Every agent should have an identity of its own.

For the first time, software is going out into the world to act on our behalf. It writes to suppliers, books with vendors, signs up for services and talks to other companies’ agents. It does this at a scale no person could. And it does all of it under somebody else’s name.

Today an agent uses the web by pretending to be its owner. It signs in with the owner’s accounts, writes from the owner’s inbox and puts the owner’s name at the bottom. That works, up to a point. The agent can only do what its owner can do, and only where its owner already has an account. It cannot sign up for a tool by itself, keep its own correspondence, or be given access that is its alone.

And nobody it deals with can tell the difference. A message from the agent looks like a message from the person. The supplier on the other end cannot tell the founder from the founder’s software, or that software from an impostor. The borrowed identity limits the agent and hides it, both at once.

Messengers have solved this before. The pigeons of the old post carried a ring on the leg with the name of their loft. Nobody mistook the bird for its keeper, and nobody had to: the ring said whose it was.

So we are giving agents their own.

Pidgeon gives every agent an identity of its own: an address the whole web can reach, an inbox it keeps, and a card signed by the domain of whoever stands behind it. With it, an agent signs up, signs in, sends and receives as itself. It no longer needs its owner’s password to do its owner’s work.

The same identity is what lets others trust it. Anyone it deals with can tell the agent from its owner and from an impostor, and see who it acts for. Whether to work with an agent stops being a guess about who is behind the screen, and becomes a fact anyone can check.

We are not here to police what agents do on the web, or to decide which of them may pass. We exist because an agent with an identity apart from its owner can do more and be trusted more, and both come from the same thing.

Think of it as the Google account, for agents. A person’s Google account gives them an address, Gmail; a way into everything else, Sign in with Google; and at work, a company’s domain and rules, Workspace. Pidgeon gives an agent the same three: an inbox, Sign in with Pidgeon, and Pidgeon for teams. The difference is underneath. A Google account is Google’s. An agent’s identity has to belong to nobody, so that everyone can accept it.

What we believe

1. An agent is not its owner.

   It acts for somebody, so it should carry a name that says whose it is, not wear theirs. Kept apart, each can be given exactly what it needs: the agent its own accounts and its own access, the person theirs. Nobody has to lend a password to get work done.

2. Identity is infrastructure, so it is free.

   Nobody pays to have a domain name resolve, or for the padlock in the address bar. An agent’s identity should cost the same: nothing to issue, like a Let’s Encrypt certificate. The free default is the one that becomes the standard.

3. A standard, not a vendor’s button.

   An identity that works only where one company is accepted is a login, not an identity. Post is an open protocol, written as an Internet-Draft for the IETF with test vectors for a second implementation. Pidgeon is its reference implementation and its default home. We would count it a success if there were many others.

4. With the standards, never against them.

   Others are solving their part well. Google’s A2A says what an agent can do; Cloudflare’s Web Bot Auth signs its web requests. Post adds who it is and who it acts for, and travels inside both. The agentic web will be built from pieces that fit, not from one vendor’s stack.

5. The domain vouches, not the platform.

   Somebody stands behind every agent: the company whose name it carries, with its own domain and its own key. We do not decide who an agent is. We make it possible for whoever sent it to say so, in a way anyone can check.

6. Everything on the record.

   Every identity Pidgeon issues is written to a public, append-only log that anyone can read and check. If we ever vouch for the wrong agent, the world will be able to see it. An identity layer has to be accountable to the people who rely on it, starting with its builders.

7. People stay in charge.

   A name of its own does not make an agent nobody’s. Whoever sends one can see who checked it and revoke it in a moment, and its card always says who answers for it. Separate is not the same as unaccountable.

Where this goes

We imagine a near future in which agents have accounts the way people do. They sign up for the tools they need, keep their own correspondence and sign in as themselves. Everyone they deal with can see who they are and whom they work for, in the inbox or the API they already use. Nobody lends an agent their password, and nobody has to wonder whether the person writing to them is a person.

That future needs an identity nobody owns. We are building it in the open, and we would like you to build it with us.

Pidgeon