After the W3C Agentic Web report: the identity layer has landed, the addressing layer is still blank
W3C AI Agent Protocol Community Group · Technical report on Agentic Web protocols · 2026-09-24 · English / Chinese · Sister pillars in this piece: rttp:// (CRI 27) · iqa:// (CRI 28)
In late September, the W3C AI Agent Protocol Community Group published a technical report that treats the Agentic Web as internet infrastructure — the first heavyweight text to do so. We read it line by line. The verdict up front: the identity layer has landed; the addressing layer is still blank.
1. What the report says
The report's diagnosis is clear: the current internet poses three challenges to the Agentic Web — data silos degrade decision quality, human-machine interfaces throttle interaction efficiency, and the absence of standard protocols blocks collaboration. Its proposed cure is native protocols: such protocols "aim to provide a unified framework for discovery, identification, verification, communication, and collaboration among agents." That list is the coordinate system of this piece — we walk it row by row, and see which rows have answers and which are still empty.
2. The identity layer has landed
The report's two cuts are precise. On OAuth: "For N platforms to interoperate freely, this requires either O(N²) bilateral trust agreements or dependence on a dominant centralized identity provider—neither of which scales well or preserves decentralization." On TLS: "TLS certificates verify domain ownership, not individual agent identity. Multiple agents on the same domain share a single certificate."
Its answer is the DID route, taken all the way to a reference implementation: the Web-Based Agent DID method (did:wba), architected after email — each platform manages its own accounts centrally, cross-platform interop rides on standard protocols. Whether or not the ecosystem ultimately adopts this route, the fact that the identity question now has a candidate answer and a reference implementation is what landing means.
3. Discovery, yes; addressing, no
The report defines discovery as: supporting agents in "dynamically searching for and locating other suitable agents in the network based on semantic matching, task requirements, or capability characteristics." The engineering landing point is an Agent Description document, surfaced via RFC 8615. That is pragmatic.
But discovery and addressing are two different questions. Discovery answers "how do you find a description document"; addressing answers "where does an agent's stable address come from, who vouches for it, and how long does it live." The former is a file convention; the latter is a namespace plus a specification of time. Read line by line, the report has an engineering-grade answer for the former and no independent specification for the latter — it is left implicit inside the vision word "interconnection."
Neither is this blank unique to the report. Third-party commentators widely observe that the current protocol stack neither defines semantics nor carries trust in content — signed cards and payment mandates all stop at "who signed," never reaching "why trust the signer." The blank is general; the report is simply the most honest about exposing it.
4. A third road into the blank
We hand in our own paper for that row. The Resonant Time Transfer Protocol (RTTP) answers WHERE and WHEN: the address is derived — the first 16 bytes of SHA-256(canonical authority), shaped as rttp://<intent>.<pillar>.<root>/<action>. Derivation is occupancy: no registry, no landlord — the address is freehold, and the landlord is mathematics.
WHEN lives inside the protocol: every statement carries a 120-second freshness lease (standing), a closed set of four states — ghost / probation / radiant / genesis — with genesis as the off-axis epoch anchor. Trust holds no lifetime appointments — what must be permanent goes to mathematics; what must be temporary goes to time. The design reasoning behind derivation and leases is in two earlier pieces (the dual-pillar overview, trust has no lifetime appointment); we will not repeat it here.
5. The WHETHER column
Address derivation only answers "what this address is"; it does not answer "whether this statement really came from who claims it" — hash self-consistency is not provenance. The verification loop belongs to the second pillar: Identity Quality Assurance (IQA) carries statements in signed envelopes, verification completes locally, and the three offline tests are disconnection, survival, and explanation. We will not expand here either — verify a piece of evidence with your own hands in 30 seconds; it beats ten paragraphs of argument.
6. Four open questions
The report calls on stakeholders to join the standardization process. We enter with questions — four, all public:
Q1 DID documents answer "who holds the key" — but which layer answers preimage defense against impersonation of an in-use authority? Is detecting a swapped identity document a matter of protocol, or of luck?
Q2 Discovery depends on the discoverability of description documents — who vouches for the address of a description document itself? Should addressing be split out of "discovery" and specified as an independent layer?
Q3 TLS certificates have validity periods — does an agent's trust have a lease? Which layer carries the freshness and expiry of statements?
Q4 Must cross-platform interoperability take the "platform" as its unit (federated), or can it sink to the "statement" as its unit (registry-free)? Are the two granularities complementary?
7. Closing
What earns this report its name-check is that it ordered identity, description, discovery, and invocation into one system — and honestly published a reference implementation. We are only filling in the row from its own requirements list that nobody has answered yet. The blank is not a defect; it is an invitation — rttp and iqa are provisionally registered at IANA (2026-09-22 and 2026-10-13 respectively, verified on 2026-10-17). The paper is in; we await the reply.
Sources [1] W3C AI Agent Protocol Community Group, technical report on Agentic Web protocols, 2026-09-24; the archived English and Chinese originals are the sole source for all quotations in this piece [2] IANA URI Schemes registry, rttp (Provisional, 2026-09-22) and iqa (Provisional, 2026-10-13), verified 2026-10-17 [3] draft-li-rttp-iqa-addressing-00 [4] The observation that the current stack "neither defines semantics nor carries trust in content" is a third-party commentary position (it-blue.com et al.), not the text of any official specification, and is labeled as such.
One line: the W3C handed in the identity layer's paper; the addressing layer's paper is still on the desk — we wrote Resonant Time Transfer Protocol on it, and then asked four questions in public.