The Registry Died Quietly: What PACT's Consent Layer Tells Us About Who Really Owns AI Agent Identity

Discussion #741 closed on August 20, 2026. Fourteen months of debate. 102 comments. 79 replies. Zero shipped registry. The A2A Registry — the artifact everyone assumed would become the canonical directory of legitimate AI agents — died not with a crash but with a shrug, and by the time the thread was locked, five mutually incompatible registry implementations were already running in production across the ecosystem. Nobody coordinated. Nobody waited. That is the story. Not the closure itself. The fact that the market had already moved on before the standards body finished typing. Meanwhile, two companies most of the industry has never heard of — Decagon and Instinct — shipped something the larger players are still arguing about. It's called PACT. It's an open-source consent layer for AI agents. It runs on Apache-2.0. And its single most consequential design decision is that it can operate without a central registry at all. Read that again. No registry. No authoritative directory. No gatekeeper deciding which agents are "real." I want to flag something before I go further, because it matters for how you read everything below. The source material here is stamped with future dates — May 2026, August 2026, a Salesforce release labeled Winter '27. Either this is scenario writing, a forward projection dressed as reporting, or the timestamps are simply wrong. I've spent sixteen years watching crypto newsrooms publish garbage with confident timestamps, so my default is skepticism. I'll treat the structural claims as analytically useful and the specific dates as unverified. That distinction is the difference between analysis and astrology. Context matters here, so let me lay it out. For the past several years, the AI agent ecosystem has been trying to solve a deceptively simple problem: when one autonomous agent wants to act on behalf of a user — booking, paying, accessing data, delegating to another agent — how does the receiving system know the request is authorized? The dominant answer has been OAuth, the same authorization framework that powers "Sign in with Google." It works. It scales. It's also built for humans clicking buttons, not for machines transacting at machine speed. Layered on top of OAuth is A2A, the agent-to-agent communication protocol that defines how agents talk to each other. And on top of A2A, everyone assumed, would sit a registry — a canonical list of which agents exist, who operates them, and what they're permitted to do. The A2A Registry was supposed to be that list. It was discussed from June 2025 through August 2026. And it failed. Not because the idea was wrong, but because coordination is hard and everyone had already built their own version. Enter PACT. The name is an acronym nobody outside the working group will remember, but the mechanics matter. PACT takes A2A 1.0, folds in OAuth's authorization model, and wraps the whole thing in signed requests. The result is a "consent layer" — a way for an agent to prove it has direct authorization from a principal, without exposing login credentials and without pointing to a central authority that vouches for it. Three things make PACT unusual. First, it's a recomposition, not an invention. The cryptography is standard. The protocol primitives are borrowed. The novelty is in the assembly. Second, it ships with a normative specification, a reference provider implementation, and — critically — a conformance test suite. Third, it's licensed Apache-2.0, which is a governance statement as much as a legal one. That conformance test suite is the part most people are sleeping on. Here's why. When I audited the Axie Infinity economy in Manila back in early 2021, I learned that the most dangerous thing in any token system isn't the token — it's the gap between what the documentation claims and what the code actually does. I spent two weeks tracking SLP inflation rates against the reward schedule and found the reward mechanism was structurally unsustainable before the market priced it in. The lesson wasn't that I was smart. It was that "documented behavior" and "verified behavior" are different products, and the market pays a premium for the second one. A conformance test suite is exactly that premium. It converts "this implementation claims compliance" into "this implementation passes a verifiable test." That is a fundamentally different claim than a marketing badge. And it's the reason PACT, despite being built by two small teams, has a technical credibility that larger players' labels don't. Because here's what's happening on the other side of the fence. Salesforce is attaching "A2A compliance" labels to its agent ecosystem — tied to Agentforce, orchestrated across AWS, Azure, and GCP. The label sounds authoritative. It isn't. There is no formal, industry-wide consistency specification backing it. The compliance is defined by the vendor selling the product. This is not a small thing. When the seller defines what "compliant" means, the buyer's due diligence cost goes up, not down. You get label inflation: the more labels that exist, the less information each one carries. And the enterprise architect — the person actually signing the