On October 7, Cequence Security pushed a feature called Agent Trust into its existing API protection platform. Two weeks later its executives were describing traffic attributed to an agent labeled "Muse" reaching more than half the customer sites the company monitors, and one travel customer blocking one request in five. Both figures originate with the vendor. Neither has been independently reproduced by a merchant or a third party. That provenance gap is the first thing I would flag in an audit, and it is the least interesting thing in the story.
The interesting thing sits three paragraphs deeper, in a claim that drew almost no attention: agents are completing multi-factor authentication at financial institutions. If that is accurate, MFA as a control is functionally dead against delegated automation, and every other artifact in this category — registries, behavioral profiling, biometric step-ups — is a patch bolted onto a primitive nobody has rebuilt.
Four standards, no referee
Agentic commerce has a structural gap, and it is not a product gap. It is an accountability gap.
Four competing protocols are being deployed in parallel. Skyfire comes from the crypto settlement world. Visa's Trusted Agent Protocol comes from the card networks. Google's AP2 comes from the platform layer. OpenAI and Stripe's Agentic Commerce Protocol comes from the model-and-payments boundary. Each is a bilateral issuer–acceptor construct. Each assumes, implicitly, that the standard owner sits inside the verification path and gets paid for it.
The merchant sits underneath all four and owns the liability. Block the agent and lose the sale. Allow it and inherit the fraud. That is what an infrastructure vacuum looks like from the till. Regulatory cover is not arriving to help: S.5051 sits in committee, and the vacuum is being filled by private registries with private adjudication rules.
Cequence's answer is not to pick a winner. Agent Trust reads all four standards at the merchant edge. In strategy terms it is Switzerland — the neutral aggregator — and it is a genuinely clever way to avoid betting on the wrong protocol. It is also an admission: the company that cannot define the standard settles for reading everyone else's.
What the registry actually is
Strip the branding. Agent Trust is a rule engine — CQ Prime — generating detection lists, plus cross-session behavioral profiling, plus a biometric confirmation pushed to the account holder's device, plus a protocol-agnostic registry that maps agent identifiers to issuers across all four standards.
There is no model architecture here, no training methodology, no alignment work. The "AI" label describes what is being defended against, not what is doing the defending. This is security orchestration — a recombination of mature bot-management primitives — and the honest framing is combination-level innovation, not invention.
The registry is the part worth forensics. Functionally it is a lookup: agent identifier in, issuing authority out. That is a thin technical artifact. It can be rebuilt in a quarter by any competitor with the same endpoint access. Its durability depends entirely on a question the source material never answers: do Visa, Google, and Stripe grant Cequence authorized read access to their registries, or is Cequence reverse-adapting against public mechanisms? Authorized integration is a moat. Reverse adaptation is a liability with a roadmap.
Rule-based detection has a known half-life. Signature and rule engines trail adversary evolution by construction. An agent that learns to shape its traffic toward the legitimate distribution — pacing, header consistency, session entropy — degrades the classifier without ever touching the registry. In my 2020 review of Optimism's testnet fraud-proof module, the defect that risked state divergence was not a happy-path logic error; it was a gas-estimation assumption that held only under expected load. Detection that assumes ordinary load fails precisely when it matters.
Here is the distinction that matters more than any product feature. There are two ways to authorize an agent. The first is a signed delegation credential: the principal issues a scoped, time-bounded, offline-verifiable capability, revocable by nonce or accumulator update. The second is probabilistic inference: does this traffic resemble a legitimate agent? These are not two implementations of one idea. They are different security classes. Inference carries a false-positive floor that cannot be engineered away; signed delegation carries a key-management problem instead.
When I optimized a zk-Rollup proving circuit in 2024, cutting proof generation by 40 percent and end-user gas by 25 percent, the commercially decisive part was not throughput. It was that verification became cheap enough to run per transaction. That is the bar for agent identity. If cryptographic verification costs more than the fraud it prevents, merchants will run inference and absorb the error rate.
Which brings us to the number nobody published. A travel merchant blocking one in five agent requests is a striking headline until you ask what fraction of those were legitimate buyers. Run the stress test: at a 20 percent block rate, if even a quarter of blocked requests are real customers, that merchant has taken a 5 percent revenue haircut to avoid a fraud loss that industry base rates put nearer 0.3 percent. The false-positive rate and false-negative rate are the only two numbers that determine whether this product creates or destroys margin. Neither appears in the disclosure.
Enforcement is not authentication
The blind spot is architectural. Agent Trust enforces at the transaction layer, not the authentication layer. It answers "should this request complete?" It does not answer "did this principal actually authorize this agent, for this scope, at this time?" Only the second question is a security property. The first is a risk score with a veto attached.
The biometric step-up illustrates the tension. Pushing a liveness check to the account holder's own device is a strong control against an agent that cannot reach that device. It is a weak control against an agent that has convinced the human to confirm — and consent-farming plus session relay is the standard playbook against every step-up mechanism deployed since 2019. Worse, biometric templates are non-revocable. You rotate a password in an hour. You cannot rotate a face. BIPA in Illinois, Article 9 of GDPR, CPRA in California: three retention regimes, and the material contains zero detail on storage, localization, or encryption of the templates being collected.
Then there is adjudication. When Visa's protocol returns "authorized" and Google's returns "unknown" for the same agent, what does a protocol-agnostic aggregator do? The answer is a policy decision made by a private vendor, applied at the point of sale, with no appeal path for the agent's principal and no published conflict-resolution logic. That is governance by default setting.
The edge problem is real. Cloudflare's Web Bot Auth, Akamai, HUMAN, DataDome — all sit closer to the traffic than an application-layer API protection platform does. Position beats feature in this market. A vendor integrated into application and API protection is fighting from the second row.
Trust is a bug. Every system that asks a merchant to trust a vendor's classification of traffic has relocated trust, not eliminated it.
What to watch
One signal outranks the rest: whether any of the four standards publishes a signed, scoped, offline-verifiable delegation credential with a working revocation path. That is the line between an identity layer and a traffic classifier wearing one.
Until then, Cequence's registry, Cloudflare's edge attestations, and everyone else's profiling are competing patches over a missing primitive, and merchants are paying for the patch while carrying the liability. S.5051 will move in six to twelve months or it will not. Cloudflare will ship or it will not. The question that actually settles the market is older than all of them: who signs the agent's authority, and who can revoke it?
If it is not verifiable, it is invisible.
