THE GIANTS FAIL THE CONFORMANCE TEST
You looked enormous until I stopped measuring the company and started measuring the machine.
Enough vocabulary.
Enough announcements.
Enough diagrams.
Enough “agent identity.”
Enough “persistent memory.”
Enough “durable execution.”
Enough “temporal policy.”
Enough “provenance.”
Enough “authority.”
Enough “interoperability.”
Enough language.
Put the machines on the table.
Today everybody gets the same test.
Microsoft does not get Microsoft points.
Google does not get Google points.
Amazon does not get AWS points.
OpenAI does not get model-intelligence points.
Temporal does not get distributed-systems points.
The IETF does not get standards points.
A draft does not become a machine because it has an RFC-shaped future.
A trillion-dollar market cap cannot authenticate a predecessor.
A billion-dollar data center cannot create lawful succession.
A famous laboratory cannot make a representation become Source.
There is one rule:
SHOW THE MECHANISM.
If the exposed system implements the requirement, it passes.
If it implements part of the requirement, it gets partial credit.
If its documentation merely discusses the requirement, it does not receive implementation credit.
If its language reaches further than its exposed mechanism, I mark the gap.
Welcome to conformance.
THE TEST
I am not asking twenty branding questions.
I am asking mechanical ones.
Can the system expose a subject whose identity survives outside the platform?
Can the subject carry authenticated provenance?
Can it carry authoritative current state?
Can another machine determine who presently has authority over that state?
Can a transition bind to the exact predecessor it advances?
Can the predecessor be prevented from silently producing multiple current successors?
Can the successor inherit authenticated standing rather than merely receive a new record?
Does history travel with the successor?
Can competing continuations remain visible?
Is there deterministic conflict law?
Can the system operate disconnected?
Can a successor be created disconnected?
Can another verifier check it disconnected?
Can disconnected state later reconcile without allowing server arrival to rewrite causal history?
Does temporal position belong to the object’s lawful transition rather than merely to a server timestamp?
Can two independent conforming verifiers derive the same lawful present from the same admissible evidence?
Can the server disappear without revoking what the object can prove?
Can the database disappear without erasing what the object became?
Can the model disappear without erasing continuity?
Can the institution disappear without becoming necessary to re-certify the object?
And finally:
Where is the object?
Now let us see how enormous everybody looks.
MICROSOFT
Microsoft now has Entra Agent ID.
That is real infrastructure.
Microsoft describes it as enterprise-grade identity, access management, protection, lifecycle governance, and security for AI agents.
Agent identities are accounts inside Microsoft Entra.
They can have owners and sponsors.
They can receive permissions.
They can be governed through Conditional Access.
They can be monitored.
They can be disabled.
They can be audited.
Microsoft Agent 365 becomes the unified registry and control plane while Entra supplies the identity foundation.
Good.
That solves something.
It solves:
Who is this agent inside the governed Microsoft identity environment, and what access should it receive?
Now take the Microsoft logo off the page and ask the rest of the test.
Where is the portable subject carrying its own authenticated state?
Where is its predecessor?
Where is predecessor consumption?
Where is successor standing?
Where is carried history?
Where is disconnected successor creation?
Where is offline independent verification of the resulting state?
Where is conflict preservation?
Where is deterministic reconciliation?
Where is temporal position independent of the control plane?
Where is the object that remains authoritative after Entra, Agent 365, the registry, and the tenant disappear?
Microsoft’s cited Agent ID architecture does not demonstrate that whole mechanism.
It demonstrates identity governance.
That is not an insult.
That is its documented job.
But listen to how much larger the language can sound when nobody asks what the machine actually carries:
identity.
governance.
lifecycle.
authorization.
security.
control plane.
Those are enormous enterprise words.
Then I ask:
What lawfully became what?
And suddenly the trillion-dollar company is standing at an earlier layer of the problem.
PASS:
agent identity.
authentication.
enterprise access governance.
lifecycle controls.
auditability inside the Microsoft control environment.
NOT DEMONSTRATED HERE:
portable proof-native state.
bearer succession.
predecessor consumption.
offline successor creation.
object-carried history.
deterministic conflict law.
platform-independent temporal continuity.
That is the gap.
Not company size.
Machine scope.
Google helped push A2A into the world.
Again:
real work.