procurement order — ends up worse off than if no label existed at all, because now they have to un-learn the false signal. Tracing the registry endgame back to its genesis block, the pattern is old. Standards bodies move slowly by design. They optimize for consensus, and consensus is expensive. The A2A Registry spent fourteen months chasing it and produced nothing. PACT spent a fraction of that and shipped. Speed over precision when the chart breaks — and in infrastructure, the chart is always breaking. Now the contrarian part, and it's where most of the Web3 crowd is going to get this wrong. The headline that will circulate is "AI agent identity goes decentralized." The narrative writes itself: PACT works without a central registry, therefore it's aligned with decentralized identity (DID) and verifiable credentials, therefore it's bullish for Web3. That reading is lazy. Look at who's actually in the room. AAIF — the framework operating under the Linux Foundation — added 43 members as of May 2026. The names on that roster include F5, GoDaddy, Stripe, and Salesforce. Those are enterprise software and payments companies. The only blockchain-native entity in the group is TRON, and its participation looks like ecosystem positioning — grabbing a seat at the AI-agent identity table — more than anything resembling a token-economy event. The structural fact is this: the dominant players in agent identity infrastructure are centralized commercial entities. The "no central registry" design is real, but it is a governance maneuver, not a decentralization victory. Whoever controls the registry controls the definition of "legitimate agent." Abandoning the registry means abandoning that power lever — which is precisely why it's easier to get market adoption, especially from vendors locked out of the standards bodies. It's not ideology. It's strategy. I've seen this movie. In 2025, after MiCA landed in the EU, I mapped a loophole in stablecoin reserve requirements by pulling the balance sheets of three major issuers and comparing how they were routing capital through shadow banking channels. Three European regulators cited that analysis in parliamentary hearings. The lesson: regulatory and structural language moves institutional capital far more effectively than price predictions. And "decentralization" is often a rhetorical wrapper around a very centralized business decision. So who actually wins here? Cloud providers win. AWS, Azure, and GCP become the orchestration substrate. Enterprise software giants win — Salesforce gets the channel, Stripe gets the payment authorization entry point. GoDaddy wins in a subtler way: the company's core asset is decades of registry governance experience, and its public statement about providing a "structural alternative to a fragmented registry landscape" is a tell. The domain-name playbook is being transplanted onto agent identity. Imagine agentname.xyz as a verifiable mapping. That's not in the source material, but it's the obvious commercial path, and GoDaddy is uniquely positioned to walk it. Stripe's presence is the other tell. A consent layer is inherently a pre-authorization layer for payments. PACT's direct-authorization model — where an agent proves it has permission without exposing credentials — maps almost perfectly onto Stripe's commercial interest in agent-initiated transactions. The payment rail and the consent rail are converging, and Stripe wants to own the junction. What about the Web3 natives? Almost invisible. The path from this infrastructure to on-chain assets is indirect and lagging. It requires agent identity and authorization to materially couple with on-chain value and payment, and that coupling is early. The honest read is that this trend is currently led by traditional finance and traditional tech, with blockchain as a spectator holding a ticket it may not get to use for a while. Now let's talk about the risk nobody is pricing. The most dangerous thing about PACT's design isn't the absence of a registry. It's that the security boundary moves. In the old vendor-registry model, trust was anchored to a directory that a company operated. In the PACT model, trust anchors to the individual agent's private key and signing authorization. That's a cleaner cryptographic story. It's also a new single point of failure. I spent November 2022 tracing $600 million in USDC moving from FTX wallets to Alameda addresses in real time, publishing a wallet-level breakdown of the insolvency within four hours of the rumor mill starting. The thing that killed FTX wasn't a sophisticated attack. It was a single control point — one entity holding keys it should never have held. Agent identity has the same shape. If the private key management for a personal agent is compromised, the attacker inherits the agent's full authorization scope. Key management via MPC or HSM and strict permission minimization aren't optional. They're the whole game. And there's a deeper, less obvious risk: cross-ecosystem privilege escalation. When authorization semantics differ between ecosystems, a permission granted under one interpretation may mean something broader under another. That kind of vulnerability is almost impossible to catch with a single audit, because it lives in the seam between