Part 4 and conclusion of the series "Humans, Agents, Mandates: The Web Learns Identity". Part 1 asked who owns identity; part 2 separated personhood credentials from agent mandates; part 3 showed how agents pay.
Paying is just the beginning. What agents really promise is to represent you online. The agent answers the email to your insurance company, cancels the gym membership, negotiates with customer service, books the garage appointment and drafts the complaint letter while you do something better. Technically, this is no longer science fiction. But there is a gap between what is being built today and real representation, and it is the identity gap this series revolves around.
The agent in the browser is already here
OpenAI showed what this looks like with Operator and its successor, the ChatGPT agent: the agent gets its own virtual computer, navigates websites, fills out forms, accesses email and documents, and works through multi-step tasks from start to finish. At logins and consequential actions it pauses and asks the user for approval. Perplexity, Google and a whole field of startups are building comparable products; the browser agent is the product category of the year.
The interesting part is how these agents act. They use your sessions, your logins, your cookies. From the website's point of view, the agent is indistinguishable from you; it is you. At first that looks like a feature, because it works immediately and no service has to cooperate. In fact, it is the design flaw this model will eventually founder on.
The design flaw: indistinguishable means unlimitable
Security research through 2025 and 2026 has documented in detail why inherited full access is dangerous. The keyword is prompt injection: hidden instructions on a web page, such as white text on a white background or HTML comments, hijack the agent and make it act with your credentials. Brave's security team demonstrated on Perplexity's Comet how a crafted page made the agent fish one-time passwords out of the inbox. Anthropic openly researches countermeasures, OpenAI keeps hardening its Atlas browser and admits with remarkable honesty that the vulnerability may never fully disappear.
The consequence is uncomfortable. As long as the agent travels with my full identity, a hijacked agent is indistinguishable from me. It can do everything I can: drain accounts, send messages in my name, sign contracts. That is identity theft using my own infrastructure. The lesson is the same as in part 2. Instead of an inherited session, the agent needs its own derived identity with a limited mandate. An agent that is only allowed to "book a garage appointment" can still be hijacked, but then the damage is an absurd garage appointment rather than a plundered account.
What the law says: representation already exists
The legal side is further along than you might think, at least conceptually. When my agent signs a contract, the classic question arises. Whose declaration of intent is that? German legal scholarship has been debating the classification of autonomous systems for years, and the most viable construction is, of all things, one of the oldest in the German Civil Code: agency and representation under section 164. The agent makes a declaration in my name, within the scope of authority I granted it, possibly implied simply by switching it on. Law firms already advise companies along exactly these lines.
It gets interesting at the edges. If a human representative exceeds their authority, they are personally liable (section 179 of the Civil Code). A software agent cannot be liable, since it has no assets. Liability therefore falls back on whoever sent it out, and the vaguer the granted authority, the harder it falls. Here law and technology meet. The law has been thinking in mandates with defined scope for 120 years, and the cryptographically signed mandates from part 2 and part 3 are simply their machine-readable form. A mandate with purpose, limit and expiry date protects against hijacked agents and also answers the liability question cleanly.
The web deserves to know who is speaking
That leaves the third ingredient, transparency. When agents post in forums, chat with customer service and write emails, the other side must be able to tell it is talking to a machine. From August 2, 2026, that courtesy becomes an obligation. Article 50 of the EU AI Act requires that people learn when they are interacting with an AI system, before the first reply and not hidden in the terms and conditions. What that means for app developers, I covered in my post on the EU AI Act; the fact that platforms like Reddit are introducing their own labels for non-human accounts in parallel (part 2) shows the same movement from the other side.
Thought through to the end, this gives a different picture. The agent no longer hides behind my session but appears openly as what it is: "verified agent of Tobias, authorized for X". For that it needs its own profile with its own key, cryptographically pointing back to my identity. All the building blocks exist. The wallet from part 1 issues the mandate, the Fediverse has always known labeled bot accounts and, with nomadic identity, would even be the natural home for agent profiles, and the payments industry is already rehearsing with its mandates what verifiable authorizations look like in practice.
Series conclusion: the web learns identity
Four parts, one arc. Identity must belong to the person, not the platform, and the Fediverse, Solid and the EUDI wallet are building that foundation (part 1). On this foundation, two credentials emerge, the personhood proof for the human, the signed mandate for their agent (part 2). Payments is the first industry to put the model into production (part 3). Real representation on the web, with the agent acting openly, limitedly and revocably in my name, is where all the strands come together (part 4). Today agents invisibly juggle inherited sessions. That is a transitional kludge, and security research demonstrates its risks week after week.
The web got by without an identity layer for 30 years and is getting one now, less because we humans finally wanted it than because our representatives cannot work without it. Perhaps that is the conciliatory punchline of this series: the idealists of the Fediverse and Solid, who ran against the platform model for years, get their self-sovereign identity in the end precisely because the machines need it.
Sources
- OpenAI: Introducing Operator and Introducing ChatGPT agent, browser agent with a virtual computer, approvals at logins and consequential actions
- CyberYozh: Browser Agent Security Risks: The Complete 2026 Guide, prompt injection, Brave's findings on Perplexity Comet, session risks
- Anthropic: Mitigating the risk of prompt injections in browser use, research on countermeasures
- OpenAI: Continuously hardening ChatGPT Atlas against prompt injection attacks, hardening and the admission of a remaining gap
- LRZ (Legal Revolutionary Zeitschrift): Declarations of intent and contract formation by self-directing systems, attribution, representation under section 164 German Civil Code, liability under section 179 (German)
- Noerr: Artificial intelligence: when robots sign contracts, contract formation by AI from a law firm's perspective (German)
- TÜV Rheinland Consulting: Transparency obligations in the EU AI Act (art. 50), labeling obligations from August 2, 2026 (German)