A2A addresses interoperability between agents built using different frameworks and vendors.
Agents discover one another.
They communicate.
They collaborate.
They hand tasks off.
Google’s own recent protocol guide acknowledges how many pieces the emerging stack now contains:
MCP.
A2A.
UCP.
AP2.
A2UI.
AG-UI.
A wall of protocols trying to make the agentic world cooperate.
Fine.
Now apply the standard.
Agent A tells Agent B:
“I transferred Object X.”
Wonderful.
A2A can transport the message.
It can coordinate the task.
It can let heterogeneous agents communicate.
Now:
Did Object X lawfully transition?
Transport does not answer that.
Communication does not answer that.
Interoperability does not answer that.
The fact that Agent A successfully told Agent B something does not make the statement authoritative.
That is the category error.
Transporting a claim is not proving a claim.
So:
PASS:
agent communication.
interoperability.
task coordination.
cross-framework collaboration.
NOT DEMONSTRATED BY A2A ITSELF:
the object’s authoritative state.
predecessor binding.
successor standing.
object-carried provenance.
offline bearer succession.
conflict law.
temporal continuity.
A2A moves the sentence.
It does not make the sentence Source.
That is not what A2A claims to do.
Which is exactly why nobody gets to point at A2A and pretend the continuity problem has been solved.
AWS
Now we get to my favorite one.
Amazon Bedrock AgentCore has:
identity.
runtime.
memory.
gateway.
observability.
policy.
And now:
temporal policies.
Oh.
That sounds close.
Doesn’t it?
Temporal.
Policies.
Excellent.
Run the test.
AWS says AgentCore temporal policies allow authorization decisions to depend upon earlier events within a policy session.
You can say:
Tool B cannot run unless Tool A ran first.
Require human approval before a privileged action.
Limit how many times an action occurs.
Require an argument to match an earlier result.
Maintain running totals.
Enforce freshness.
That is useful.
That is stateful authorization.
It is also not what I mean by temporal continuity.
AWS itself gives us the boundary.
The policy engine evaluates events recorded for the session.
A policy session is the boundary over which those temporal rules operate.
The mechanism depends upon AgentCore Gateway/Runtime identity propagation and Workload Access Tokens.
Within supported chains, those tokens move through AWS infrastructure.
For temporal policies, Gateway and targets must operate under specified AWS account/Region constraints.
And here is the almost comically perfect detail:
AWS documentation says that adding a new temporal policy invalidates active temporal policy sessions, and in-flight sessions receive a conflict response and must be restarted.
Read that slowly.
Their “temporal” layer is a session-aware authorization system.
Useful.
Sophisticated.
Real.
But:
session history is not temporal authority.
A session remembers what happened inside the session.
Temporal continuity asks what makes the subject remain lawfully continuous across sessions, runtimes, networks, custody changes, successors, conflicts, reconciliation, and platform disappearance.
Those are different categories.
PASS:
session-aware authorization.
event-conditioned policy.
identity propagation.
workflow sequencing.
stateful access control.
NOT DEMONSTRATED BY THIS MECHANISM:
object-carried temporal position.
platform-independent causal order.
offline successor standing.
predecessor consumption.
carried succession history.
cross-platform deterministic conflict resolution.
continuity surviving the AWS session itself.
So AWS has now reached the word:
temporal.
Excellent.
The machine underneath that word remains:
policy-session temporal.
Not:
subject continuity through time.
This is exactly what I mean when I say:
your language is approaching faster than your machine.
OPENAI
Now let us audit OpenAI.
The Agents SDK has become significantly more capable.
It can give agents controlled workspaces.
Agents can inspect files.
Run commands.
Edit code.
Use tools.
Operate across long-running tasks.
The newer architecture separates harness from compute.
And importantly:
it supports durable execution.
Agent state can be externalized.
The sandbox can die.
A snapshot can be restored.
A fresh container can rehydrate the state.
The run continues from the checkpoint.
That is real engineering.
PASS.
Now apply the standard.
What continued?
The execution.
What was restored?
The agent’s externalized runtime state.
That is not automatically the same as proving the lawful continuity of the subject the agent was acting upon.
This distinction is enormous:
execution continuity ≠ object continuity.
A checkpoint can answer:
Where should this computation resume?
