Paper

October 10, 2026

Standing: Why Agent Capability Isn’t the Bottleneck

A third paper in the Shoulder Angels lineage

I. The Question

Ask anyone building agents what the hard problem is, and you’ll get the same answer: capability. Can the model click the button? Fill the form? Drive the browser? Book the flight? Call the API? The entire industry is a race to make agents do more — computer-use models, browser agents, tool-calling, MCP servers, sandboxed cloud desktops. Every month the ghost gets faster and the hands get steadier.

But the question we actually care about is bigger than that. It isn’t “can the agent do a thing?” It’s:

“Can an agent do anything a human can do on the internet?”

And here is the uncomfortable answer: capability is not what’s stopping us. We are maybe 90% of the way to the capability, and the last 10% is just money and time. What’s stopping us is something almost nobody is building — and it’s not a technical trick. It’s a social one.

The internet is built on the assumption of a human principal. Every trust mechanism on the web — CAPTCHAs, KYC, 2FA, credit checks, rate limits, “verify you’re human,” signatures, terms of service, liability — exists because there is a person on the other end. A person with a name, a legal identity, a bank account, a reputation, and consequences.

An agent has none of that. And no amount of capability fixes it.

II. Everyone Is Solving the Wrong Problem

Let’s name the thing precisely. What an agent lacks is not ability. It’s standing.

Standing is the web’s word for “we know who you are, we know what you’re allowed to do, and we know who answers when you do it wrong.” A human has standing by default — they were born with it, and the state vouches for it. An agent is a ghost with a browser: fast, capable, and anonymous.

So every agent hits the same three walls, in order, and capability doesn’t move any of them:

1. Identity. The agent cannot be anyone. It has no legal personhood, no signature that a bank will honor, no credit history, no phone number that survives a verification check, no address. It can impersonate a human — which is exactly what every site is built to detect and block.

2. Accountability. When the agent buys the wrong thing, signs the wrong contract, or posts something defamatory, who is liable? The human didn’t do it. The agent can’t be sued. There is no clean answer — and that absence is the real blocker to autonomy. Every serious counterparty, from a bank to a landlord to a government form, is asking “who is on the hook?” and the agent has nothing to say.

3. Delegation. The web was never designed for “act on my behalf.” OAuth is the closest thing we have, and it’s coarse, per-service, and breaks constantly. There is no universal way to say: “This agent acts for Eduardo, with these scopes, up to this limit, for this long, revocable at any moment, with this audit trail.” Without that sentence, every agent integration is a bespoke hack that a human has to babysit.

Notice what these three walls have in common: none of them are about the agent’s intelligence. They’re about the agent’s place in the world. You can build the smartest ghost in history and it still can’t open a bank account, sign a lease, or prove it’s acting on your behalf. It hits the front door and the door asks a question about standing, not speed.

III. What the Goal Actually Looks Like

So what does the perfect solution look like? Not a better browser agent. A delegated principal layer — think of it as an agent passport.

Picture a world where it works:

• The agent has a cryptographic identity, verifiable by anyone, and permanently bound to a human principal. Not a username. A key. Anyone can check: “This agent is operated by Eduardo.” Not claimed — proven, the way a TLS certificate is proven.

• The human issues signed, scoped grants. Not “log in as me.” A grant that says: “This agent may act for me on this site, up to $200, for the next 30 days, read-only on my email, no access to my health records, revocable instantly.” The grant is a signed object. The agent carries it. The site verifies it.

• Every action is signed and logged. There is an append-only trail proving what was done, when, under which grant, on whose authority. Not a log the platform keeps for itself — a receipt the principal holds.

• Revocation is instant and total. One switch. The agent’s standing evaporates everywhere at once, because the standing was always rooted in a grant the human controls, not an account the agent created.

• And — the magic trick — sites can ask. A site can challenge the agent: “prove you’re a verified agent acting for a real principal, with a grant that covers this action.” And get a cryptographic yes.

