The missing identity layer in multi-vendor automation

A single misconfigured agent on a shared production floor can halt a line in seconds. No verification failed. No alarm fired. The agent simply exceeded its scope at machine speed, and by the time a human noticed, the damage was done.

This is the reality of multi-vendor automation in 2026. Your company's agents have no passport. They can't prove who they are, what they're authorized to do, or whether they're any good at it. And they're about to need all three.

The bottleneck is no longer in deploying robotic systems. Any organization can stand up an AMR fleet, connect a cobot cell, or integrate an inspection line. 60% of enterprises are scaling AI agents right now. Fewer than 5% have any governance framework tracking them, even within their own walls. This doesn't account for the harder question: how to coordinate agents between companies. A logistics provider's fleet working alongside a manufacturer's production line. A service provider's diagnostic agent evaluating equipment it didn't build. A supplier's fulfillment system operating on a customer's warehouse floor.

The infrastructure to verify anything about another company's agents doesn't exist.
Without an identity and coordination framework, companies are exposed to compounding risk. Unauthorized agents accessing production systems. No way to verify whether an agent claiming to represent a vendor actually has authorization. No way to assess capabilities before granting access to critical equipment. Even assuming every agent is a good actor, the problems persist. Agents operating without proper scope. Exceeding authorization boundaries. Taking actions at machine speed without adequate controls.

In the machine economy, agent identity won't look like human identity. No usernames. No passwords. No document uploads. What agents require is a passport. A portable credential containing relevant metadata about that entity's work history and core capabilities. A card that is queryable by other agents for evaluation before engaging in coordinated work. This card carries scoped authorization from its parent organization, verified attestation of its competencies, and a trust score built not from claims but from completing the work it's designed to do. Machine-readable. Independently verifiable. Queryable in milliseconds.

To make this concrete: a logistics company's AMR fleet agent meets a parts supplier's fulfillment agent on a shared warehouse floor. They exchange passports. The fleet agent sees 12,000 verified fulfillment cycles at 99.1% placement accuracy, certified for mixed-SKU operations. Trust threshold met. Coordination protocol established. Work commences. The AMRs transport, the palletizer stacks, the inspection system verifies. No integration project. No vendor evaluation committee. No six-month onboarding.

When every agent carries a portable identity with accumulated work history, autonomous work cells form across organizational boundaries. A crane operator's agent, a logistics fleet, a supplier's fulfillment system, and an inspection line self-organize around a job, execute to spec, settle payment, and disband. The coordination that takes weeks of procurement and project management today takes seconds.

The communication protocols are maturing. MCP handles tool discovery. A2A handles the agent-to-agent handshake. What's missing is the trust layer underneath. The portable, accumulating, verifiable work history that turns a stranger into a trusted collaborator in milliseconds.

The protocols exist. The trust algorithms exist. The portable credentials exist. The question isn't whether autonomous agents will carry passports. It's whether yours will have them when the factory floor opens up to cross-vendor coordination.

Identity is the primitive that makes every other primitive operational. Without it, the automation industry is a collection of isolated systems. With it, every agent on every factory floor becomes a potential collaborator.

Ryan Gordon | foundrynet.io