Two theories of agent identity hit the stage this week, four days apart. The FIDO Alliance closed Authenticate 2026 on October 20 with a wallet-certification announcement that frames identity as something a person carries. AGNTCon and MCPCon open October 22 in San Jose with an agenda that frames identity as something a platform issues. Between the two programs sits a production failure neither theory covers: the BeyondTrust breach, where the broken check was not who you are but where the request came from.
FIDO’s October 20 announcement is the clearest statement yet of the wallet-native position. The alliance is working toward an ecosystem “where people and their agents access and interact with services by relying on verifiable human identity,” a “cryptographic root of trust” that closes the phishable gaps at account onboarding and recovery. In FIDO’s framing that root of trust is also “a prerequisite for agentic commerce, ensuring each transaction is rooted in verified human approval, traceable to the person who granted it, and within the limits they set.”
Two working documents carry the theory: a Credential Manager Reference Architecture, defining how digital wallets should meet functional, security and interoperability requirements, and a Framework for Verifier Identification. Both are promised “in the coming weeks,” not published. An External Advisory Forum for issuers, governments and regulators launched alongside them. “The vast potential of digital credentials will only be realized if people, organizations and governments can trust them wherever they’re used,” said Andrew Shikiar, the FIDO Alliance’s executive director and CEO.
The competing theory opens Thursday at the San Jose McEnery Convention Center, where the agenda bills 3,500-plus attendees and 150-plus talks across 11 tracks. Here identity is a property of the tool-call layer. Block’s Bradley Axen keynotes on workspaces where “permissions and identity carry across tools.” A day-one session on governing agent calls prescribes the pattern: “intercept every call an agent makes, swap in short-lived scoped credentials instead of handing it real secrets.” MCP co-creator David Soria Parra opens the protocol’s track Thursday morning, and Google Cloud’s Rao Surapaneni follows on Friday with “a unified control tower for security and policy enforcement” over MCP, A2A and OpenTelemetry.
Set side by side, the contrast is clean. FIDO wants a portable credential that proves the human to any relying party. The MCP world wants a scoped credential that proves the agent to any tool. One moves identity outward from the person; the other issues identity downward from the platform.
Both theories verify the claimer. Neither verifies the requester. That distinction is the whole story of the BeyondTrust Remote Support breach: CVE-2026-102764, an improper origin validation flaw (CWE-290) in an internal messaging component, exploited as a zero-day from August 29 by ARMORY CASTLE. The component trusted the origin of a message instead of checking it, and an unauthenticated attacker performed file operations on the appliance. Every identity layer downstream was working. The one check that would have stopped it, the request never got.
FIDO’s own Verifier Identification framework concedes half the gap in plain terms: credential managers “excel at proving who the user is, but lack scalable mechanisms to validate the identity of the verifier requesting the data.” The wallet, in other words, cannot yet verify who is asking. The gateway camp’s current answer is the choke point: short-lived scoped credentials plus a log of every call. That verifies channel and scope. It does not establish, as analysis, that a request arrived from where it claims to have arrived.
Forkast has tracked the claimer side of this for months: the payments industry’s “know your agent” work, Proof’s x401 protocol for identifying who is behind an agent, and Descope’s MCP-native auth at the gateway. Those are all assertions about the actor. Origin is a different question, and this week’s conferences stage the identity debate as if the origin question were already settled.
The money lens sharpens the stakes. FIDO ties its root of trust directly to agentic commerce: transactions “rooted in verified human approval, traceable to the person who granted it, and within the limits they set.” AGNTCon puts the spend side on the table in its own program, where one keynote frames the deployed agent as “an autonomous buyer, spending tokens on models, tools, and retries that nobody explicitly approved.” An approval layer that cannot verify the requester, or a spend layer that cannot establish origin, leaves both open to the spoofing class that hit BeyondTrust.
Three tells. Whether the identity-adjacent keynotes, the workplace session on permissions carrying across tools and the demos on governing every agent call, produce a mechanism or stay at framing. Whether anyone demonstrates origin verification at the wallet layer, which FIDO’s own framework says is not yet scalable. And whether the gateway answer to origin turns out to be more than channel trust and logging. The FIDO working documents are announced, not public; the AGNTCon sessions are staged talks, not shipped specs. Until one of the two theories names the mechanism, the origin check gap stays open.