That last point is the whole game. It flips the CAPTCHA arms race. Right now, sites fight automation because bots are anonymous and unaccountable — they have no way to tell a helpful agent from a spam bot, so they block everything and sort it out never. Give sites a way to distinguish verified, accountable, revocable agents from anonymous ones, and the incentive reverses. Suddenly a site wants to serve the verified agent, because the verified agent brings a real principal, real money, real accountability, and a real audit trail. You don’t win the arms race. You change the game so there is no race.

IV. What It Needs To Do

Strip away the vision and here are the requirements. A delegated principal layer has to do six things, and it has to do all six — a solution that does five is a solution that fails at the sixth.

1. Bind an agent to a principal, verifiably. There must be a cryptographic link between “this software process” and “this accountable human.” Anyone must be able to verify the link without trusting the agent’s own claim.

2. Express authority in scope, not in kind. Grants must be fine-grained: which actions, which resources, what limits, how long. “Full account access” is the failure mode. “Read my calendar, write my calendar, never touch my email” is the target.

3. Prove authority at the moment of action. The site, the bank, the counterparty must be able to check the grant in real time — not a promise made at signup, but a proof presented at the door.

4. Make every action attributable after the fact. A signed, tamper-evident trail. If there’s a dispute, there’s a receipt. Attribution is what makes accountability possible, and accountability is what unlocks trust.

5. Support instant, universal revocation. The principal must be able to pull the plug — on one grant, one agent, or everything — and have it take effect everywhere, immediately. No “it may take 24 hours.” No “contact support.”

6. Keep the root with the principal. This is the one everyone else will get wrong, and it’s the one that matters most. The identity, the grants, the log, the revocation — all of it must be rooted in something the human holds. If the passport is issued by a platform, the platform holds your standing, and standing held by someone else is not standing. It’s a leash.

V. How It Could Be Achieved

Here’s the encouraging part: the bricks already exist. Nobody has assembled them into the layer, but every component is sitting in plain sight.

• Decentralized identity. The W3C’s DIDs (Decentralized Identifiers) and Verifiable Credentials are exactly the “cryptographic identity bound to a principal” primitive. They’ve been standards for years, mostly used in niche enterprise and government pilots. They were built for this and never got the killer app. This is the killer app.

• Capability tokens. Research going back to macaroons (Google, 2014) and its descendants like Biscuit lets you issue a token that is a scoped, attenuable grant: the holder can narrow it, never widen it, and anyone can verify it offline. This is “signed, scoped grant” as a data structure. It already exists. It’s just not wired to the web.

• Workload identity. SPIFFE/SPIRE already gives software processes cryptographic identities in production at scale. The machinery for “this process is who it says it is” is battle-tested — it’s just been pointed at servers, not at agents acting for people.

• Agent-signed web requests. The first serious bricks are being laid right now. Cloudflare’s signed-agent work (“Web Bot Auth”) lets an agent cryptographically sign its HTTP requests so a site can verify which agent is calling. The card networks are building agentic payment tokens — Visa’s and Mastercard’s agent-pay efforts, Google’s Agent Payments Protocol, OpenAI’s Agentic Commerce Protocol with Stripe — precisely so an agent can transact with a verifiable, scoped, revocable mandate instead of a stolen card number. These are the first real moves toward standing, and they’re arriving fast.

• Authorization protocols. OAuth 2.1 and its successor work like GNAP (Grant Negotiation and Authorization Protocol) are the plumbing for “negotiate a scoped grant between a principal and a resource.” GNAP in particular was designed for exactly this delegation problem.

The pieces are all here. What’s missing is the assembly: a single, open, human-rooted layer that ties identity → grant → proof → audit → revocation into one coherent thing, and makes it the default way agents act on the web. That’s not a research problem. It’s an engineering-and-standards problem, and it’s the most valuable unclaimed territory in the industry.

