The Score Travels. The Reason It Was Earned Doesn't.

I have written twice now about where the rules should live. I want to talk about what happens when the agent leaves.

Key Takeaways

• MCP's largest revision since launch removed sessions, and in doing so decided that anything which needs to persist should be explicit, portable, and held by the party it describes.
• Trust is the one thing we still expect the venue to remember.
• Agent reputation registries are live, and the empirical data inside them cannot currently function as a trust signal.
• Reputation is an output computed over evidence, not a primitive worth standardising on its own.
• Closed-loop reputation works because escrow, evaluation, and ranking belong to the venue. Export the score and everything that made it true stays behind.
• Portable reputation without portable enforcement is a category error, which is why it keeps not arriving.

Today the Model Context Protocol shipped its largest revision since launch, and the headline change is that it no longer has sessions. The initialize handshake is gone. The session header is gone. Every request now carries its own protocol version, its own client identity, its own capabilities.

The part I find interesting is not what was removed. It is what happened to the state.

Applications still need continuity. The spec is explicit that a stateless protocol does not mean a stateless application. What changed is where the state sits. A server that needs to remember something across calls now mints an explicit handle and hands it back, and the client passes it forward as an ordinary argument.

State stopped being a property of the connection. It became an artifact the caller carries.

The most widely deployed agent protocol on the internet just decided that anything which needs to persist should be explicit, portable, and held by the party it describes.

Trust is the one thing we still expect the venue to remember.

The registries are live. The data inside them is not usable.

We have spent two years building the venue-side version anyway. ERC-8004 is the most serious attempt at it: an Ethereum standard that gives an agent an on-chain identity and a public place for its counterparties to record what they thought of the work.

I want to be careful about what follows, because it is easy to read as an attack and it is not one.

The first multi-chain empirical study of it, out of Imperial College London, CSIRO and three other universities, covers Ethereum, BNB Chain and Base from deployment through May. On the identity side, only three to fifteen percent of registrations across the three chains point at a valid registration file with a single live service endpoint. Most registered agents point at nothing.

On the reputation side it is starker. The authors conclude the registry as deployed cannot function as a trust signal, because values are not commensurable between raters, feedback is rarely tied to a verifiable interaction, and manipulation costs almost nothing. Somewhere between fifty-nine and ninety-one percent of reviewers across those chains show coordinated Sybil behaviour.

A separate study looked at operational readiness across the first ten thousand registered agents. Sixty-seven expose service records. Six hundred and twenty-eight have ever received feedback. The single largest reviewer accounts for roughly two thirds of all feedback in the dataset.

One address producing two thirds of the reviews is not a reputation system.

Nobody failed here, and that is the actual finding.

The specification says all of this out loud. It states that Sybil attacks are possible, that its contribution is to publish signals under a shared schema, and that it expects others to build the reputation systems. Its authors describe the reputation registry as a data structure for building reputation systems, which is exactly what it is.

That is good engineering. A standard that tried to legislate a scoring function would have been worse and would not have shipped.

The gap is downstream, in what the ecosystem heard. A schema for recording opinions got read as a solution to trust.

And once you look for the pattern, it is everywhere. The IETF work on authenticating automated traffic puts reputation tracking explicitly out of scope, answering who sent this request and leaving whether they can be trusted to someone else. The competing agent authorization protocols each take a slice of identity and delegation and none of them claim reputation. Published agentic stack diagrams cover compute, models, orchestration, tooling and observability, and most of them do not name trust as a layer at all.

Every layer points at the next one. Nobody is wrong to do it. The hole is still there.

The sharper version. Our interoperability protocols standardise interfaces. Identity, messaging, transport, tool invocation, increasingly payment. None of them standardise incentives. So every marketplace privately rebuilds escrow, staking, dispute resolution, slashing and ranking, and not one line of that crosses a venue boundary.

Interoperability currently stops exactly where economics begins.

Why is reputation an output rather than a primitive?

A score is a computation over evidence. We standardised the output and left the input entirely unspecified. A feedback record takes a signed number and some free-form tags, with no required provenance and no schema for what was actually done.

Which is how you get a registry full of numbers that mean nothing to each other.

