PegasusAgents are becoming customers. Know which ones you’re letting in.
Every business an agent deals with now has to answer the same question: may this agent take this action, on whose authority, and what gets recorded? This library collects the argument, the essays, the signals from the field and the proof running today. It’s updated as the field moves.
The specimen
The captcha asked the wrong question.
In October a reviewer sent a new consumer agent to cancel an order. It hit a puzzle captcha and asked its user: “May I solve it? You can also give me permission to solve future captchas if you’d like.” It failed the puzzle, and the order stayed open.
The merchant’s gate tested whether a human was present. The customer was legitimate, a real person who had sent a real agent, and the gate turned them away. Then the agent asked the wrong party for consent to defeat the merchant’s control. Nothing in the exchange carried who the agent was, who it worked for, or what it was allowed to do.
The argument
Four questions. Three converging, one open.
KYC asks who the customer is. KYA asks what the agent may bind you to. It breaks down into four questions, and the market is answering them at different speeds.
Who is the agent?
Who authorized it?
What is it allowed to do?
How far does that authority travel?From a person to an agent, from an agent to another agent, and now from a job title to an agent. Does it stop when the role changes hands?
Identity is not authority. A signed agent can prove where it came from, not that it’s allowed.
The exposure runs both ways. Inbound, the trust stack built to keep automation out now blocks good agents and waves through bad ones; no setting fixes both. Outbound, if your own agents can’t show who stands behind them, you get filtered out of the networks that check. One question sorts every business on this:
When an agent transacts with you, can you tell whether an accountable party stands behind it, and can you prove one stands behind you?
Forecasts: eMarketer, Dec 2025. The status of each question is our reading of the field, not a claim made by any single source.
The membrane
Know what the agent is for. Record what it did.
Knowing who an agent is answers half the question. The other half is what it was built to optimize for, because the objective a system is given and the behavior it learns are rarely the same thing. We call the layer that closes that gap the membrane. On every consequential action it authenticates what is acting, permissions what it may do, and records what it did and why.
What governed each run
A signed decision trace on every consequential run: the rule applied, the inputs, any exception and its justification, and who approved it.
What you actually intended
Evals that watch for drift, searchable logs, a review queue with a named owner, and rollback when a signal fires. Not just whether the metric moved.
What each behavior is for
No spec, no ship. Each behavior has a purpose, an autonomy tier and a permission envelope. One you can't account for halts the build.
What a system optimizes for is a decision. Decisions get recorded.
The essays
The long version, written as it happened.
Reggie Britt’s series on the agent surface works through the argument one development at a time.
Block, Allowlist, or Open the Door
Amazon blocks, Target allowlists, Walmart opens, DoorDash builds its own. What each door costs, and the one question to ask this quarter.
Read on Pegasus Source →The Captcha Asked the Wrong Question
A consumer agent asked permission to beat a captcha; an enterprise agent shipped with a job title. Identity is not authority.
Read on reggiebritt.ai ↗Do You Know Who Is Using Your Product?
Where the four KYA questions come from, and why the customer journey has to be rebuilt around an agent.
Read on reggiebritt.ai ↗The Money Moves Last
The rails solved three of the four questions. What an agent may commit you to is the part nobody can hand you.
Read on reggiebritt.ai ↗Neither You Nor a Stranger
A court and a contract said the agent is you; a retailer said it is a stranger. Both fail. The agent is yours.
Read on reggiebritt.ai ↗Governance Comes Home
Households now govern agents by hand. Protection has to move to the crossing, where the business can check.
Read on reggiebritt.ai ↗Everyone Built the Gate
Every layer shipped a gate around the agent. Almost nobody asked whether the system of record can refuse on its own.
Read on reggiebritt.ai ↗From the field
What moved, and how sure we are.
We track agents moving into transactions every week. These are the specimens that matter for KYA, newest first, each with its source and how much weight it can bear.
The agent got a job title
Google’s Gemini agent can act for a role, like a finance analyst, with an attested identity and an audit trail that attributes actions to the agent rather than to a person.
Google Cloud · Google’s own launch claims.The captcha asked the wrong question
A consumer agent hit a captcha cancelling an order, asked its user for standing permission to solve captchas, and failed. The merchant’s gate could only ask whether a human was present.
WIRED · One reviewer’s test: a specimen, not a measurement.Agents at the door, turned away
Personal agents are being blocked across retail, travel and local-business sites by human checks, terms-of-service bans and paid walls, some of it unintended.
TechCrunch · A roundup; some claims anecdotal.A protocol for personal agents
Meta and Sierra proposed a Personal Agent Protocol for how personal agents deal with businesses. The first spec is due this month; how an agent proves who it represents isn’t spelled out yet.
Sierra · Specification pending.Retailers split
Some retailers keep agents out of their own checkouts; others let them buy and send their catalogs to the agent platforms.
PYMNTS · Relays The Wall Street Journal.The networks start scoring agents
Mastercard began US testing of a score telling issuers how likely a purchase was started by an agent. Experian is binding agents to verified consumers and their devices.
The Paypers · US testing only; no Experian pricing or availability.The proof
Not a puzzle at the door. A decision.
Silver Lake Financial Group shows the other answer working end to end. An agent shops a store running Pegasus Commerce, carrying its own key and a limit the store enforces. The shopper approves and pays. Financing goes to the lender’s own decision engine, which decides on its own system of record and leaves a record nobody can quietly rewrite.
Silver Lake Financial Group
A whole lender, built with agents at every door and people at every gate.
The October 1 run
An agent buys under a limit; the store refuses the cart that goes over it.
What’s built, and what isn’t
Eight functions, one record. We mark what’s running.
Silver Lake and its demonstration store are fictitious companies. The store runs in test mode; nothing is really sold or lent. The crossing to the lender’s decision engine was built and proven working end to end.
What to do now
Build the decision points now. Commit to a vendor later.
The standard isn’t settled, and the fourth question can’t be bought. You don’t need either to start.
Retire “are you human?”
Ask who the agent is, who stands behind it, and what it’s asking to do. Where you can’t tell yet, route the binding act back to a person.
Bind authority to a person
For every agent acting with a job title, know who currently answers for the role, and end its authority when that changes.
Decide at the destination
The final check belongs where the action lands: the order, the ledger, the loan. Your system of record should be able to refuse on its own.
Selling online? Pegasus Commerce puts this in front of a store you own →
Run on IBM i? Pegasus4i delivers it on the platform you already own ↗
See where you stand.
When an agent shows up at your door, does anything in your business decide what it is and what it may do? Open a free workspace and find out in a few minutes. No sales call required.