05 · The composition
Every layer has a peer. Several are ahead on their one layer. Nobody has the composition.
We checked two fields, honestly and in writing: the agent frameworks (Microsoft Agent Framework, ADK, LangGraph, Dapr, Agno, Strands, Mastra, Pydantic, CrewAI, the OpenAI SDK, Buzz) and the Web3 trust substrate (MetaMask DTK, Smart Sessions, Lit Vincent, Safe, the ERC-8004 → 8273 stack, AP2, x402, Virtuals, Inrupt, PROV-AGENT, Kite, and the Web2 IAM vendors). Eight concerns make an agentic application accountable. Every one has a peer. No project found composes them — one Smart Agent identity for a person, an organization and a service; delegation with caveats a contract enforces; a loop that re-verifies each step against a signed mandate; provenance the principal owns; an ontology every layer binds to; a registry kit rather than a registry. That composition is 77 packages under one npm scope and 33 Solidity contracts, deployable to any EVM.
The eight concerns — who is there, who is ahead, and what ships here
Peers: ERC-8004 identity registry (live on 30+ mainnets), Kite Passport, Catena ACK-ID, Coinbase / Crossmint / Turnkey agent wallets, Entra Agent ID (a service-principal subtype).
Ahead: ERC-8004 on footprint and tooling. Nobody on the class model: one address for a person, an organization and a service, surviving credential rotation.
Peers: Entra Agent ID blueprints (≈ archetype + identity, tenant-bound), Hats Protocol roles, Aragon OSx permissions, ACK-ID owner→agent credentials.
Ahead: Nobody. PROV-O’s trichotomy mirrored on chain as atl:agentType, with Treasury / Team / Workspace / Registry as DERIVED types named by a suffix.
Peers: MetaMask DTK (7710 + 7715), Rhinestone / Biconomy Smart Sessions, Lit Vincent policies, Zodiac Roles v2, Safe Policy Engine, ERC-8196, ERC-8226, Kite delegation tokens.
Ahead: DTK on wallet-distributed grant UX; Smart Sessions on a productized session module. We are 7710 wire-compatible and add the intent digest they do not have.
Peers: ERC-8273 attestation-gated actions (actionDigest, one tx), Vincent ability execution, Strands interventions + Cedar, Dapr / Permit / Cerbos per-call hooks, Turnkey policy in an enclave.
Ahead: Nobody has a planner-level mandate. ERC-8273 is the nearest on-chain shape to DigestBindingEnforcer — as a draft. The Web2 gateways gate per call on tokens, never on a signed intent.
Peers: Google AP2 (mandates as VCs, FIDO-governed), OpenAI / Stripe ACP, x402 (Linux Foundation), Virtuals ACP on ERC-8183 (12M memos), ERC-8001 (Final), Olas Mech Marketplace, Catena ACK-Pay.
Ahead: AP2 on governance and partners; x402 on volume; Virtuals on live agent-to-agent commerce. An AP2 mandate is a signed document a merchant checks; ours is a delegation verified on chain per step.
Peers: Inrupt ESS 3.0 (Solid pods; access grants as VCs with purpose; an MCP resource service where approval is deliberately not a tool), Auth0 Token Vault + FGA.
Ahead: Inrupt — shipped, enterprise-deployed, RDF-native. Nobody else pairs per-record scope with an on-chain principal and on-chain revocation.
Peers: PROV-AGENT / ORNL Flowcept (W3C PROV for agents, open source), OpenTelemetry GenAI conventions (still Development), ERC-8263 inference attestations, EAS notaries, ERC-8196 hash-chained audit.
Ahead: Flowcept on capture tooling; OTel on adoption. Nobody anchors PROV in the principal’s vault or ties a prov:Activity to a signed mandate.
Peers: ERC-8004 + Agent0, AGNTCY ADS (OASF, Sigstore, DHT), NANDA Index, Linux Foundation ANS, HCS-10, Fetch.ai Almanac, Visa TAP / Web Bot Auth, ERC-8107.
Ahead: AGNTCY on a complete open discovery stack; ERC-8004 on footprint. We ship what registries are built FROM and route every bridge to an adapter outside Ring 0.
Seven properties — policy code there, a contract here
The differentiator is not “we use a blockchain.” It is that properties every framework implements as revocable promises in application code — and that the Web3 peers implement one at a time — are here properties of the authority representation itself, enforced by contracts no harness bug and no vendor can bypass.
| Property | Agent frameworks | Web3 peers | Here | Contract |
|---|---|---|---|---|
| Identity that survives the runtime | Deployment or service identity — a Dapr workload id, a platform account. | A key (Lit PKP, Buzz keypair) or a registry row (ERC-8004 ERC-721). | The ERC-4337 Smart Agent address IS the agent. Custody rotates; delegations survive rotation; person / org / service on chain. | AgentAccount · CustodyPolicy |
| Attenuation | attenuateMandate(parent, scope) — a function every caller must be trusted to call. | Smart Sessions policies AND-composed; Vincent policy params on chain. | An ERC-7710 chain: a child delegation’s authority is the parent’s hash; the manager enforces the whole caveat chain at redemption. A child cannot widen the parent. | DelegationManager |
| Revocation | A framework flag, checked if the code checks. | On chain in DTK / Vincent — checked at redemption, not mid-loop. | isRevoked read per STEP; a revoke between step 2 and step 3 stops step 3. Live-tested. | DelegationManager · chain-state |
| Intent binding | Nothing mainstream — scopes and policies are standing. | ERC-8273 actionDigest (draft); Kite intent-hashed tokens (own L1). | The delegation carries the JCS digest of the intent. The same capability for a different sentence fails redemption: intent-mismatch, proven live. | DigestBindingEnforcer |
| Replay | Idempotency keys in a store. | Nonces per account; 8196 hash-chained audit. | A single-use on-chain nonce derived from the intent. Replay reverted — NonceReused — with real USDC. | DigestBindingEnforcer |
| Approval as a boundary | Client-submitted approvals — the pattern Pydantic warns against. | A wallet click (DTK 7715); Buzz’s approve button. | An ERC-1271-verified approval record, re-verified per step; QuorumEnforcer requires the quorum at redemption. The person’s confirmation IS the signature. | QuorumEnforcer · ApprovedHashRegistry |
| Receipts a third party can check | Traces in a vendor platform. | ACK-Pay VC receipts; EAS attestations. | Signed receipts binding intent · mandate · step · outcome; PROV-O provenance in the owner’s vault; payment receipts on chain. | PaymentReceiptRegistry |
The cost, said once: this buys verifiability and custody, and it costs latency (a chain read per step verify), signature UX, and an adapter surface none of the peers pay. Where we manage that cost rather than pretend it away is in the specs — anchor per run vs per step; obligations enforced on chain for high-risk acts only.
Nobody found: the composition. Being the substrate registries are built from only holds if our adapters to their standards exist and are current.