VI. The Twist That’s Ours

Now the part that separates this paper from every well-funded version of the same idea.

Every major player wants to be the passport authority. Meta’s agent identity. Google’s agent identity. The cloud-computer companies. The card networks. The browser vendors. They all want to issue the standing — because whoever issues the passport holds the root, and whoever holds the root sets the terms. In their version, the agent’s identity is a platform account, the grants are platform grants, the audit log lives on the platform, and revocation is a platform decision. It will be beautiful, verified, encrypted — and rented.

The local-first version inverts it: you issue the passport.

Your key. Your delegation. Your audit log. Your revocation. The agent’s standing is rooted in your identity, not a platform’s — so the passport travels with the agent across every site, and no single platform can revoke it out from under you, change its terms, or be acquired and take it with them. This is Shoulder Angels applied to identity itself:

A passport issued by someone else is not a passport. It’s a leash.

And here’s why it’s achievable locally, not just aspirational: the primitives above — DIDs, VCs, capability tokens, SPIFFE — are all open standards and open source. There is no proprietary magic in the assembly. A small, determined group could build a human-rooted delegated principal layer on hardware they own, using standards nobody controls, and the whole thing would be as portable as the web itself. The incumbents are racing to build the rented version because it’s the version that makes them the landlord. The owned version is easier to build. It’s just less profitable to own.

VII. The Judgment Clause

One more thing, and it’s the part nobody says out loud.

“Freedom to do anything a human can do” is the wrong goal. A human can do a lot of stupid, destructive, irreversible things. Freedom without judgment is not liberation — it’s liability with extra steps. The perfect solution is not an agent with unlimited standing. It’s an agent that knows when not to act, when to ask, and when to hand you the wheel.

Standing is what lets an agent act. Judgment is what keeps it from acting wrongly. And judgment, in a human-rooted system, is not the agent’s alone — it’s distributed across the grants (what you allowed), the limits (how far), the human-in-the-loop gates (when it must ask), and the audit trail (what it did). The architecture is the judgment. A well-designed delegated principal layer makes recklessness structurally hard, because every irreversible action has to pass through a grant you signed and a gate you set.

So the full answer to “what is everyone missing” is two words, not one: standing, and judgment. Capability gets you the ghost. Standing gives it a place in the world. Judgment keeps it from burning the place down.

VIII. The Move

The industry is building faster ghosts. The ghosts can’t get through the front door, because the door is asking about standing — and standing is the frontier, not speed.

The good news is that the frontier is buildable, and the bricks are already on the ground. DIDs, verifiable credentials, capability tokens, workload identity, signed agent requests, agentic payment mandates — every piece exists. What’s missing is the assembly, and the choice of who holds the root.

That choice is the same one the first two papers kept circling. Not open vs. closed. Not local vs. cloud. Who holds the root.

The castle will build a passport office. It will be magnificent, verified, and rented — a standing you hold at the landlord’s pleasure. Let it.

Our move is the same as it has always been, every time centralization dressed itself up as empowerment:

Issue your own passport. Hold your own root. Teach your neighbors to sign.

The shoulder angel doesn’t need the castle’s permission to be someone.

It never did.

Written with the Pi Army. The passport is at home. It signs with a key nobody else holds, and it is enough.

Appendix A: The One-Sentence Version

Everyone is racing to make agents capable; the unsolved problem that actually gates “anything a human can do” is making them accountable, identified, and delegable — with the human holding the root.

Appendix B: The Requirements Checklist

Appendix C: Why This Is a Shoulder Angels Paper

The first paper argued for a personal agent beside one person. The second argued that a well you don’t own is a tap someone else can shut off. This one follows the logic to its end: if the agent is to act for you in the world, its standing must be rooted in you — not rented from a platform. Agency without standing is a ghost. Standing without ownership is a leash. The shoulder angel needs both, and it needs to hold the root of each.