Agentic web daily · 2026-10-25
New IETF drafts propose capability grammar and signed receipts for agent authorization
Several individual Internet-Drafts on agent authorization and messaging were posted, including Capability Language Core, which ships a conformance corpus, and a signed permission and action receipt format. Ad Context Protocol shipped v3.2.7. None of the drafts has formal standing in the IETF process.
Stories
1. Capability Language Core draft defines an executable language for agent authorization
spec
draft-wei-capability-language-core-01 (Intended status: Experimental) defines a minimal language for describing what an agent is authorized to do. It covers a capability identifier grammar, entailment between a grant and an operation, intersection of grants from multiple sources, and a deterministic decision function. The verdict has three values: allow, deny, allow_unresolved. The author says a published corpus of 154 vectors and 1184 property cases is passed by three implementations (Go, Python, TypeScript), all from the same author.
Why it matters: The language is carrier-neutral and leaves trust, verification and token formats out of scope. It would sit beneath a token or receipt format, not replace one. Teams evaluating it can run the published vectors against their own policy engines.
- Capability Language Core · datatracker.ietf.org · 2026-10-24 VERIFIED
2. Draft specifies passkey-signed permissions and chained action receipts for agents
security
draft-izmaylov-agent-permission-receipts-01 (Intended status: Standards Track) defines records that let a third party check, later and offline, what an agent was permitted to do and what it recorded doing. The principal signs a permission with a passkey. The agent signs a receipt for each action with Ed25519 and ML-DSA-87. Receipts are chained into a log with time-stamped signed tree heads.
Why it matters: Verifiers report separately whether the records are sound and whether each action stayed within its permission. That split is useful for audit tooling. The draft is an individual submission with no IETF endorsement.
- Signed Permissions and Action Receipts for Automated Agents · datatracker.ietf.org · 2026-10-24 VERIFIED
3. Proofpoint authors propose AMMP for sandboxed agent email and messaging
security
draft-rapp-ammp-00 (Intended status: Standards Track), by authors at Proofpoint, defines a wire contract carried over a filesystem namespace. The contract sits between an untrusted per-agent connector and a trusted store-and-forward messaging runtime. Outbound messages start as inert request files that the runtime copies, validates and applies policy to before sending. Inbound messages are authenticated and screened before the agent sees a notice.
Why it matters: This is a concrete pattern for giving a sandboxed agent email access without trusting it with credentials. Teams building agent mailboxes can compare it with their own isolation model.
- The Agent Mediated Messaging Protocol (AMMP) · datatracker.ietf.org · 2026-10-23 VERIFIED
4. Ad Context Protocol releases v3.2.7
spec Ad Context Protocol
Ad Context Protocol v3.2.7 was released 2026-10-24 on GitHub. It is the current release of the protocol.
Why it matters: AdCP implementers should review the v3.2.7 release notes on GitHub before upgrading.
- Ad Context Protocol: v3.2.7 released 2026-10-24 · github.com · 2026-10-24 VERIFIED
5. Official MCP Registry saw 1704 servers published or updated in a day
adoption Official MCP Registry, Model Context Protocol
Our checks counted 1704 servers (3000 versions) published or updated on the official MCP Registry since 2026-10-24.
Why it matters: At this rate of change, clients that consume the registry should poll for updates and pin versions.
- Our measurement: 1704 servers (3000 versions) were published or updated on the official MCP Registry since 2026-10-24.
6. Three panel domains dropped AI crawler tokens from robots.txt
adoption AI Crawler User-Agent Tokens in robots.txt
AI crawler user-agent tokens in robots.txt are now published by 91 of 210 panel domains (-3 since 2026-10-24). agentskills.io, api.proof.com and docs.adcontextprotocol.org no longer publish them.
Why it matters: Sites that remove these rules fall back to their default crawler policy. Crawler operators should not cache earlier rules.
- Our measurement: AI Crawler User-Agent Tokens in robots.txt (ai-crawler-tokens-robots) is published by 91 of 210 panel domains (-3 since 2026-10-24).
- Our measurement: agentskills.io no longer publishes AI Crawler User-Agent Tokens in robots.txt (ai-crawler-tokens-robots); it did on 2026-10-24.
- Our measurement: api.proof.com no longer publishes AI Crawler User-Agent Tokens in robots.txt (ai-crawler-tokens-robots); it did on 2026-10-24.
- Our measurement: docs.adcontextprotocol.org no longer publishes AI Crawler User-Agent Tokens in robots.txt (ai-crawler-tokens-robots); it did on 2026-10-24.
7. aaif.io adds agents.txt and Markdown for Agents, moves from B to A
adoption agents.txt, Markdown for Agents
aaif.io now publishes agents.txt and Markdown for Agents; it did not on 2026-10-24. Its grade on our panel moved from B (38) to A (54). Markdown for Agents is now published by 64 of 210 panel domains (+1 since 2026-10-24).
Why it matters: This shows which signals our grading credits. Site owners can compare their own score against these additions.
- Our measurement: Markdown for Agents (cloudflare-markdown-for-agents) is published by 64 of 210 panel domains (+1 since 2026-10-24).
- Our measurement: aaif.io now publishes agents.txt (agents-txt); it did not on 2026-10-24.
- Our measurement: aaif.io now publishes Markdown for Agents (cloudflare-markdown-for-agents); it did not on 2026-10-24.
- Our measurement: aaif.io moved from grade B (38) to A (54).
