No One Noticed, But the AI Battlefield Just Shifted Again on June 17: From “Whose Model Is Smarter” to “Who Dares Open the Door to a Stranger Company’s Machine”

You probably scrolled past this news, and most likely didn’t give it a second thought, because it just wasn’t that clickbaity. Google, Microsoft, and Hugging Face took the lead, followed by a whole roster of companies like Snowflake, Databricks, NVIDIA, Cisco, and GitHub. They jointly released an open standard called ARD (Agentic Resource Discovery). In plain English: it lets AI agents from different companies discover what each other can do.

Sounds like another piece of technical jargon, right? I thought so too at first. But after staring at it for a few days, the more I thought about it, the more unsettling it became. The thing lurking beneath this unassuming little standard might be more important than all the big model launches of the past two years combined.

Because it marks a turning point: the AI war is quietly shifting from “who’s smarter” to “who’s more trusted.” These are two completely different battlefields. You’re still watching the action on the first one, but money and power are already changing hands on the second.

Let me put it in plain language: AI agents are about to start calling each other.

The AI you understood before was you chatting one-on-one with ChatGPT, asking questions and getting answers. You were the client, it was the vendor.

The coming form is nothing like that. It’s your company’s agent automatically going to call another company’s agent to get work done, with no human oversight the whole time. Your procurement agent, in the middle of the night, autonomously negotiates prices with a supplier’s quoting agent. Your risk control agent goes and knocks on the credit bureau’s agent’s door to pull data. Your travel agent books flights and hotels and pays for them, all by itself, dealing with the airline’s and hotel’s agents. Machines find machines, machines command machines, machines pay machines.

ARD solves the first step of all this: how do these machines from different companies find each other, and how do they know what each other can do? In short, it’s building a yellow pages and a DNS system for the world of agents. It lets your machine look up: “Oh, that company has an agent specifically for checking inventory, and its address is here.”

Sounds important. But here’s my first dose of cold water: this step is actually the least valuable part of the whole thing.

“Finding” is the least valuable part. “Why should I let you through the door” is the real hard part.

Think about it. A machine from a strange company comes knocking at your system’s door and says, “I’m the procurement agent from Company X, I need to check your real-time inventory.”

Then come three killer questions. First, how do you verify it’s really from Company X, and not some impostor wearing a mask to scrape your data? Second, even if it is real, how do you make sure it can only read and not modify, and won’t casually drag away your entire inventory table? Third, if it does do something bad, or if something goes wrong on your end, who’s accountable, how do you reconcile, where’s the evidence?

“Who are you” is identity. “What can you do” is permissions. “What did you do” is audit. These three things are what’s truly difficult, truly valuable, and truly decide who wins. Discovery is printing a yellow pages — anyone can do that. Identity, permissions, and audit are installing access control. Yellow pages are free; access control is where the business is.

There’s another overlooked bombshell here. The entire logic of today’s login and authorization system — OAuth, “Sign in with Google,” various pop-ups — fundamentally assumes that there’s always a human at the end who will stare at a screen and click “Allow.” But agents don’t have humans. For the millionth call at 3 AM, there’s no one there to click allow. So the real difficulty of this access control isn’t “recognizing who you are.” It’s how to achieve fine-grained, traceable, authorizable and revocable permission management — “you can do this, but not that” — in the absence of humans, in a millisecond-by-millisecond machine-to-machine interaction. This is something we basically don’t have today.

Dig deeper, and you realize this is an age-old problem that humanity has been dragging its feet on for millennia.

This is not a new problem at all. It’s a problem as old as the hills: how can two strangers who don’t know each other and have no common superior trust each other enough to do business?

The entire history of commerce is a bloody chronicle of “how to trust strangers.” Early on, it relied on a common king — you and I both recognized the king’s seal. Later, it relied on banks and letters of credit — you and I both trust HSBC, so we use an L/C issued by HSBC for settlement. Even later, it relied on platforms — Taobao guarantees for both buyers and sellers, Visa intermediates between you and the merchant.

See the pattern? For thousands of years, the answer has always been the same: insert a trusted third party that both sides believe in as an intermediary. The internet age hasn’t escaped this. When you “Sign in with WeChat” or “Sign in with Google” on a third-party website, essentially WeChat or Google is vouching for you. The technical term for this backer is IDP, Identity Provider. And whoever becomes the IDP gets to sit at the toll booth. Today, the identity of the entire internet is held by just a few companies.

The moment you cut across company boundaries, the knot appears: there is no common guarantor.

Apply this old formula to agents, and the knot immediately shows up.

Your company and your supplier’s company do not share a common IDP. You don’t log into the same Google domain, you’re not on the same intranet. You have nothing to do with each other in normal times. Machine-to-machine, cross-company, needs to be completed in milliseconds, with no human around to click “allow.” The traditional method of “find a mutually trusted intermediary” fails instantly at the company boundary. Pull in a common guarantor on the fly? For millions of calls, each pair of unfamiliar companies would need to find one — it’s simply impossible.

