Every serious deployment of software agents now runs into the same wall, and a new industry has formed to sell ladders over it. The wall is this: an agent that can act on the world needs authority to act with, and the authority available to it is almost always ambient — an API key in its environment, a session it inherited, a service account with standing permissions. The ladders are called “identity for agents”: accounts for non-human actors, scoped tokens, delegation flows, registries of agents, vaults for their credentials, lifecycle tooling to create and retire them. The category is growing fast, and it is solving a real problem with the wrong tool, because it was built by an industry whose only tool is the identity provider.
This essay is about the place where that industry’s tools and a capability-based world meet. It argues that the meeting point is a specific, well-defined component — a seam — that the seam is fundamentally bidirectional, that most of what “identity for agents” sells collapses into it, and that whoever owns the seam is in the riskiest position in the system, which is exactly why the seam needs a conformance discipline of its own.
Two ways to trust
There are two ways a system can decide that a request is legitimate.
The first is trust by assertion. A central party — an identity provider, a token service, a licensing body — vouches: this session is Alice; this agent belongs to the finance department; this operator holds a valid certificate. Relying parties accept the assertion because they trust the party that made it. The assertion travels as a token; the token’s meaning is whatever the issuer says it is; and the issuer knows every place the token was used. Almost the entire enterprise world runs on this model, and it works — right up to the moment the issuer is compromised, unavailable, or simply too coarse to express what the request actually needs.
The second is trust by proof. Authority travels with the request as an unforgeable capability that names exactly what it permits: this key may read this record, command this instrument at these settings, spend up to this amount, until this time, revocable by the party that granted it. Nobody vouches for the holder; the capability proves itself, and the holder’s identity is beside the point. Every hand-off can only narrow the authority — the capability that comes out of a delegation is a subset of the one that went in — and every use can leave a signed receipt. This is the model PolyCap runs on, and it is the model agents need, because an agent’s identity was never the interesting question. What it was handed, by whom, derived from what, with which receipts — that is the question, and a capability is the answer written down.
Neither world is going away. The assertion world holds every SaaS integration, every corporate directory, every professional license. The proof world is where agents, devices, and cross-organizational work can be made safe. So the interesting engineering is where they touch.
The seam is one component
Look closely at what an “identity for agents” product actually does and it decomposes into a handful of jobs. Give the agent its own account and scoped tokens. Delegate a human’s authority to the agent for a task. Keep the agent’s credentials to third-party systems in a vault. Maintain a registry of which agents exist and who is responsible for them. Bind agents to real-world accountability. Retire them.
In a capability world, two of those jobs simply dissolve. Delegation is what capabilities are — narrower at every hop, expiring, revocable — and they express things a scoped token cannot: an attenuation chain three parties deep, a grant that dies at midnight without anyone remembering to revoke it, a receipt for every use that a stranger can verify. Lifecycle dissolves with it: there is no agent account to provision or decommission, only grants to hand out and take back.
The jobs that survive all live at the same place — the boundary between the two worlds — and they turn out to be one component with two faces. Call it an assertion-to-capability adapter.
Inbound, an assertion becomes a capability. The identity provider says “this is Alice, in Finance”; the adapter mints a capability for Alice’s key that is no wider than what the assertion authorized — the scope of the assertion is the ceiling of the grant. From that moment Alice’s agents act on capabilities derived from hers, attenuated at every hand-off, and the identity provider’s assertion never travels further than the seam.
Outbound, a capability becomes an assertion. An agent holding a grant to read one customer record needs a token to call a system that speaks only OAuth. The adapter holds that system’s credential — the agent never does — and emits a token no wider than the capability presented. The agent gets the narrowest possible slice of a credential it never sees, for a task it was explicitly granted, with a receipt recording that the seam was crossed.
Same law in both directions: what comes out is never wider than what went in. Inbound, the assertion bounds the capability; outbound, the capability bounds the token. Receipts are written on every crossing. The registry of agents and their responsible humans is the same thing seen from the accountability side: a governed group in the proof world whose members’ keys carry attestations from the assertion world. And the real-world bindings — this agent acts for this firm, this operator holds this license — are attestations the adapter consumes and never issues.
That is the whole surviving category, folded into one place. Not a set of products; a seam, with a shape.
The seam is the most dangerous place in the system
There is a reason to be precise about this rather than merely pleased by it. An adapter that holds every third-party credential for a thousand agents, and mints capabilities on the strength of assertions it accepts, is the single most valuable target in the deployment. It is the identity provider reborn at the edge, wearing a capability badge — unless it is built under discipline.
The discipline is the same one that governs everything else in a capability system, applied without exception at the seam. The attenuation law holds across the boundary: an adapter can never issue more authority than it was granted, in either direction, and a conforming adapter makes that mechanically checkable. Legacy credentials live in the strongest custody available — hardware-anchored keys, not configuration files — so that compromise of the adapter’s host does not surrender the credentials it holds. Every crossing is receipted, so the adapter’s own actions are auditable by parties that do not trust it. Revocation on either side propagates through the adapter in seconds. And the adapter is small, verifiable, and conformance-tested: a boundary adapter is a component whose behavior can be graded against a published verification suite, and a buyer of one should demand the grade.
That last point is the lever. The riskiest position in the ecosystem becomes the most disciplined one when “conformant adapter” is a certification an operator earns and a customer requires. It is how a protocol governs companies it does not own.
Who builds the seam
Here is the part that surprises people who expect a new model to sweep away the old industry. The companies best placed to build assertion-to-capability adapters are the identity providers themselves. They already hold every SaaS integration on Earth, every corporate directory, every enterprise relationship. Their existing primitives — token exchange, on-behalf-of delegation, claims — are the raw material of the outbound and inbound halves. What they cannot express in their own protocols is the attenuation chain and the receipt trail between the halves, and that is precisely what the adapter supplies. For an incumbent, the adapter is not a threat; it is the fastest route through a protocol shift for their existing customers.
For everyone else, the seam is a business per vertical. Laboratory instruments, industrial estates, SaaS-heavy enterprises, telecom, spatial computing — each has its own assertion world, its own credentials to hold, its own accountability regime to bind. A company that owns the seam for one of those verticals, under conformance, is doing the work that “identity for agents” was reaching for, with the one correction that makes it safe: the agent never holds the credential, never holds more than it was granted, and never acts without a receipt.
What the seam is not
It is not a replacement for identity providers; it consumes them. It is not a place where authority is invented; it is where authority is translated, always narrower. It is not a product one company will own; it is a pattern many will build, and the pattern is only trustworthy if the adapters are graded. And it is not a new idea in security — reference monitors and capability translation are decades old — only a newly urgent one, because agents have made ambient authority a problem at machine speed.
The industry spent its first year of agents asking who they are. The better question was always what they were handed. The seam is where that question gets answered on the way in, and enforced on the way out.
PolyCap’s boundary adapters — for external networks, spatial systems, plain-MQTT devices, and agent-operated hardware — are assertion-to-capability adapters under the attenuation law, with conformance suites of their own. This essay describes the pattern; the pattern is the point.