GoDaddy, Infoblox, Google and Cloudflare have unveiled a system for verifying the identity of AI agents as they move through a transaction, developed in partnership with Singapore’s Infocomm Media Development Authority (IMDA).
Called the Chain of Trust, the open reference architecture was demonstrated at GovWare 2026 during Singapore International Cyber Week, and is built on principles from IMDA’s Model AI Governance Framework for Agentic AI (v1.5). It lets organisations discover, identify and authenticate AI agents at every step of a transaction, even when the agents involved have never interacted before and run on different platforms.
Agent-led commerce is growing fast
AI agents are already being used to search for products, compare prices and make purchases on behalf of people and businesses. McKinsey & Co estimates AI agents could facilitate between US$3 trillion and US$5 trillion in global consumer purchases by 2030.
The problem, according to the companies behind the project, is that most platforms today verify agents through closed systems, leaving businesses with little visibility into how an agent’s identity was checked or whether it can be trusted. The Chain of Trust addresses this by building on existing, open internet standards, including DNS, OAuth and the Model Context Protocol, so trust can be verified independently across clouds and platforms rather than inside a single vendor’s walled garden.
Live demo simulated a flight purchase between strangers
At GovWare, the four companies demonstrated a complete agentic purchase of a flight from Madrid to Singapore between agents that had never interacted before and ran on different platforms. The buyer agent ran on Amazon Web Services, the seller agent on Cloudflare Workers, and the mandate authority and verifier agent on Google.
A person approved the purchase with a passkey, which triggered a signed Agent Payments Protocol (AP2) mandate setting what the buyer agent could purchase, from whom and up to what amount. The buyer agent found the seller through DNS-based discovery, checked its identity against a public log, and verified its trust score before completing the purchase. The demo also included attempts by a look-alike seller using forged credentials, which the system stopped before any transaction occurred.
“Realising the potential of agentic AI will require trusted and interoperable foundations that can support responsible deployment at scale,” said Lee Wan Sie, cluster director for AI governance and safety at IMDA. “Robust agent identity will be a key part of that.”
“We don’t need to rebuild the internet for AI agents. By extending the open standards that have connected the internet for decades, we can give agents a verifiable identity that works across platforms,” said Jared Sine, chief strategy and legal officer at GoDaddy.
Wei Chen, executive vice president of regulatory strategy at Infoblox, said the project extends DNS and other established internet standards to agent discovery and identity verification, “helping create a system where businesses can independently verify who they’re dealing with, without relying on a single platform to decide who can be trusted.”
Rao Surapaneni, vice president for Gemini Enterprise and Agent Governance Platform at Google Cloud AI, and Stephanie Cohen, chief strategy officer at Cloudflare, also took part in the demonstration. The companies have published a technical case study and invited domain registrars, identity providers, payment networks and cloud and AI platforms to adopt and extend the architecture.