It’s precisely to solve this knot that the giants’ standard has brought a long-neglected piece of technology to the main table: DID, Decentralized Identifier. It also lists X.509 certificates and SPIFFE as veteran options, but those two share a fatal flaw: they both require a pre-existing “root” that everyone agrees on — a common Certificate Authority or a common trust domain. Only DID doesn’t need this common “parent.”

The most delicious dark humor: the pie Web3 baked for humans is being eaten by machines.

What is DID? In plain English: an identity you issue to yourself and prove cryptographically, without needing any central authority to stamp it. Think of it as a digital fingerprint that nobody can forge. You carry it with you, and wherever you go, the other party can instantly verify its authenticity without having to go register at some government office first.

This concept is not new at all. It’s the “self-sovereign identity” and “decentralized identity” that blockchain and Web3 shouted about for years. And then? It basically flopped, degraded into token-launching buzzwords for rug pulls, and regular people never used it.

Here’s the dark humor: the decentralized identity that crypto circles pitched to humans for over a decade, that nobody wanted, is likely to see its first real-world deployment on machines.

Why machines? Because humans always have a fallback. When push comes to shove, make a phone call to verify, send an email to confirm, or worst case, both parties just register a Google login and make do. Humans can settle. But machines can’t. Millions of cross-company calls, milliseconds, unattended — you can’t possibly arrange a common guarantor for every pair of unfamiliar companies. The human fallback solutions shatter at machine speed. At that point, an identity that is self-contained, self-proving, and asks no one for help wins, not because its ideology is lofty, but because it’s the only option that can still survive.

Remember this: it’s necessity, not faith, that pushed DID onto the table. This is the real information asymmetry: something dismissed as a Web3 joke is quietly being resurrected in the foundation of the agent world. And this time, it has a real, inescapable need.

The standard also has an even slicker trick up its sleeve: capabilities you don’t actually own.

It allows an agent to list for sale a capability it doesn’t inherently possess. It just knows “who has it” and has the right to connect you in, taking a cut along the way.

Think about what this means. In this world, the wall between “truly owning a capability” and “being able to rent a capability at any time” is leveled. Any agent can, in milliseconds, rent any capability from any company.

So what’s left of a company’s moat? It’s no longer “what can I do,” because that can be instantly rented from anywhere and has become commoditized. The only remaining barrier becomes: what am I trusted and authorized to handle. Companies like Snowflake and Databricks will see their real business shift from “storing your data for you” to becoming a licensed, trusted intermediary for agent data. In the end, trust and permission themselves become goods that can be priced and sold. Capabilities become cheaper by the day; trust is the hard currency of this era.

But don’t let the “giants jointly release a standard” headline fool you. Watch where they’re actually putting their effort.

I’ve said a lot, so let me pump the brakes so you don’t get too hyped.

When giants jointly release an “open standard,” nine times out of ten it’s land-grabbing, PR, or setting up a committee that never delivers. These so-called “epoch-making” standards that died on the vine over the years could form a mountain. This set of specs has only been out for two weeks and is still a draft. Almost nobody is running this agent identity system in production today. So the right posture is: don’t go all in. Don’t take it as gospel just because giants are backing it.

But there is one detail that helps you tell if this is real or empty: see where everyone is putting their muscle. If everyone at the press conference is hyping the “discovery” part — the sexy, headline-grabbing bit — while treating identity, permissions, and audit as grungy, unsexy plumbing, it’s mostly PR. Conversely, whoever is hunkered down chewing on the messy work of authentication, authorization, and audit is the one serious about this.

And there’s one more honest footnote to this: the ARD standard itself honestly only handles the “discovery” layer. When it comes to actual connection and identity verification, it explicitly says, “This part I don’t manage; you need to figure that out directly between yourselves.” In other words, even the standard admits it hasn’t touched the hardest part. Remember an old rule: in any real infrastructure change, the critical layer is always boring, dirty, and gets no applause. Where it’s boring, where the dirty work isn’t fought over, that’s often where the gold is buried.

Finally, zoom out to the widest angle.

What we’re actually doing is solving for machines a problem that humans haven’t solved cleanly in thousands of years: how two subjects who don’t know each other and have no common superior can establish trust in an instant, complete a transaction, and leave an irrevocable audit trail. Humans have circled this problem for millennia with kings, banks, and platforms, always falling back on “insert an intermediary.”

The interesting part is this: what’s pushing us forward isn’t some noble ideal. It’s the impatience of machines. Humans can make do with sloppy solutions; machines cannot. If they settle, it means millions of errors and vulnerabilities. So to serve these machines that won’t wait, don’t sleep, and command each other in milliseconds, we are being forced to maybe finally truly solve this ancient problem.

So in the next few years, what’s worth watching isn’t which model scored two more points on a benchmark. It’s this foundation — how machines trust each other — and who pours it, and with what material. Whoever lays that foundation holds the faucet for the entire agent economy.

This war has already started. It’s just not sexy enough, so nobody is applauding yet. And you know the old rule: where nobody’s clapping is where money and power are really changing hands.