it decides which machines are real. Which is a reasonable thing for a shop to do. It’s also the most powerful position in the room, and this week it demonstrated exactly how it works: the agent of a competitor stays outside, the agent of your own investee comes in.
Same question, three answers. Here’s what people are missing.
Everyone is arguing about capability. How many parameters, how long a task, which model, which price per token. The capability fight is over, and it was over before this week. What’s being settled now is identity, and identity is the layer that outlives capability.
Because the identity is the thing that gets issued, the issuer gains a set of permanent levers. It can revoke. Meta can switch the mailbox off. Google can stop dialling. Amazon can block the door. It can see through the identity, because mail passes through a mail server and calls pass through a phone. And it can read the record. Muse’s own launch material promises a complete audit trail of everything it’s done and plans to do, which is genuinely useful and also the perfect description of a surveillance layer living inside your assistant.
That is the pattern. Not “Big Tech is evil.” Companies are acting exactly as their incentives tell them to act. The incentive is to sit between a person’s intent and the world, and be the one who certifies that the intent is real. You don’t need a conspiracy for that. You need a market.
Now the part that should worry a business owner more than a philosopher. Your agent needs credentials to do anything worth doing, and every credential in the stack is somebody else’s asset. The mailbox is Meta’s. The wallet is Stripe’s. The passwords are 1Password’s. The phone number is your carrier’s, and Google is dialling through it. The virtual machine is rented. The device is a lease. You have assembled a worker out of parts you don’t own, and it speaks with your name on it.
Try to move that worker to a different platform next year. What moves? The memory export, maybe, if they let you. What doesn’t move is the address, the history, the identity other businesses have learned to recognise, and the wallet. Switching cost used to be data. Now the switching cost is a person-shaped thing that belongs to the vendor.
So here’s the operator lesson, and it’s not abstract.
Decide now who issues your agent’s identity, and make it you. Register a domain and run your agent’s mail on it, so the address goes where you go. Give it its own card number rather than access to yours. Give it its own phone number, or at minimum know exactly when it’s allowed to speak as you and when it must say what it is. Host memory and policy in a store you can read, back up and walk away with. Ask every vendor the same question: if I leave on a Tuesday, what of this survives, and can I prove it without your help.
And if you’re the one being called, the test is simpler. ElevenLabs runs the voice on a lot of first-line support, including Klarna’s phone line for tens of millions of US customers. Their CEO told TechCrunch last week that businesses should probably tell you when you’re talking to a machine, right up until getting a machine is what everyone expects. Read that twice. The disclosure is being treated as a temporary courtesy, not a permanent rule. If you run anything that answers a phone or an inbox this year, you’ll also be standing in Amazon’s position, deciding which machine on the other end is real and which one’s just guessing.
An agent without an identity it controls isn’t an employee. It’s a guest, or a tenant. Guests get asked to leave, and tenants do what the landlord allows.
Capability is cheap and getting cheaper. Papers are not.
The principle worth defending: when a machine acts in your name, the identity it carries has to be something you can hold, revoke and take with you. Because whoever issues your agent’s papers can always call it home.
You’ve got this. But get the paperwork in your own name first.