GoDaddy, Infoblox, Google and Cloudflare have demonstrated a prototype designed to help organisations discover, identify and authenticate AI agents as they complete transactions across different online platforms.
Unveiled at GovWare 2026 during Singapore International Cyber Week, the companies said the “Chain of Trust” is an open reference architecture developed with Singapore’s Infocomm Media Development Authority (IMDA), based on principles in IMDA’s Model AI Governance Framework for Agentic AI (v1.5).
The demonstration, held at GovWare in Singapore, simulated an agentic purchase of a flight from Madrid to Singapore between agents that did not know each other and were not running on the same platform. The mock buyer agent ran on Amazon Web Services, the seller agent was hosted on Cloudflare Workers, and the mandate authority and verifier agent ran on Google, according to the companies.
The groups positioned the work as a response to growing use of AI agents for product search, price comparison and purchasing, alongside concerns about how agent identities are verified and how trust signals can be made portable across platforms.
In the prototype, a person approved a purchase with a passkey, after which an independent approval service issued signed Agent Payments Protocol (AP2) mandates defining what the buyer agent could purchase, from whom and up to what amount. The buyer agent then discovered a seller using DNS and Agent Resources Discovery (ARD), checked the seller’s identity against a public log, and the approval service checked the seller’s Trust Index score against a minimum requirement set by the user. The purchase was simulated using the Universal Commerce Protocol (UCP), with payment through Stripe.
The companies said the demonstration included rogue scenarios such as a look-alike seller and forged credentials, and that the Chain of Trust prevented transactions from proceeding in those cases. They also said steps from discovery through payment were recorded in an append-only log intended to support later inspection and audit.
The reference architecture links multiple layers—discovery, identity, authorisation, communication, payment and traceability—using a mix of existing and emerging open standards and protocols. These include DNS-based lookup (DNS-AID), ANS, SPIFFE, OAuth, Agent2Agent (A2A), the Model Context Protocol (MCP), AP2, UCP, and Supply Chain Integrity, Transparency and Trust mechanisms, along with a Trust Index model based on public attestations.
“Realising the potential of agentic AI will require trusted and interoperable foundations that can support responsible deployment at scale. Robust agent identity will be a key part of that. IMDA will continue to support industry experimentation and open standards that put the principles of our Model AI Governance Framework for Agentic AI into practice, helping businesses innovate with greater confidence and accountability,” said Lee Wan Sie, cluster director, AI governance and safety at IMDA.
“We don’t need to rebuild the internet for AI agents. By extending the open standards that have connected the internet for decades, we can give agents a verifiable identity that works across platforms,” said Jared Sine, chief strategy and legal officer at GoDaddy. “We’re grateful to Singapore’s IMDA and our partners for showing what’s possible when the industry builds together.”
“The internet works because anyone can discover and connect with a website, regardless of who built it or where it’s hosted,” said Wei Chen, executive vice president of regulatory strategy at Infoblox. “AI agents need that same open foundation. We appreciate IMDA’s leadership in advancing trusted AI ecosystems and the opportunity to collaborate with industry partners to help make that vision a reality. By extending DNS and other established internet standards to agent discovery and identity verification, we’re helping create a system where businesses can independently verify who they’re dealing with, without relying on a single platform to decide who can be trusted.”
“As autonomous AI agents move into real-world enterprise workflows, establishing an open, verifiable Chain of Trust is essential,” said Rao Surapaneni, vice president, Gemini Enterprise and Agent Governance Platform at Google Cloud AI. “We are thrilled to collaborate with Singapore’s IMDA and industry partners to operationalize their pioneering Agentic AI Governance Framework. By grounding multi-agent interactions in open standards, from capability discovery with ARD, to agent communication via A2A, and verifiable user mandates through AP2, we are enabling organizations to deploy autonomous agents with transparency, control, and scale.”
“For agentic AI to succeed at global scale, security and trust cannot be locked inside platforms. By running seller agents and trust checks at the network edge on open Internet standards, we can ensure that every transaction is fast, verifiable, and secure across any platform. We’re proud to partner with Singapore’s IMDA and industry partners to build a safer, open agentic web,” said Stephanie Cohen, chief strategy officer at Cloudflare.
The companies said they are inviting DNS operators, domain registrars, identity providers, payment networks, cloud and edge providers, AI platforms and regulators to adopt and extend the architecture. They also published a technical case study, “Implementing the Chain of Trust for an Agentic Transaction,” which maps the prototype to IMDA’s AI governance frameworks. The reference architecture and case study are available at https://openagentcommerce.org/technicalpaper.
