Agent verification: two meanings, one hard problem

Search "agent verification" and you get two unrelated markets wearing one name. One sells proof of who an agent is. The other, older and quieter, tries to prove the agent's work was correct. Few pages say which they mean, so this one starts there.

What does agent verification mean?

Agent verification means one of two different things: confirming an AI agent's identity and authority to act, or confirming that the work the agent performed meets its specification. The first is an identity and authorization problem, and it is where almost all commercial activity sits, because payments fraud pays for it. The second is a correctness problem with a formal definition and a research lineage going back decades, and as of mid-2026 no vendor has planted a flag on the term.

If you are buying, the question is which failure you are trying to stop. A signed credential proving an agent belongs to a real company does nothing about that agent posting the wrong number to your ledger. A check that catches the wrong number does nothing about an agent impersonating your customer. Two problems, two sets of vendors, one keyword.

What is agent identity verification?

Agent identity verification is the practice of cryptographically proving that an agent is what it claims to be, that an accountable party stands behind it, and that it holds authority for the action it is attempting. The industry term is KYA, "know your agent", by analogy to KYC in financial services.

The clearest pure-play is Vouched, whose KYA suite uses decentralized identifiers, verifiable credentials, and an agent reputation directory, and which raised a $17M Series A in September 2025. AgentFacts proposes a universal KYA metadata standard, described in its arXiv paper as "cryptographically-signed capability declarations, multi-authority validation, and dynamic permission management". Dock Labs issues an Agent ID binding an agent to a verified organization with delegated-authority credentials.

The money behind this sense is payments money. Visa's Trusted Agent Protocol, developed with Cloudflare, has agents sign their requests so a merchant can reconstruct the signature base and verify it with the agent's public key. Mastercard's Verifiable Intent, announced March 2026 with Google, adds authorization: an Intent Mandate the user signs to scope what an agent may buy, and a Cart Mandate signed at final approval. In July 2026, Veratad launched the VX Agent Toolkit, exposing identity and age verification as a tool an agent can call to prove a real human authorized an action.

Buy this if your exposure is fraud, chargebacks, bot traffic, or regulated access. It does not help when your agent did the wrong thing using credentials it was entitled to use.

What is agent work verification?

Agent work verification is, in Wikipedia's definition, "activity to gain assurances that purposeful artificial constructs act in accordance with their specifications" (Agent verification). That comes out of formal methods, not security. The tooling it names is model checkers: MCMAS for temporal, epistemic, and strategic logics over multi-agent systems, and AJPF, which extends Java Pathfinder to agent programming languages. Model checking became dominant in that literature, theorem proving second, and the field is now confronting LLM agents whose reasoning is too open-ended for either to cover end to end.

Right definition, wrong assumptions about the agent. An LLM agent in your accounting system has no finite state space and no specification in temporal logic. It has a job, systems it touches, and an outcome somebody has to trust.

Wing Venture Capital put the stakes plainly in its January 2026 analysis of the RL environments market: "The limiting factor, like with early chip design, is in whether we can reliably verify the work produced by AI models" (RL Environments for Agentic AI: Who Will Win the Training & Verification Layer by 2030, Chris Zeoli). Work you cannot verify is work you cannot hand over.

What are the four things sold as agent verification?

These rows are not competitors. The last one has the fewest people selling it.

Why is verifying agent work the hard one?

Verifying agent work is the hard one because the obvious method, asking a model to check the model, fails exactly where you need it most.

Start with the self-verification ceiling. The intuition that checking is easier than doing comes from computational complexity, and it does not transfer to systems working by approximate retrieval. Testing GPT-4 on Game of 24, graph coloring, and STRIPS planning, Stechly, Valmeekam, and Kambhampati found "significant performance collapse with self-critique" and "significant performance gains with sound external verification". A model does not catch the error classes it reliably makes.

Then judge bias and drift. A strong model as grader works better than skeptics expect, and the paper that established the method also established its holes: Zheng et al. report GPT-4 judges reaching over 80% agreement with human preferences, the level humans reach with each other, while identifying "position, verbosity, and self-enhancement biases, as well as limited reasoning ability". Later work quantifies position bias and self-preference bias individually.

What makes both dangerous rather than merely imperfect is silent failure. Apica states the shape well: "An AI agent returns HTTP 200. The JSON is valid... Every dashboard shows green. The agent hallucinated its findings, skipped a required tool call, and hid the failure behind a well-formatted answer" (Your AI Agent Passed Every Test. It Was Still Wrong). Uptime monitoring and schema validation cannot see this, and neither can a test suite that ran last Tuesday on cases you chose.

How do approved checks verify agent work?

Approved checks verify agent work by grading every step of every real run against a pass condition the operator signed off on beforehand, rather than sampling outputs afterward. An environment wraps software around your work: a machine does the steps on your systems, and a check you approved grades each one. When a step fails, the run stops there and resumes there once fixed, so you get a step number instead of a transcript. The run records are the audit trail and the training set.

The checks come in three types, ordered by how much you have to trust a model:

• Computed. Code decides. Do the totals reconcile, does the record exist, do the two systems agree. The gold standard, and more of a real process is computable than people expect.
• Classified. A small model trained for that one check and scored against held-out examples before it is trusted. Narrow, with a measured error rate.
• Judged. A judge trained on a few hundred pass/fail examples annotated by the operators themselves, with judge-human agreement reported on held-outs. Where agreement is too low, a human stays in the check. Designing the criteria a judge applies is rubric engineering.

Every check pushed from judged toward computed removes a place where the verification itself can be wrong. The term itself is defined in approved checks, the mechanics are in reinforcement learning with verifiable rewards, the step-by-step version is in how to verify AI agent work, and what this cannot catch is in the limits of AI agent verification. The record those checks leave behind, and how it differs from an entitlement log, is in verified agent audit trail. Terms: glossary.

Which sense did you come here for?

If you came for identity verification, go to the vendors: Vouched and Dock Labs for KYA infrastructure, Visa TAP and Mastercard Verifiable Intent for agentic commerce, AgentFacts for the standard. Pebble does not build any of that and will not pretend otherwise.

If you came here because an agent already did something you could not verify, that is our work. Bring one process and we will tell you which steps can be checked by code, which need a trained check, and which should stay with a human. Scoping calls: [email protected]. If an environment is the wrong tool, we say so on the call.