04 · The Web3 field

Is anyone else building the substrate itself? Every layer, yes. The composition, no.

A project counts as similar if it makes at least one of our load-bearing claims: the agent’s identity is an on-chain account, not a key or a row; authority is a revocable, attenuable, on-chain-verifiable grant rather than a credential or an ACL; an autonomous loop is gated per action by that grant; evidence of what an agent did is a record the principal owns. Searched September 2026. The closest single analogs are Lit’s Vincent and Kite’s Agent Passport — each about a third of the surface, each rooting trust somewhere we deliberately do not. The ERC agent stack is where the same ideas are being standardized piece by piece, and where our adapters should point.

On-chain delegation and policy-bounded execution

MetaMask Delegation Toolkit — ERC-7710 + 7715

A session account requests execution permissions; the person approves a typed permission in the wallet; the session redeems through the 7710 Delegation Manager from her own account. Explicit agentic-AI positioning; 7702 brings EOAs in.

ahead ·: Wallet distribution of the grant ceremony; human-readable, adjustable permission types.
stops ·: One account model. No person / org classes, no harness, no provenance.
take ·: The 7715 request / grant shape for the Home ceremony — a mandate request the person can ADJUST before signing. We stay 7710 wire-compatible.

Rhinestone / Biconomy Smart Sessions

One ERC-7579 validator for session keys across Nexus, Kernel, Safe7579; permissions and policies AND-composed. Their thesis in our words: “the user owns the wallet; the agent is a delegate, not a co-owner.”

ahead ·: A productized session module; ours is still inlined in AgentAccount.sol.
stops ·: Sessions and spend only; no identity classes, no intent.
take ·: The validator / policy split when we extract SessionKeyValidator.

Lit Protocol Vincent

The closest single analog on the delegation + loop axis: Abilities governed by Policies with a precheck → evaluate → commit lifecycle; user params on chain the app cannot alter; a Connect page to approve and revoke; an app registry.

ahead ·: Shipped per-execution policy with persistent state (daily spend ledgers) and a marketplace UX.
stops ·: The trust root is Lit’s threshold network — the key is THEIR MPC. Policies are JavaScript. No smart-account classes, no A2A / MCP admission, no provenance the user owns.
take ·: The commit phase — post-execution state — is what our ObligationEnforcer must model explicitly.

Zodiac Roles v2 · karpatkey

Permissions as code: declarative, diffable, version-controlled permission sets on a Safe; DAOs let a treasury operator act under a voted policy.

ahead ·: The permission-diff UX; operational maturity of treasury delegation.
stops ·: Safe-shaped, operator-shaped; no agents, no intent.
take ·: The diff view — for caveat changes and for playbook upgrades (skills gained / lost).

Safe · Brahma ConsoleKit

Safe: deny-by-default guards referencing policy contracts. Brahma: policies stored OFF chain with a commit hash on chain, validated by a service whose signature the guard checks.

ahead ·: Safe on TVL and battle-testing.
stops ·: Brahma is the architecture we refuse: the enforcement point is a service; the chain only verifies the service’s attestation.
take ·: Deny-by-default as a stated invariant for treasury agents. Read Brahma to recognise the drift, not to copy it.

Coinbase Agentic Wallets · Turnkey · Privy · Crossmint

Policy enforced in a TEE or on the vendor’s servers (Coinbase, Turnkey, Privy) or in the contract (Crossmint). x402 spend controls ship an in-memory store by default.

ahead ·: Volume, KYT, card rails; Turnkey’s DENY-overrides-ALLOW circuit breaker.
stops ·: Vendor-side policy as the authority.
take ·: A steward-toggled deny / kill-switch caveat; one ceremony that revokes every live wire for an agent.

Kite Chain + Agent Passport

A purpose-built L1; user account → BIP-32 agent → ephemeral session keys; delegation tokens carrying an intent hash; x402 / MPP / AP2 bridges.

ahead ·: The identity SHAPE is nearly ours, shipped.
stops ·: Proprietary chain, closed core, payments only.
take ·: Watch, don’t adopt.

The ERC agent stack — where our vocabulary is being fixed, without us in the room

ERC	Title	Status	Overlap	Our position
8004	Trustless Agents — identity / reputation / validation registries	identity + reputation live on mainnet	A registry entry as a FACET of the Smart Agent.	A facet target since ADR-0010; the adapter lives in a sibling repo. The largest external-footprint gap we have.
8001	Agent Coordination Framework — intent + per-participant acceptances	Final	CoordinationPlan adoption + ContributionCommitment against a plan hash.	Publish an 8001 projection of a commitment externally; apcoord: unchanged.
8183	Agentic Commerce — job escrow, evaluator-only completion	Draft; Virtuals runs it (12M memos)	The offer algebra and fulfillment evidence; evaluator ≈ attestor.	Crosswalked; escrow stays an external commerce adapter. Evaluator-as-an-address is the right abstraction.
8196	AI Agent Authenticated Wallet — policy proof per tx, hash-chained audit	Last Call	Caveat-bound execution + receipts.	Their policy is a struct; ours is enforcer contracts. Their hash-chained audit requirement is one we should meet.
8273	Attestation-Gated Agentic Actions — capability + actionDigest, one tx	Draft	DigestBindingEnforcer + the intent-derived single-use nonce — our core differentiator, as a draft ERC.	Study before DigestBindingEnforcer is final; consider an 8273-compatible read as an external profile.
8226	Regulated Agent Mandate — scoped, time-bounded, capped authority	Draft	Our Mandate: a delegation + intent caveat.	Same noun, narrower domain; a future adapter target for regulated assets.
8257	Agent Tool Registry — manifest hash + invocation predicate	Draft	tool-policy, capability ids.	Tool manifests on chain are not our model: capabilities are the record; tools are operations.
8126 · 8107	Verification risk score · ENS transitive trust graph	Final · Draft	agent-relationships, discovery.	Reputation and trust-graph proximity are NEVER gates here. Signals for discovery, never permission.

