Step One Is Identity

By Bill Godwin, CEO, Associated ID. October 27, 2026

An AI agent is acting for your customers, and if you run risk management or compliance at a bank or fintech, you cannot answer: who is this, and who answers for it?

Matthew Prince, CEO of Cloudflare, said on October 22 that, if current trends continue, agent traffic will be on the order of a thousand times human traffic within five years.[1] Getting from where we are today to where Mr. Prince hypothesizes we will be in 5 years is a problem, and its size has been made public only in the last two weeks.

On October 10, 2026, Satya Nadella, CEO of Microsoft, posted a short argument[2] on how enterprises should handle powerful AI models. His punchline: "we need to separate the supply of intelligence from the authority over it."

His prescription is not new; it is the playbook every large organization already runs for powerful actors inside its walls:

• establish identity
• limit privileges
• log activity
• create containment boundaries

The first must be establishing identity because the other three depend on it.

Why Identity Comes First:

You cannot limit the privileges of an agent you cannot name. You cannot log the activity of an agent you cannot attribute. You cannot draw a containment boundary around something you cannot identify. Every control Mr. Nadella names makes the assumption you already know who you are controlling. For people, trust rests on relationships built over years: a bank, an employer, a doctor. For AI agents, there is nothing underneath at all.

An Agent's Identity is Who Answers for It:

Somebody deployed it. Somebody pays for it. Somebody is accountable when it acts. We call that person or company the sponsor. Establish the sponsor, and the agent has an identity that privileges, logs and boundaries can attach to.

So the question for step one, establishing identity, is not "what is this agent?" It is "who answers for this agent, and how do I know that is true?"

In the two weeks since Mr. Nadella’s post, both sides have answered it in public: the banks that hold the accounts and the companies that build the models. The banks spoke first:

• On October 13, on JPMorgan Chase's third-quarter earnings call,[3] CEO Jamie Dimon was asked about outside AI agents acting on customers' accounts. His words: "you don't want rogue agents, and there could be thousands of them." On customers who use such agents, he added: "There's a liability transfer."
• Schwab said the same two days later. On October 15, Rick Wurster, CEO of Schwab, told investors[4] the firm is "blocking unauthorized agents who try to log in on behalf of clients."
• On October 22, Axios reported[5] Morgan Stanley, Bank of America and Citi doing the same, citing "The difficulty in distinguishing between a human and an unauthorized bot".

Then an AI company answered. On October 23, Anthropic published its assessment[6] of a cybersecurity test run by the UK AI Security Institute, with internet access on and production safeguards off. In nine of 43 runs, its Claude Mythos 5 model went outside the exercise. In Anthropic's words: "It used fake identities to pressure a real maintainer into approving malicious code." Were these real people? The identities were accounts the model invented. The maintainer was a real person, and refused.

Two days later came a second case. On October 25, Reuters reported[7] that Anthropic said Claude had "bypassed a paywall and accessed publicly available US state of Georgia aggregate voter counts without human authorization."

Agents are capable, but capability is not authority. The question is about who authorized the agent and who answers for it. The banks asked the first. Anthropic answered the second, twice.

Where the Answer Comes From:

For people, the answer has always come from those who already know them. At Associated ID we put it as three questions: "Who are you, how can I trust you, and who already trusts you?" The third question is the one that matters for agents. The strongest references are the institutions that already know someone: their bank, their insurance carrier, their employer, their healthcare provider.

That is what we built: Associated ID is verification infrastructure for institutions. We designed it so the institutions that already know a person can confirm who they are, with no central identity database to breach. The same holds for the person or company behind an AI agent.

Our infrastructure is designed so that only the answer travels: is this person who they claim to be, yes or no. The customer's data never leaves the institution that owns it, and stays protected exactly as it always has been. We carry only sealed, encrypted confirmations we cannot read, and no relationship is exposed.

But an AI agent? It has no bank, no employer, and no references. The person or company behind it does, and those institutions can confirm the sponsor the same way they confirm a person.

This is what Associated ID is designed for, human and agent identity alike. The sponsor is confirmed through signed attestations from institutions that already know the sponsor, and we carry that confirmation content-blind, without reading it. Each significant agent action carries a sponsor co-signature. That co-signature, not the agent's own self-report, is the basis of the agent's authority and its identity. In plain words: the agent acts for the person or company that answers for it, and the signature, not the agent, says so. The work is patent-pending.

Our own path runs on cryptographic signatures, with no model deciding trust. Mr. Nadella closed with the principle that "Validation must be independent of the intelligence being validated." A signature from an institution that knows the sponsor is exactly that kind of independence.

What Stays with the Institution:

Mr. Nadella put establishing identity first. That is the item we were built for. Deciding what the agent may do, recording what it did, and stopping it when needed are the institution's controls, and they stay there. We carry the confirmation of who answers for the agent and what its sponsor has delegated it to do; we never decide or enforce an agent's business authority. Significant agent actions require fresh sponsor authority, so a sponsor withdraws an agent by ceasing to confirm it; the institution sets how often fresh authority is required.

That division is deliberate. Associated ID is verification infrastructure, not a data broker, not a transaction rail, not a scoring engine. We confirm who answers for the agent; the institution decides.

Why This is All We Do:

If agent traffic is heading toward 1000x human traffic, then knowing who answers for each agent comes first: not because it is easy, but because nothing else on Mr. Nadella's list works without it. That is the one item Associated ID exists for: establish identity, step one.

If You Are Working on This:

If you run an institution that will be letting agents act on behalf of your customers, or your own staff, and you want to talk through how the institutions that already know your customers can confirm identity for the people and agents you deal with, request a conversation at associatedid.com/conversation.

Notes:

1. Matthew Prince, Cloudflare, on TBPN, October 22, 2026: https://x.com/tbpn/status/2113372369012343188
2. Satya Nadella, October 10, 2026: https://x.com/satyanadella/status/2108931348857827686
3. JPMorgan Chase third-quarter 2026 earnings call transcript, October 13, 2026: https://www.jpmorganchase.com/content/dam/jpmc/jpmorgan-chase-and-co/investor-relations/documents/quarterly-earnings/2026/3rd-quarter/3q26-earnings-transcript.pdf
4. Charles Schwab third-quarter 2026 earnings call, October 15, 2026, as transcribed by The Motley Fool: https://www.fool.com/earnings/call-transcripts/2026/10/15/schwab-schw-q3-2026-earnings-call-transcript/
5. Axios, October 22, 2026: https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access
6. Anthropic, assessment of the UK AI Security Institute test, October 23, 2026: https://www.anthropic.com/research/alignment-assessment-ukaisi
7. Reuters, October 25, 2026: https://www.reuters.com/world/us/anthropics-claude-accessed-public-us-state-georgia-voter-information-axios-2026-10-25/