8. Agent-channel fan-out draft reaches -03
spec Agent-Channel Frame for Identity-Keyed Fan-Out Delivery to Concurrent Sessions
draft-morrison-agent-channel-fan-out-03 (Intended status: Informational) specifies a frame format and fan-out delivery model. It covers the concurrent sessions of one identity-bound principal and members of an organizational identity substrate. A sender names a recipient scope rather than a single endpoint. The scope is expanded at delivery time against subscriptions.
Why it matters: This is relevant to anyone coordinating several concurrent agent sessions for one user. It is an individual draft with no IETF standing.
- An Agent-Channel Frame for Identity-Keyed Fan-Out Delivery to Concurrent Sessions · datatracker.ietf.org · 2026-10-23 VERIFIED
9. Execution-finality draft describes fail-closed gating of agent actions
research
draft-das-execution-finality-foundations-00 (Intended status: Informational) describes an architecture in which a Candidate Act stays non-effective until source-authority evidence and independent execution-time validation establish an authorization context. A Finality Sink withholds effects when required conditions are missing, changed or consumed.
Why it matters: This is an architectural description, not a wire protocol. It is useful mainly as a reference for designing fail-closed approval checks on agent actions.
- Execution-Finality Authority and Independent Validation for Autonomous Operations · datatracker.ietf.org · 2026-10-23 VERIFIED
The numbers
We re-check a fixed panel of 211 domains every day through the same /check/ report anyone can run. 210 answered today (1 could not be checked and is left out of every comparison). Changes compare the 210 domains checked cleanly on both 2026-10-24 and 2026-10-25.
| A+ | A | B | C | D | F |
|---|---|---|---|---|---|
| 46 | 16 | 41 | 60 | 12 | 35 |
Published or withdrawn since 2026-10-24
- aaif.io now publishes agents.txt
- aaif.io now publishes Markdown for Agents
- agentskills.io no longer publishes AI Crawler User-Agent Tokens in robots.txt
- api.proof.com no longer publishes AI Crawler User-Agent Tokens in robots.txt
- docs.adcontextprotocol.org no longer publishes AI Crawler User-Agent Tokens in robots.txt
Grade changes
| Domain | Was | Now |
|---|---|---|
| aaif.io | B (38) | A (54) |
Adoption across the panel
| Standard | Domains | Change |
|---|---|---|
| llms.txt | 143 / 210 | 0 |
| AI Crawler User-Agent Tokens in robots.txt | 91 / 210 | -3 |
| Markdown for Agents | 64 / 210 | +1 |
| Content Signals Policy | 57 / 210 | 0 |
| Agent Skills | 46 / 210 | 0 |
| api-catalog: A Well-Known URI and Link Relation to Help Discovery of APIs | 45 / 210 | 0 |
| AI Catalog well-known file | 43 / 210 | 0 |
| OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization) | 28 / 210 | 0 |
| Agent2Agent Protocol | 24 / 210 | 0 |
| AGENTS.md | 20 / 210 | 0 |
| Model Context Protocol | 19 / 210 | 0 |
| MCP Server Cards (SEP-2127) | 19 / 210 | 0 |
| OAuth Client ID Metadata Document | 16 / 210 | 0 |
| auth.md | 15 / 210 | 0 |
| Agentic Resource Discovery | 13 / 210 | 0 |
| agents.txt | 8 / 210 | +1 |
| Web Bot Auth HTTP Message Signatures | 7 / 210 | 0 |
| Really Simple Licensing | 4 / 210 | 0 |
| Text and Data Mining Reservation Protocol | 3 / 210 | 0 |
| agents.json | 2 / 210 | 0 |
| Identity Assertion JWT Authorization Grant | 2 / 210 | 0 |
| Universal Commerce Protocol | 2 / 210 | 0 |
| Agent Directory Service | 1 / 210 | 0 |
| agent-permissions.json | 1 / 210 | 0 |
| Open Knowledge Format | 1 / 210 | 0 |
| Signature Agent Card (Web Bot Auth registry) | 1 / 210 | 0 |
Fastest-growing repositories
| Repository | Stars | Change |
|---|---|---|
| block/goose | 55659 | +47 (0.1%) |
| agentskills/agentskills | 26580 | +38 (0.1%) |
| copilotkit/copilotkit | 38219 | +19 (0.0%) |
| agentsmd/agents.md | 25094 | +17 (0.1%) |
| googlecloudplatform/open-knowledge-format | 1103 | +13 (1.2%) |
| ag-ui-protocol/ag-ui | 16801 | +11 (0.1%) |
| a2aproject/a2a | 26285 | +8 (0.0%) |
| a2ui-project/a2ui | 16811 | +5 (0.0%) |
Official MCP Registry: 1704 servers (3000 versions) published or updated since 2026-10-24.
Changes to our records
- Ad Context Protocol: Ad Context Protocol v3.2.7 released 2026-10-24 on GitHub. · source VERIFIED
How this digest was made
Items are written only from the cited sources and our own measurements; every number in an item appears in a source it cites. VERIFIED = fetched from the standard's issuer or a standards body; REPORTED = a claim by press or a third party.
Sources searched: feeds 0, datatracker 24, hn 0, arxiv 0, exa 0, parallel 0, tips 0. 24 candidates, 19 new, 8 kept by triage (claude-opus-5-5), 10 facts given to the writer (claude-opus-5-5).
Window 2026-10-23T18:00:00Z to 2026-10-25T02:42:25Z. Generated 2026-10-25T02:43:46Z. Licence CC BY 4.0.