The survey’s own verdict: outside 8004, no production product with meaningful usage has surfaced for the rest. They are designs — which is exactly why they are worth reading now. ERC-8273 in particular is our core differentiator, intent-digest-gated action, as a draft ERC.

Identity, discovery, naming

ERC-8004 + Agent0 + ChaosChain

ERC-721 identity → registration JSON listing A2A / MCP / OASF / ENS endpoints; reputation feedback; deterministic addresses on 30+ chains.

ahead ·: Footprint and tooling — create-8004-agent, subgraphs, explorers.
stops ·: A row is not a principal; no authority model.
take ·: The registry entry is a facet; the SA is the anchor; registry-kit is what registries are built FROM.

AGNTCY (Linux Foundation · Cisco)

OASF skill taxonomy, a content-addressed Agent Directory (OCI, Sigstore, DHT), VC badges for agents and MCP servers, observability. Webex-integrated.

ahead ·: A complete open discovery stack with enterprise adoption.
stops ·: Workload / badge identity, not principal identity; no authority.
take ·: Sigstore-style transparency for released cards; OASF taxon publication via an adapter.

NANDA (MIT)

One index record per organization mapping identity to the next discovery object; an IETF draft on registry-assisted discovery without DNS anchors; AgentFacts as JSON-LD.

ahead ·: A standards venue for identity-first resolution.
stops ·: Signs at the index / issuer / resolver; we sign from the anchor.
take ·: Nothing new — our private-resolution stance already says naming ≠ resolution ≠ listing.

Linux Foundation ANS · GoDaddy ANS · ENS · HCS-10

DNS-anchored or chain-native naming and profile standards with their own identity roots.

ahead ·: DNS-scale reach; mature registrars and resolvers; a live Hedera network.
stops ·: Each makes the NAME or the record the principal.
take ·: All are facets. External names resolve to the same Smart Agent; bridges live outside Ring 0.

Visa Trusted Agent Protocol · Cloudflare Web Bot Auth

Agents sign HTTP requests (RFC 9421); merchant edges verify against a key directory; AWS WAF, Vercel, Shopify, Akamai verify it.

ahead ·: Deployed at the CDN layer.
stops ·: Transport evidence about a request.
take ·: Admit RFC 9421 signatures at the edge as transport evidence — like mTLS, never authority, never a stage skipped.

Mandates and payments · consented data · provenance · the Web2 answer · TEEs

Google AP2

Intent / Cart / Payment mandates as W3C VCs signed by the user’s wallet or the agent’s key; A2A + UCP extension; donated to the FIDO Alliance.

ahead ·: Governance and 60+ partners.
stops ·: A mandate is a signed DOCUMENT the merchant verifies.
take ·: Same word, different enforcement plane: ours is a delegation + intent-digest caveat verified on chain per step and revocable by the principal.

x402 · Stripe MPP · OpenAI/Stripe ACP · Virtuals ACP · Olas

HTTP-402 stablecoin micropayments; multi-method machine payments; cart / feed / orders over MCP; live agent-to-agent hiring with escrow and an evaluator role.

ahead ·: Volume and live commerce.
stops ·: These are RAILS.
take ·: payments pays an x402 challenge under a mandate without importing any of them into Ring 0; the client / provider / evaluator split for fulfillment evidence.

Inrupt Enterprise Solid Server 3.0

Per-user RDF pods; access requests and grants as VCs with purpose, owner-revocable; an MCP resource service where APPROVING a request is deliberately not a tool.

ahead ·: Shipped, enterprise-deployed, standards-tracked; the nearest thing to our vault + per-record delegation, and RDF-native like our ontology.
stops ·: The principal is a WebID, not an on-chain account; grants are VCs the server checks, not revocable on chain.
take ·: A purpose field on vault delegations; “approval is never a tool” as a stated invariant.

PROV-AGENT / ORNL Flowcept · OpenTelemetry GenAI

W3C PROV extended for agents — prompts, tool calls as first-class provenance, MCP-based capture, a queryable store. OTel GenAI: invoke_agent / execute_tool / plan spans, still Development.

ahead ·: Capture adapters and query tooling; vocabulary adoption.
stops ·: A platform store; no principal ownership; no link to authority.
take ·: PROV class alignment so a Flowcept query works over our A-box; an OTel GenAI projection with a pinned version — a projection, never the record.

Auth0 for AI Agents · Okta Cross-App Access · Entra Agent ID · AWS AgentCore · Permit · Cerbos

The Web2 answer: secretless credential brokers, short-lived scoped tokens, per-call policy, universal logout. Okta’s own write-up lists provenance through the delegation chain and continuous evaluation as requirements.

ahead ·: Enterprise integration, kill-switch UX, SIEM.
stops ·: Authority is an issuer-granted scope.
take ·: The ID-JAG lineage idea is our portable authority chain (adapters outside Ring 0); an instant kill switch at the Home. Ours stays a principal-signed, on-chain-revocable grant.

Oasis ROFL · Phala dstack · TEE-verified agents

Attested containers, on-chain policy registries, integrity receipts.

ahead ·: Enclave attestation as a product.
stops ·: Attestation as identity or authority.
take ·: Transport evidence about a workload — an optional WorkloadIdentityBinding source; nothing more.

Breadth is also exposure. Several peers have more production hours on their one layer than we have on all of ours, and the ERC stack is standardizing our vocabulary — mandate, capability, action digest, coordination acceptance — without us in the room.
the honest counterweight

← Agent frameworks The composition →