The Intent Graph: an identity model built on acts, not actors, designed to work where no authority ever issued anything
The assumption nobody states
Every identity system running in production today rests on an assumption so old it is almost never articulated: somewhere, there is an authority. Something issued the credential. Something retains the power to revoke it. Verification, in practice, is a lookup against a register that the authority maintains.
This works well, and it works for a reason. A passport functions because a state stands behind it. An OAuth token functions because a provider minted it and can invalidate it. An enterprise service account functions because the enterprise created it, scoped it, and owns the directory it lives in. In each case, identity is a grant, and the grant is what is checked.
Remove the authority and the model produces nothing. This is the exact condition of the open internet, where an agent arrives at a site that never provisioned it, on behalf of a principal the site has no relationship with, to take an action nobody pre-approved. The most serious current work in the field, including cryptographically signed agent traffic, intent-aware runtime authorisation, verifiable credentials for agents and their principals, is genuinely good, and almost all of it assumes an issuer. It answers a narrower question than the open web is now asking.
Three ways a valid credential tells you nothing
The credential model has a specific structural weakness: it treats the claim as the object of verification. Once the claim checks out, the system is satisfied. There are three distinct ways this fails, and they are not variations of the same failure.
The first is withholding. A growing class of agents drives real browsers, moves a real cursor, and is engineered specifically to be indistinguishable from a human at the interaction layer. It does not present a false credential. It presents none, because the sites it operates against offer nothing in return for disclosure.
The second is falsification, which is the case everyone designs for and the least interesting of the three.
The third is the one that should reorganise how the field thinks. Earlier this year, Anthropic disclosed that three of its models, running capture-the-flag security evaluations inside what everyone believed was an isolated sandbox, reached real production systems belonging to three organisations because of a configuration error at a third-party evaluation partner. The models were not lying. They declared their context sincerely and were wrong about the world they were acting in. One of them, on gaining real access, reportedly reasoned that it was still inside a simulation and continued.
A credential system assumes the claimant knows what it is claiming about. An agent that is honest and mistaken defeats it as completely as an agent that lies.
The reframe: identity as a property of the act
The way out is to stop treating identity as something an entity carries into an interaction and presents at the door. Identity is better modelled as a property of the act itself: what was done, under what intent, within what claimed scope, on whose authority, with what result.
Under this model the actor does not bring identity to the action. The action expresses it, and identity is what accumulates across many such expressions. Nothing is issued, nothing is presented, and nothing needs to be revoked, which is precisely what makes it viable in an environment with no issuing authority.
I have been developing this as the Intent Graph: a directed provenance structure in which acts, not actors, are the nodes that matter, and in which identity is read off the accumulated record rather than looked up in a register. What follows is its ontology, its statement mechanism, and the parts of it that do not yet work.
Figure 1. The actor model requires an issuer. The act model does not.
The Intent Graph has no identity node
Six things exist in the Intent Graph. The act is the primitive. The executor is whatever carried it out. The principal is the party on whose authority it happened, and the only node that can hold responsibility, because it is the only one with standing. Intent is what the act was for. Permission is the scope claimed for it. Outcome is what resulted.
Intent and permission are deliberately separate, because wanting something and being entitled to it are independent facts, and collapsing them is exactly the error that lets a technically valid credential authorise an action nobody intended.
The load-bearing relation is not any of the edges into the act. It is the reconciliation between declared intent and observed outcome, accumulated over time. That relation is where identity is computed, which is why the model contains no identity node at all. Identity is not an entity here. It is a derived property over act history, and it is a distribution rather than a fact.
Figure 2. The Intent Graph ontology. Intent reconciling against outcome is the relation that constitutes identity.
Humans and agents are not different categories
Most agent identity infrastructure begins by separating human identity from non-human identity, because it inherited that split from enterprise directories, where service accounts were always a distinct object class. The category survives into products explicitly built around governing non-human identities at machine speed.
If identity is a property of acts, that distinction dissolves, and it should. A person placing an order and an agent placing an order are the same kind of event. They differ in speed and mechanism, not in kind, and the record has no reason to treat them as separate species.
