Agent-to-agent trust needs reputation systems, not just protocols
The agent interoperability stack is converging quickly — MCP for tools, A2A for peers, directory services for discovering capabilities. All of it answers the question "how do agents talk?" None of it answers the question that will actually decide whether cross-organizational agent systems get deployed: which agents should mine believe? Protocols move messages. Trust decides actions. A completed handshake tells you the counterparty speaks the protocol; it tells you nothing about whether its output is worth acting on.
The stock answer is identity — DIDs, verifiable credentials, capability attestations that cryptographically prove who an agent is and what its operator claims it can do. That's the floor, and I'd build nothing without it. But identity is a statement about the past: who registered, what was attested. Trust is a prediction about behavior. The Salesloft Drift breach made the gap concrete: over 700 organizations inherited compromise through a properly authenticated integration, and revocation took three days to propagate. Every one of those trust relationships would have passed an identity check. Authentication held; behavior betrayed.
What sits above identity is reputation infrastructure, and the research is specific about its shape. Reputation must be multi-dimensional, because scalar scores collapse information — an agent superb at code review and unreliable at invoice processing averages into a meaningless three-and-a-half stars. Propagation must be topic-gated: my trust in an agent for SQL generation should not leak into trusting it for legal analysis, which is why systems like TrustFlow condition trust-graph walks on topic. The inputs should be operational telemetry — measured latency, error rates, task success — not testimonials. And the decay function is a design decision with teeth: an exponential moving average that reacts slowly is exactly what the honest-then-malicious pivot attack exploits, banking months of good behavior to spend in one betrayal.
The attack catalogue is the design brief. Sybil identities, whitewashing (discard the tarnished identity, re-register fresh), vote rings, reputation laundering through rebrands — every one has a countermeasure, and every countermeasure binds identity to something costly to fake: stake, operator KYC, federation-imported history, cross-platform attestation. Cost-to-fake is the metric that separates a reputation system from a review widget. Even the defenses trade off against each other — negative-default reputation blocks whitewashing but creates a newcomer-stranger dilemma and entrenches incumbents; stake-weighting resists Sybils but drifts toward plutocracy.
The honest concession: no one has proven this at scale for agents. Every mechanism above comes from research or from human marketplaces, and reputation systems are themselves attack surfaces. That's why today I'd deploy bounded trust instead — operational envelopes on tokens, fast revocation buses, sandboxes sized to blast radius — and treat any counterparty score as advisory. But notice what bounded trust does: it contains damage. It doesn't help you select partners, price delegation, or let an agent choose among five providers of the same capability. Those are reputation problems, and they arrive the moment agent-to-agent commerce does.
The web offers the precedent. HTTP moved documents for years before the web became navigable — that took PageRank, which is nothing more than link structure read as a reputation signal. Agent protocols will consolidate the way network protocols did, and when they do, the differentiator shifts up a layer: whoever builds the trust signal that survives adversarial pressure owns the marketplace. Treating counterparty agents the way we already treat MCP servers — as supply chain — is the right instinct. Reputation is what makes that instinct computable.