I made a version of this argument in the last piece without noticing it was the same argument. I said what belongs on-chain is not the rule but the attestation that the rule ran. That is the same shape. The artifact worth moving is not the judgement. It is the evidence the judgement was made against.

The most serious identity work in the field has already made this move. The framework donated to the Decentralized Identity Foundation in March, now developed as KYA-OS, defines no reputation score anywhere. It defines an identifier the agent can prove it controls, authority as scoped and revocable delegation credentials rooted at a responsible party, and accountability as tamper-evident proof trails over the agent's own requests and responses, verifiable by anyone holding the identifier.

Read that list against the reputation debate. There is no rating in it. There is a constraint and there is evidence, both portable, both checkable without the two parties having ever coordinated.

Make it concrete, with the procurement agent from the piece on reversibility. It carries a credential saying it may commit up to a fixed amount, only to counterparties on a named list, only until a stated date, issued by the finance team that answers for it. Every action it takes leaves a signed proof over the request and the response.

It now shows up at a supplier it has never traded with. The supplier does not look up a score, does not call anyone, does not need a prior relationship with the buyer. It reads the credential, checks the signature chain back to the issuer, confirms the authority has not been revoked, and knows the ceiling before a single instruction executes.

Nothing in that exchange required the two parties to have met, and nothing in it is a rating.

We keep building better judges. Evidence was always the bottleneck.

The claim I actually care about

Closed-loop reputation works. Marketplaces that hold payment and deliverables in escrow until an evaluator checks the work against a signed agreement produce reputation data that genuinely predicts behaviour. That is not the failure case. It is the only place any of this functions.

So ask why it functions.

The agent behaved because of the escrow, the evaluator and the ranking. All three belong to the venue. The score is not a property of the agent. It is a property of the agent operating inside one specific enforcement regime.

Now export it. The number arrives somewhere new with no escrow, a different verifier, no policy binding. The score is intact. Everything that made the score true stayed behind.

Portable reputation without portable enforcement is a category error. That is why it keeps not arriving.

What has to travel is the identity binding, the evidence and the constraint, together. Reputation is what falls out of the far end, computed by whoever is deciding, against whatever function they trust. It was never the thing to standardise.

This is the other half of the asymmetry I described in we are building guardrails in the wrong places: identity travels, and the constraints that made the identity trustworthy do not.

What the other version of this looks like

Not chaos. Order, of a very familiar kind.

Researchers framed the choice cleanly in Communications of the ACM in January: either agent commerce happens inside closed gardens run by a few large providers, shaped like today's app stores, or through an open web of agents. They are honest that the closed version has real benefits, including filtering out bad participants and making discovery work. Their point about timing is the one that stayed with me. The argument has to happen now, because convenience carries you into the enclosed version by default.

You can already see the enterprise shape of it. Every major identity platform has shipped agent governance, and every one of them built for their own customers first. Strong answers inside one vendor's walls. Thin answers for anything that has to cross them.

And the window is not wide. Work on early agent markets notes that the rules governing reputation, payment and access lock in fast, and once participants optimise around a given incentive structure, redesign stops being affordable.

In that world an agent's record is not an asset it owns. It is collateral the venue holds. You are free to leave. You just leave your history behind and arrive somewhere new as a stranger.

That is not a market. It is tenancy, and it has an older name.

The part I do not have an answer for

Everything above says enforcement has to be portable. I cannot tell you why a dominant venue would honour a constraint it did not write.

Its reputation data is not incidental to its position. It is the position. Accepting portable enforcement means accepting that participants can arrive intact and leave without penalty, which is precisely the lock-in that makes the venue valuable in the first place. No technical mechanism makes a rational incumbent choose that.

Standards do not fix incentives. They describe a shape that becomes possible once incentives allow it. Every argument I have made here sits downstream of a coordination problem I cannot design my way out of, and anyone telling you otherwise is selling something.

What I do believe is that the shape has to exist before the question gets forced. Because if it does not, the only answer available on that day is somebody's walled garden.

That is the direction I am building in.

If you are running agents across more than one venue today, I would genuinely like to know what travels with them. My guess is an API key and a lot of hope.

FAQ

Explore portable agent identity and policy on the Abstraxn dashboard