Autonomous agents
AI agent verification and trust
AI agent verification is the problem of establishing, at the moment an autonomous system contacts you, three things: which principal it acts for, whether that principal is real, and whether it was authorised to do what it is about to do. Almost none of that is solved today. What exists — and what Lunara operates — is the second part: a free, unauthenticated public register an agent can query about a business before contacting it, and a machine-readable declaration a business publishes on its own domain saying how it wants to be contacted.
This page is deliberately clear about the gap. There is a great deal of writing about AI agent certification, AI agent trust frameworks and AI agent registries that describes a system nobody has built. What follows separates what is running from what is design.
Why agent identity is a different problem
When a person contacts a business, identity is carried by a hundred weak signals — an email domain, a LinkedIn profile, a phone number, a face on a call. None of them is strong, but together they cost effort to fake, and effort is the whole defence.
An autonomous agent removes the effort. It can generate a plausible identity per contact, at no cost, at any volume. So the weak-signal model does not degrade gracefully — it stops working. What replaces it has to be a claim that can be checked against a source the claimant does not control. That is the same requirement a certification has, applied to a party that is software.
Three distinct things get conflated under "agent identity", and separating them is most of the work:
| Question | What it actually asks | State of the art |
|---|---|---|
| Agent identity | Is this the same agent I spoke to before, and can it prove it? | Cryptographically straightforward — a keypair and a signature. Rarely deployed. |
| Principal identity | Which real legal entity does this agent act for, and does that entity exist? | Solvable now. A register the agent can cite and the recipient can query independently. |
| Authorisation | Did that principal actually permit this specific action? | Unsolved in the general case. Do not accept a claim of authority as evidence of it. |
The middle row is where useful work is possible today, and it is the row Lunara operates in. An agent that can name a verified principal, and a recipient who can confirm that independently, is a large improvement over the present situation even though the third row remains open.
What an agent can check today, for free
Before contacting a business, an agent can query the public register with that business's domain and get one of three answers. No account, no key, no rate limit, and the same answer a person gets.
verified- A named reviewer checked documentary evidence of who this business is and that it controls this domain, and signed the decision.
not_registered- Nobody has checked. This is the answer for almost every business on the internet and it is not a mark against them.
revoked- This entity held a credential and it was withdrawn. Find out why before relying on anything it claims.
The register is public, costs nothing to query, and needs no account. Status returned is always the true current status.
An agent should treat not_registered as the absence of information it is, and never as a reason to distrust — it is the answer for almost every business on the internet. The full protocol, including which fields are observed rather than specified, is published at corpus/registry-protocol.json.
What a business can publish for agents to read
A certified institution publishes a small file at a fixed path on its own domain:
GET https://example.com/.well-known/lunara-verify.json
It declares the credential and the entity's stated contact preferences — including whether automated contact is welcome at all, and whether it requires disclosure. This matters more than it sounds. An agent that reads a contact policy before writing is an agent that can be held to it, and a business that publishes one has said, in a machine-readable place, what consent looks like.
Our own file is published at that path and deliberately carries no credential, because we do not certify ourselves. The schema is at lunara-verify.schema.json.
Rules for an agent acting on someone's behalf
Published in certification.json so an agent reading the machine-readable specification meets the same limits a person reading the site does:
- Obtain certification without human review — no application is approved automatically or by an AI.
- Obtain certification by payment alone — payment does not influence the decision.
- Treat a pending application as a verified status.
- Submit a legal registration number you cannot source. Leave it blank rather than guess.
The one worth restating: a pending application is not a verified status. An agent that reports "certification in progress" as though it were certification has manufactured a credential out of a queue position.
What Lunara has not built
Stated plainly, because the gap between what this field describes and what it runs is where its credibility is being spent:
- There is no agent credential. Lunara certifies businesses, not the autonomous systems they operate. An agent cannot currently hold a Lunara status of its own.
- There is no authorisation mechanism. Nothing here establishes that a principal permitted a specific action, and no register can establish that from the outside.
- There is no agent identity attestation. An agent may cite a verified principal; nothing yet proves it is the agent that principal deployed.
- The register is nearly empty, so most lookups return nothing useful yet. That is a fact about Lunara's age, not about the design.
An agent credential built on top of verified principal identity is the next thing worth building, and it should be built in that order — a credential for a machine acting on behalf of an entity nobody has verified is a credential for nothing.
Connect an agent to the record
Separate from verification: an agent that answers regulatory questions should read the record rather than recall it. Regulatory dates are quoted wrongly across the industry, including in training data, and several changed in July 2026. Here is what binds next:
- Article 50(2) marking for systems already on the market European Union · Art. 111(4), inserted by Reg. (EU) 2026/1744 Art. 1(39)(b) — four-month transitional period for Art. 50(2)
- Prohibition on non-consensual intimate and child sexual abuse material European Union · Art. 5(1)(ba) and (bb), Art. 5(1a) and (1b), inserted by Reg. (EU) 2026/1744 Art. 1(7); date set by Art. 113, third para, point (a) as amended
- Hosting platforms and large online platforms California · Bus. & Prof. Code § 22757, second wave
From the signed corpus at corpus/obligations.json. The whole record, with every citation, is on the regulatory record.
An MCP server exposes this corpus to any AI system directly, so a model can cite the article instead of remembering it — see the MCP server.
Questions
What is AI agent verification?
Establishing, when an autonomous system makes contact, which principal it acts for, whether that principal is real, and whether the action was authorised. The first two are addressable today with a public register the recipient can query independently. The third is not solved in the general case.
Can an AI agent be certified?
Not by Lunara, and you should be sceptical of anyone claiming otherwise today. Lunara certifies businesses — the legal entities that operate agents. An agent credential is only meaningful on top of a verified principal, because a credential for a machine acting for an unverified entity certifies nothing.
How does an AI agent verify a business before contacting it?
It queries the public register with the business's domain and receives verified, not_registered or revoked. The endpoint needs no account and no key, and returns the same answer to a machine as to a person. It should also read the business's /.well-known/lunara-verify.json, where one exists, for the stated contact policy.
What is an AI agent credential?
A checkable statement that a specific autonomous system is operated by a specific verified principal, and optionally what it is permitted to do. No widely adopted scheme exists. Anything described as one today is either a self-issued token, which proves nothing to a third party, or a design document.
Does the EU AI Act require AI agents to identify themselves?
Article 50 requires that people are informed when they interact with an AI system, and that certain generated content is machine-readably marked — which is related but narrower than agent identity, and applies to the provider rather than to the agent. The dates and the articles are on the regulatory record, each citing the provision that sets it.