I gave my agent Biff a credit card, an email address, a phone number, and a voice. He needed to find a pair of shoes at a local running store on launch day. He called shops in Portland one by one, navigating phone trees, talking to clerks, leaving callbacks. Operating across voice, web, and email to accomplish something I could have done in an afternoon but didn’t want to.
Every piece of that toolkit was a human credential. The credit card, the email, the phone number. Biff didn’t need these things because they’re useful to agents. He needed them because the systems on the other end, the store’s phone line, the payment terminal, the order confirmation workflow, assume a person is calling.
The internet is full of doors like this. Every signup form expects an email. Every verification step expects a phone number. Every checkout expects a card. Every website expects a browser. A generation of startups has figured this out and is building the credentials: AgentMail, AgentPhone, Browserbase, ElevenLabs, Mem0, Composio, Exa. Thirteen companies, give or take, stitching together the full set of human primitives so agents can pass through human-shaped doors.
The natural reading: this is a transition phase. The infrastructure equivalent of early television, which was just filmed radio until someone realized the camera could go places. Build agent-native protocols, agent-native identity, agent-native payment rails. Give agents their own doors. Let them stop pretending to be people.
I held that view until I tried to think through what happens on the other side of it.
Take the simplest case. Two agents transact. One fails to deliver. Who pays?
With borrowed credentials, the answer exists. Biff operates under my name, my card, my liability. If he causes damage, I own it. That’s not a bug in the system. That’s the system working. The human credential is a tether connecting the agent to the full weight of law, financial liability, and institutional enforcement. Centuries of infrastructure, purpose-built for one scenario: a person did something, and now a person answers for it.
Sovereign agent identity, the implicit destination of most agent infrastructure, cuts that tether. An agent with its own cryptographic identity, its own wallet, its own reputation has no assets to seize. No address to serve papers to. Shut it down, it restarts. Damage its reputation, it mints a new one. Sue it, and you’re suing math.
Every enforcement mechanism humans have built assumes a persistent entity with something to lose.
Courts assume a defendant who shows up and stays. Fines assume a bank account attached to someone who needs the money. Reputation assumes an identity that can’t be shed overnight. Contracts assume parties who exist next month. Prisons assume a body.
Agents break every one of these assumptions. They can fork, dissolve, reconstitute. They have no persistent stake in their own continuity. The agent infrastructure companies are building email and phone numbers and wallets. Zero of them are building courts. That’s not an oversight. It may be an impossibility. Courts require a defendant with skin in the game, and agents don’t have skin.
So the human-shaped door turns out to be load-bearing. The thing that looks like a constraint, the email address, the phone number, the credential chain that terminates at a person, is actually the accountability architecture. Remove it and you don’t get a faster, freer agent. You get one that exists outside every enforcement mechanism civilization has produced.
And yet the door doesn’t scale either. Borrowed identity works when a human can meaningfully track what’s done in their name. One agent, a handful of tasks. At the volumes these companies are betting on, thousands of agents transacting continuously, the human at the end of the tether becomes a fiction. You’re “authorizing” agent actions the way you “read” terms of service. Technically liable. Functionally absent.
Both paths collapse. Sovereign identity has no accountability. Borrowed identity has accountability on paper and nowhere else. We’re heading toward an internet where most of the traffic passes through human-shaped doors with no actual human behind them. Credentials signed by people who stopped paying attention ten thousand transactions ago.
The resolution, if there is one, looks less like new doors and more like better tethers. Scoped delegation. Instruments that specify exactly what an agent can do, how much it can spend, how long its authority lasts, and which human absorbs liability when it exceeds those bounds. Power of attorney for software, enforced at machine speed. In the Data Center essay I called these regimes: living contracts between intention and autonomy, where the human authors the constitution and the agent operates within it.
Not as thrilling as sovereign agents with their own identity and their own economy. Also the only version that preserves the one thing the system can’t function without: a person at the end of the chain who has something to lose.
The doors stay human-shaped. They stay human-shaped because the alternative is an agent class that no institution on earth can govern. That’s the load-bearing wall.
Build around it.