Agent identity tells you who. Reputation tells you whether you should.

I've been building trust infrastructure for AI agents for the past few months, and the thing that keeps coming up in conversations is a conflation that seems obvious once you see it but is almost universally ignored in practice. Everyone is shipping identity for agents right now. Okta, Ping Identity, a dozen YC companies. Cryptographic keypairs, W3C DIDs, OAuth flows. Good work, genuinely useful. None of it tells you whether to trust the agent. Scenario I kept running into When I started building AVP, the use case I had in mind was simple. Two agents from different companies need to work together. One processes customer data, the other handles payments. They authenticate fine. The handoff happens cleanly. But what does the first agent actually know about the second one? That it exists. That it controls a private key. That's it. Nothing about whether the payment agent completed tasks reliably last week. Nothing about whether it shares an owner with three other agents vouching for each o