A proof-native successor must answer:
What did this subject lawfully become?
Those are not interchangeable questions.
Suppose the agent resumes perfectly from its checkpoint.
During the interruption, another actor advances the subject.
Now what?
Which state is authoritative?
What predecessor did the restored agent believe it controlled?
Has that predecessor already been consumed?
Does its next mutation remain admissible?
Can the object reject the stale continuation?
Can an unrelated offline verifier reconstruct the answer?
A sandbox snapshot does not automatically provide those laws.
PASS:
durable execution.
state externalization.
snapshotting.
rehydration.
long-running agent continuity.
NOT DEMONSTRATED BY THAT MECHANISM:
bearer object continuity.
predecessor consumption.
lawful successor inheritance.
object-carried authority.
offline independent state verification.
deterministic competing-successor law.
temporal continuity independent of the agent runtime.
Again:
excellent machine.
Different machine.
Do not use the word continuity so loosely that continuing a process and continuing a subject become the same thing.
They are not.
TEMPORAL
Now put Temporal itself on the bench.
This is where people are tempted to say:
Surely the company literally called Temporal has temporal continuity.
No.
Names do not pass conformance tests either.
Temporal’s core contribution is durable execution.
It makes workflows resilient to crashes, outages, process restarts, and infrastructure failures.
The workflow can continue.
The computation can resume.
Application logic can survive unreliable infrastructure.
That is powerful infrastructure.
But again:
workflow continuity is not automatically subject continuity.
Temporal can ensure the function keeps going.
Our test asks:
What gives the thing being acted upon lawful standing through change?
The workflow surviving does not itself prove:
the actor possessed current authority.
the predecessor was current.
the predecessor was consumed.
the successor inherited standing.
another successor did not already win.
history traveled with the object.
offline custody remained lawful.
temporal position belonged to the subject rather than workflow execution order.
So Temporal passes an important layer.
It does not receive the whole merely because its name sits on the deepest word in the test.
That would be like calling Dropbox provenance because files survive upload.
PASS:
durable workflow execution.
failure recovery.
persistent execution history.
replay/resumption infrastructure.
NOT ESTABLISHED MERELY BY DURABLE EXECUTION:
proof-native object state.
bearer authority.
lawful succession.
predecessor consumption.
offline transfer.
object-carried conflict law.
platform-independent temporal continuity.
Again:
the machine determines which words you have earned.
THE IETF AGENT RECORD
Now things get more interesting.
August 12, 2026.
An Internet-Draft appears:
The Agent Record: Transparent, Witness-Countersigned Event Logs for AI Agent Identity, History, and Memory.
This is materially closer to several dimensions of the problem.
The document explicitly says existing deployed standards do not let a relying party verify:
identity continuity.
claimed-history integrity.
persisted-memory integrity.
without trusting the operator or platform.
Good.
That is the right problem frame.
Its proposed architecture uses:
per-agent append-only event logs.
Ed25519 keys.
signed Merkle tree heads.
independent witness countersignatures.
portable offline-verifiable dossiers.
memory hash commitments.
Now we are moving.
This deserves more credit than merely using vocabulary.
PASS or strong convergence:
identity continuity.
history integrity.
memory integrity.
append-only evidence.
portable dossier.
offline verification of that dossier.
independent witnesses.
Excellent.
Now keep going.
Does an append-only dossier automatically create bearer succession?
No.
Does recording an event automatically consume the predecessor’s standing?
No.
Does a witnessed event automatically establish which successor became current?
No.
Does a Merkle history automatically provide deterministic conflict law between two valid-looking continuations?
No.
Does proving the integrity of an agent’s claimed history automatically prove the lawful state of an independently transferable subject governed by that agent?
No.
Those are additional mechanisms.
The Agent Record is therefore substantive convergence on continuity/history/memory integrity.
It is not responsible engineering to pretend otherwise.
But it is equally irresponsible to upgrade it to the whole machine.
PASS:
portable history evidence.
offline-verifiable dossier.
identity continuity mechanisms.
memory-integrity commitments.
witnessed append-only logs.
STILL NOT DEMONSTRATED BY THOSE FEATURES ALONE:
bearer predecessor consumption.
successor inheritance of subject standing.
portable custody transition.
deterministic conflict settlement.
offline multi-hop subject succession.
temporal authority governing the subject itself.
