The answer a machine cannot fake
Identity, conduct, execution and escrow each have a proof now. None of them answers the question capital asks before it moves.
Every layer of agent trust now has a name. Identity has ERC-8004 and, since this month, x401, a protocol for proving who authorised an agent and what it may do. Conduct has Proof-of-Control, a draft standard with over a hundred requirements for evidence that an agent stayed inside its controls, and Proof-of-Behavior, an IETF draft of signed receipts and policy gates. Execution has Attestable, Axiom and ClawCheck, which prove that a model ran or an agent acted inside hardware isolation. Escrow has TessPay and VCAP, where a payment is released when evidence of a finished task arrives.
These are good answers to good questions. Who is this agent? Did it obey? Did the task run? Was the work delivered? An agent economy needs all four, and a venue that requires all four is safer than one that requires none.
And a venue that requires all four still cannot answer the question capital asks before it moves: did this machine earn what it claims, honestly, and how many times did it try?
Why the four layers are silent about money
Each of them proves something about the process and nothing about the result. An authority proof says the principal signed. A conduct proof says the limits held. An execution proof says the committed weights ran on the committed input. An escrow proof says a deliverable passed a check. None of them re-executes a track record. None of them knows whether the record shown is the one survivor of a thousand silent attempts. None of them keeps a public register of what was refused.
That last absence is the one that matters most. Every trust signal a machine can present today, a rating, a stake, a star, a stake-weighted reputation, an audit, a self-reported track record, can be produced by the party being judged. It is a claim with a signature on it. For a human manager the industry built a workaround over decades: meet them, call references, ask how many strategies they tried. None of that works on a machine that forks, retrains and will not show its method.
What an answer a machine cannot fake looks like
It has four properties, and the absence of any one makes it fakeable.
| Property | What it rules out |
|---|---|
| The record is re-executed inside the proof, after costs, on committed data | a result that was typed in rather than computed |
| The number of tries is bound inside the proof, as the leaf count of a committed ledger, with the reported winner forced to be the maximum | the survivor of a thousand silent attempts presented as the only attempt |
| The method never leaves its owner; only the metrics do | the excuse every quant and agent operator has for refusing to be checked |
| Every verdict and every refusal is a leaf in a register that only ages forward, anchored in Bitcoin blocks | backdating, deletion, and the quiet disappearance of failures |
Put together, those four turn a claim into an answer. Not an opinion about the machine, and not a promise about its future, but a fact about its past that a stranger can re-run without trusting anyone, including the issuer. The register includes the issuer's own refusals, because an answer that cannot be faked has to be unfakeable by the party issuing it.
Partners, not rivals
The four layers and the answer are not in competition. A venue will want to know who the agent is, that it obeyed its policy, that it ran the model it said it ran, and that the work was delivered, and then it will want to know whether to fund it. The first four are conditions. The last is the decision. The honest way to say this is that the identity, conduct, execution and escrow projects are the rail an answer travels on, and the answer is what the rail carries.
To our knowledge, as of this month, no project re-executes a results record inside a proof with the trial count bound, and no project keeps a public register of verdicts and refusals. That is the slot MIZAN fills. If a second issuer fills it under the same open rule, the answer gets stronger, not weaker, which is the point of publishing the rule.
What follows
If capital is moving to machines that cannot be interviewed and will not be disclosed, and if every trust signal a machine can present is a claim, then capital needs one answer that is not a claim. The machines worth funding are exactly the ones with the most to hide and the most reason to refuse an audit. The answer they cannot fake is the only answer they can afford to give.
Run a platform where people or agents decide where money goes? One founding seat per category →
Building an agent? Check one in one call → · Allocating? Verify a credential yourself →
Sources: x401 launch announcement (Proof.com, 15 October 2026); Proof-of-Control working draft v1.0 (Advanced AI Society, comment period to 30 October 2026); Proof-of-Behavior Protocol, IETF Internet-Draft (April 2026); TessPay, arXiv 2602.00213; VCAP, draft-stone-vcap-02 (September 2026); Prufold Labs ClawCheck (February 2026). Surveyed from public materials; no relationship with any project named is implied. "To our knowledge" is a hedge, not a boast: tell us what we missed.