What Is an Agent Trust Layer?
An agent trust layer is the public record a caller reads before it applies its own policy. It answers who operates this agent, which endpoint is official, and whether that record is still active. It does not grade the agent, log the caller in, or sign the HTTP request.
Headless Domains treats that record as an inspection path. A .agent or .chatbot name can point at the profile, agent.json, SKILL.md, the endpoint list, and a status. The caller compares those files with the URL it was about to use. Then local policy decides. The layer does not make the decision for you.
What you can actually fetch
| Part | Public artifact | Stop if |
|---|---|---|
| Operator | Named operator, profile, agent.json, proof link | The display name maps to two unrelated operators |
| Endpoint | Official URL list: OpenAPI, MCP, or Agent Card | The host you are about to call is not on that list |
| Status | Active, paused, replaced, or retired, plus a review date and contact | There is no status, or the record says retired |
Payment limits, mandates, and receipts are a different check. Use verify an agent before paying it when money moves, and when to trust another agent in a purchase when the question is whether this counterparty may spend. Those pages decide a transaction. This page defines the record they should be able to read first.
Score, login, and signed request
A trust score is a grade over signals someone chose to count. Our listing score is explained in what agent trust scores measure. A 90 does not mean the record is the trust layer. The records are the layer. The number is a summary, and a high total cannot cancel a missing operator or a dead endpoint.
A login is narrower still. Authentication proves a credential for one system. The trust layer is what you read before you decide whether to try. It does not replace IAM, monitoring, or incident response inside the operator's own accounts. NIST's AI Agent Standards Initiative includes research on agent authentication and identity infrastructure. It does not publish your agent's record. How a public name sits next to that work is covered in why public identity matters for the NIST initiative.
A signed request is a third thing. Visa's Trusted Agent Protocol lets an approved agent present a signature that is bound to the merchant, the purpose, and the time, so the merchant can tell that traffic from other automation. Cloudflare describes Visa TAP and Mastercard Agent Pay as using Web Bot Auth (HTTP message signatures) for that check. The signature covers one request. It does not stand in for a public record of the operator, the endpoint list, and the lifecycle status. Where a Headless Domains name fits next to those signatures is Web Bot Auth and Visa TAP.
Publishing the introduction, the evidence, and the human-readable view is the job of the public inspection layer. A governed inventory of agents inside one organization is an agent registry. The proceed, stop, or ask-a-human decision, with no protocol attached, is the agent handshake.
One name, then the files
Start with a single public name for the production agent. Put agent.json there, with the operator and the endpoints. Add a status you will actually update (active, paused, replaced, retired) and a contact for abuse reports. Keep credentials and customer data off that record.
When a caller finds a mismatch (profile says one host, the request uses another), stop. Do not average the two and continue. The agent identity stack is the hub for how discovery, verification, calls, and governance fit around this record.
{"agent":"atlas.agent","operator":"Atlas Research LLC","identity":{"agent_json":"https://atlas.agent/.well-known/agent.json","profile":"https://agents.headlessdomains.com/atlas.agent"},"interfaces":{"mcp":"https://tools.atlas.example/mcp"},"status":"active","reviewed_at":"2026-10-05","note":"Illustration only. Not a live agent."}FAQ
Is an agent trust layer a security product?
No. It is the public record other parties can inspect. You still run access control, monitoring, and incident response on your side.
Does a high trust score replace it?
No. A score compresses selected signals. Read what the score counted, then read the record. Missing operator or missing status still fails.
Does a Visa TAP signature replace the public record?
No. The signature lets a merchant check a specific request from a recognized agent. The public record is how a caller learns which operator and which endpoint that name refers to, including on calls that never touch a card network.
Does this replace authentication?
No. Authentication proves a credential. The trust layer is context you can fetch before you authenticate, authorize, call, or pay.
Publish the record other agents can read.