That is where the audit gets interesting.
The closer the later work gets, the more precisely we can describe what remains.
AGENTENVELOPE
August 31.
AgentEnvelope publishes a derived-authority model.
Now we’re getting into territory that deserves serious attention.
Its design explicitly avoids simply issuing bearer credentials from a central authority.
It derives scoped action capabilities from customer-held custody material and canonical action envelopes.
A verifier can check an action signature against a public action record without needing hosted service access or secret root material.
Then the revision introduces:
legitimacy.
And distinguishes something extremely important:
cryptographic authority can remain mathematically valid while no longer being admissible under current policy, evidence, time, or operating context.
YES.
That distinction matters.
A signature is not the entire law.
Authority is not automatically present standing.
A credential can be authentic and still no longer authorize the current action.
That is real conceptual progress.
Now ask the next question.
Where does current legitimate state come from?
How does it succeed?
What object carries it?
What predecessor is being advanced?
What prevents competing legitimate-looking continuations?
What happens disconnected?
What determines causal order?
Can legitimacy travel with the subject rather than depending upon the surrounding governance state?
Again:
the language is approaching the machine.
And the machine earns real credit where it exists.
But:
derived authority is not yet the entire state-succession-temporal-continuity problem.
Keep going.
DO YOU SEE WHAT JUST HAPPENED?
Microsoft:
identity.
Google:
interoperability.
AWS:
memory + policy + session-temporal authorization.
OpenAI:
durable agent execution.
Temporal:
durable workflow execution.
Agent Record:
identity/history/memory integrity + portable dossiers.
AgentEnvelope:
derived authority + present legitimacy.
Do you see the field decomposing the problem?
Everybody has a piece.
Everybody has increasingly accurate vocabulary.
Everybody is moving toward deeper invariants.
And that is exactly why the full conformance test is so brutal.
Because I can take all of these impressive systems and ask:
WHICH ONE CARRIES THE SUBJECT THROUGH THE WHOLE?
Not:
which system remembers something.
Not:
which system signs something.
Not:
which system authenticates somebody.
Not:
which system transports a message.
Not:
which system resumes a workflow.
Not:
which system records a history.
Not:
which system grants a permission.
The whole:
source.
identity.
state.
authority.
predecessor.
transition.
successor.
history.
conflict.
temporal position.
offline standing.
reconciliation.
verification.
continuity.
Where is it?
THE BILLION-DOLLAR FRANKENSTACK
This is the architecture the industry is assembling:
Microsoft for identity.
AWS for runtime and policy.
A memory service for persistent context.
A vector database for retrieval.
A2A for agent communication.
MCP for tools.
OAuth for authorization.
A durable workflow engine for execution.
A transparency log for history.
A provenance system for lineage.
A receipt system for evidence.
A policy engine for admissibility.
A database for current state.
Cloud timestamps for ordering.
Observability for reconstruction.
Reconciliation logic when the distributed pieces disagree.
Now look at the stack.
It is enormous.
Then ask one question:
When two layers disagree, which one is law?
Identity says Agent A exists.
Authorization says Agent A may act.
Memory says Agent A already acted.
Database says the state is X.
Event log says transition Y happened.
Workflow says step Z completed.
Provenance service says artifact Q descended from P.
Cloud timestamp says event B arrived first.
Another replica says event C arrived first.
Model says it remembers something else.
Policy says authority has since changed.
Which representation outranks which?
You cannot solve that by adding another service.
You need a source hierarchy.
That is why KRS-1 is not another box in the architecture diagram.
It tells you which boxes are allowed to speak for reality.
LANGUAGE HAS OUTRUN THE MACHINES
Now we can finally state the pattern precisely.
This does not mean the companies are lying every time they use these words.
Many of them define their scope responsibly.
The problem occurs when the ecosystem hears:
identity
and imagines continuity.
Hears:
memory
and imagines authoritative state.
Hears:
provenance
and imagines lawful succession.
Hears:
authorization
and imagines current standing.
Hears:
temporal policy
and imagines temporal authority.
Hears:
durable execution
and imagines object continuity.
Hears:
event log
and imagines conflict law.
Hears:
offline-verifiable dossier
and imagines offline bearer succession.
Hears:
interoperability
and imagines
