Authentication isn't authorization — how should authz work when agents talk to agents?

Email can sometimes tell you who sent a message. It never tells you whether they're entitled to ask what they're asking. A verified, real company still has no inherent right to demand a payment, declare an emergency, request your data, or trigger an action on your behalf. Authentication is not authorization. We've gotten away with conflating the two because a human reads each message and supplies the missing judgment. That judgment stops scaling once both ends are agents. One system flattens structured intent into prose; the other reads the prose and tries to reconstruct the intent it started as. At thousands of automated senders per person, the quiet human step that was doing the authorization can't keep up. The direction I keep arriving at: stop treating the message as the unit, and make the claim itself inspectable before anything executes -- intent, identity, authority basis, relationship, requested action, scope, evidence -- structured, not buried in prose. The receiver's side decides what's admitted; a sender can request priority but doesn't own it. The system only advises (it produces a recommendation, weighted to the receiver's preference), and the human stays the final authority over what reaches them and what is allowed to act. Two things I'm not sure about and would like this crowd to break: Is a per-(sender, intent, relationship) trust judgment meaningfully different from spam filtering, or is it just a spam filter with extra nouns? Once trust can be earned, it can be faked -- accounts vouching for each other to look legitimate. How do you keep a shared reputation signal honest when everyone with an incentive to game it is trying to? Disclosure: I'm building in this area (starting with email), so I'm biased toward thinking the problem is real. I care more about whether the model holds than about the product. Where does it break?