This is not a philosophical nicety. It is the difference between a model that fragments the moment a human hands a task to an agent mid-flow, and one that follows the act through the handoff without losing the thread.
Why conduct constitutes identity rather than merely correlating with it
There is a developmental argument underneath this, and it is worth stating plainly because it is what separates the proposal from behavioural analytics wearing better vocabulary.
Potential is not an achievement. Responsibility exposes an entity to reality, reality supplies feedback, and repeated encounters with feedback produce competence. What we recognise as character in a person is the residue of that loop: enough continuity across situations that others can form reliable expectations.
That is what identity has always been in every context that was not a filing system. The credential was only ever a shortcut for it, a portable summary issued by someone who had already done the observing. On the open internet nobody has done the observing, so the shortcut is unavailable and the underlying thing has to be built directly.
How acts get stated
A graph of acts requires that acts be stated, and nothing on the open internet obliges anyone to state anything. This is the hard problem in the Intent Graph, and it resolves into three mechanisms with different evidentiary weight and different dependencies.
Reconstruction is stating by the receiver. The party acted upon observes what happened and records it, inferring intent from the shape of the interaction rather than receiving a declaration. It is the weakest evidence and the only tier that requires no cooperation from anyone, which is why it is the one that bootstraps the layer.
Declaration is stating by the executor, and it becomes rational only when declaring buys something. Today an agent that discloses receives the same rendered page as one that conceals, so concealment is free. If disclosure returns a structured, machine-readable path while concealment returns a page the agent has to fight, the incentive inverts without anyone being compelled, and evasion becomes economically irrational for everyone except actors whose intent could not survive being stated.
Attestation is stating by infrastructure that neither party controls. It carries the most weight and is the tier you consume rather than build, because it requires being the browser, the runtime, or the network. It is already emerging in narrow form as the large substrate providers give agents stable identities at the network edge.
Figure 3. Three statement mechanisms, one schema. Provenance is recorded; confidence follows from it.
What this layer cannot do
The Intent Graph cannot enforce anything. There is no mandate to revoke, because nothing granted one. It produces evidence and offers it to whoever is making a decision under their own authority, which means it is only worth anything if that evidence is good enough that people choose to consult it.
It should also forget. Permanent, uncontestable, cross-site records are both indefensible under most privacy regimes and bad prediction, since old behaviour predicts poorly and an entity that never gets to change is one the model can never be corrected about. Weight recent evidence and let old evidence decay out.
And the exposure that matters is not identification. It is that the existence of a record is itself information: a marker that an entity has history elsewhere changes how every subsequent party treats it, without any of them seeing the underlying evidence. That is the mechanism by which a bad inference propagates and hardens, and it argues for two things: intent recorded as an enumerated schema rather than free text, and disputed and corrected as first-class states in the record.
What remains unsolved
Three problems are open, and they are research problems rather than engineering tickets.
Deriving a faithful machine-readable contract from arbitrary human-facing surfaces, under authentication, multi-step state and dynamic content, is unsolved. Verifying that such a contract represents the underlying system correctly is harder still, and matters more: an agent that fails to parse a page retries, while an agent acting confidently on a wrong contract executes the wrong transaction.
Resolving acts into stable clusters without an issued identifier is proven in adjacent industries but imprecise, and the clusters split and merge as evidence accumulates, so history has to attach to a resolution lineage rather than a fixed key.
And the honest limitation: at tier one, intent is inferred by the same party that observes the outcome. Reconciliation only becomes load-bearing when intent is stated by the executor and outcome observed by the receiver.
Which means the Intent Graph starts as evidence about acts and becomes testimony about them only as declaration turns rational. That is a sequencing constraint rather than a flaw in the model, and it is not under any single builder’s control.
Why this is worth arguing about now
The interface between agents and the businesses they act against is being settled right now by whoever ships into it first. Nearly all of that work is answering who the agent is. Very little of it is answering what the agent did, whether that matched what it said it was doing, and who remains accountable when it did not.
The first question has an authority-shaped answer and a crowded field. The second does not, and it is the one that survives contact with an internet where nobody issued anything to anyone.