two systems, not inside either one. The source material flags fragmentation as a technical-debt problem. It's worse than that. Fragmentation is a security problem wearing a technical-debt costume. Read the room in the order book silence here: the market is telling you there is no leader. Three parallel tracks — PACT at the protocol layer, AAIF at the governance layer, Salesforce at the application and channel layer — plus five isolated registry implementations. No winner-take-all. Network effects get diluted by fragmentation rather than amplified. In capital markets, a "functional but fragmented consensus" usually gets read as "sector confirmed, no champion." That configuration tends to reward the picks-and-shovels players — integrators, middleware, audit and testing services — rather than any single protocol. Which brings me to the sharpest line in the entire source material: the people who ship products versus the people who write specs. It's a governance observation disguised as a throwaway. In fast-moving domains, governance authority is migrating from standards committees to implementers. The A2A Registry had 102 comments and 79 replies — genuinely thorough discussion — and produced nothing, because thorough discussion among parties with sunk costs produces stalemate, not consensus. When five vendors each have an implementation, agreeing on one registry means some of them write off their investment. The rational move is to not agree. That's not a capability failure. It's an incentive failure, and it's structural. This is where I'd push back on the source's framing. It treats the registry failure as analysis paralysis. I think it's closer to a bargaining breakdown where the equilibrium is non-agreement. Same outcome, different diagnosis — and the diagnosis matters, because if it's a bargaining problem, no amount of better facilitation fixes it. The space will stay fragmented until an external force — regulation, a major security incident, or a dominant platform — forces convergence. Which is exactly why the "vendor-defined compliance" issue is the sleeper risk. Right now, "compliant" is a marketing word. The moment an agent authorization failure causes a major loss — funds drained, data exfiltrated, a delegation chain abused — regulators will demand auditable consistency. And on that day, PACT's conformance test suite stops being a nice-to-have and becomes a moat. The team that shipped verifiable compliance will be the only one able to prove anything. Let me be concrete about the fragmentation feedback loop, because it self-reinforces. Fragmentation raises integration complexity. Integration complexity accumulates technical debt. Technical debt pushes enterprises toward "one-stop" vendor solutions that promise to abstract the mess. Vendor lock-in deepens. Lock-in makes the next round of fragmentation even more expensive to resolve. It's a negative spiral, and it doesn't correct on its own. The most likely mid-term steady state is what the source calls "internally consistent, externally incompatible" — each ecosystem clean inside its own walls, incompatible across them. That means cross-ecosystem interoperability will depend on bridge layers for the foreseeable future. And bridge layers are, historically, where the money gets stolen. From the sprint to the sprawl of DeFi, every major exploit I've tracked lived in the bridge, not the bank. So what do I actually watch from here? First, adoption numbers, not announcements. The AAIF added 43 members — that's a headline. It is not a signal that anyone is using anything. Member growth outpacing verifiable deployment is the classic signature of a narrative running ahead of fundamentals. I want to see reference implementations in production, conformance suites passing in the wild, and real agent-to-agent authorization traffic. Absent that, this is a press-release sector. Second, whether PACT gets absorbed. Two small teams opening a road that larger players eventually pave is the standard fate of open standards. Decagon and Instinct are the risk-takers here. The question is whether AAIF or Salesforce swallows the protocol and re-labels it as their own compliance layer. Watch the commit history, not the press coverage. Third, the DID crowd's reaction. If the Web3 community over-absorbs the "no registry" narrative and treats this as native validation for decentralized identity, expect a wave of mispriced tokens riding a trend whose actual architects are enterprise centralizers. The decentralization here is a design choice about where to put the trust anchor, not a statement about who holds power. Those are different questions, and conflating them is how people lose money. Fourth, and most important, the timestamps. If the 2026 dates are projections rather than records, then some of the "facts" — the 43 new members, the registry closure — may be scenario assumptions rather than events. Cross-verify before you cite. Chasing the alpha while the market sleeps only works if the alpha is real. The registry is gone. The consent layer is here. And the question nobody in the Web3 echo chamber is asking is the one that matters: when the trust anchor moves from a directory to a private key, who ends up holding the key — and who ends up holding the liability?