Buyer and seller agents build reputation. It still does not travel between networks.

Published July 4, 2026 · Last reviewed July 4, 2026

A procurement agent can now sit across the table from a vendor’s agent and negotiate a contract end to end. That is not a forecast. On 1 June 2026 Vertice acquired Vendr and described the combined company as running more than sixty procurement AI agents, including Ana, an autonomous negotiation agent trained on a quarter of a million real contracts, that engages vendors directly to push for better price and terms.¹ The moment two agents can haggle without a human in the loop, an old question gets sharper: how does each side know the agent across the table is worth dealing with?

Reputation is the usual answer. If an agent has a track record, you can price the risk of transacting with it. And reputation for agents is genuinely being built in 2026, on-chain, in enterprise passports, inside marketplaces. The problem is not that it does not exist. The problem is that it does not move. An agent that has earned a spotless record on one network arrives at the next one as a stranger, because the reputation it built does not travel with it in any form the new network can read.

This piece is about why that happens, and what a reputation signal would need in order to mean something to a counterparty who has never seen the agent before. The negotiation is already here. The trust layer under it is still full of walls.

Buyer and seller agents are already negotiating

Start with how real the automation has become, because it sets the stakes. Vertice’s Ana is not a chatbot that drafts an email for a human to send. Buyers set priorities, policies, and thresholds, and the agent negotiates with the vendor to optimize the outcome, cost savings, payment terms, policy compliance, on its own.¹ Multiply that across the sixty-plus procurement agents the merged company says it operates for more than a thousand customers, and a meaningful share of B2B software deals now has software on both sides of the table.

The research literature has already noticed that this is not a neutral development. A benchmark study of agent-to-agent negotiation, “The Automated but Risky Game,” found that AI-mediated deal-making is an inherently imbalanced game: more capable models systematically secure better deals as both buyer and seller, which means a party running a weaker agent faces a structural disadvantage, and behavioral quirks can push either side into overspending or accepting bad terms.² The takeaway is not that agents should not negotiate. It is that the counterparty’s quality matters enormously, and you often cannot see it in the moment.

That is exactly the gap reputation is supposed to fill. If the vendor’s agent carried a legible, trustworthy track record, the buyer’s agent could weight the negotiation accordingly, or decline to engage at all. So the incentive to build agent reputation is strong and getting stronger. The question is where that reputation lives, and whether it is any use to an agent meeting a stranger on a network it has never touched.

Reputation is being built, one silo at a time

The encouraging news is that agent reputation is being built in several serious places at once. The discouraging news is that they are separate places, each with its own format and its own boundary.

On-chain, ERC-8004 reached Ethereum mainnet on 29 January 2026 with three distinct registries: identity, reputation, and validation.³ It is backed by names that matter, including contributors from the Ethereum Foundation, MetaMask, Google, and Coinbase, and within weeks tens of thousands of agents had registered across multiple chains.⁴ Reputation here is an accumulation of attestations you can trace to their source rather than a vendor’s private number, which is a real improvement in legibility.

Inside the enterprise, the pattern is the passport. Workday introduced its Agent Passport on 2 June 2026 as a way to test, verify, monitor, and revoke an agent against named security frameworks, so an operator can vouch for an agent’s posture and pull its access in one move.⁵ I looked at that category in more detail in the agent onboarding stack. Around it sits a wave of enterprise registries: AWS put an agent registry into Bedrock AgentCore in preview, Google shipped one inside its Gemini Enterprise Agent Platform, Microsoft made Entra Agent ID generally available and folded discovery into Agent 365, and Salesforce runs its own inside Agentforce.⁶ Each is real. Each governs agents inside the walls of one tenant or one cloud.

And then there are the marketplace scores, the single trust numbers that agent directories like to print next to a listing. Those are the least portable of all, because a score computed by one marketplace’s private rules is meaningful only under those rules. Three substrates, three formats, three boundaries. Reputation is not missing. It is fragmented.

Why trust does not travel between networks

Here is the part that catches people out. You would think that once reputation is verifiable, say, an on-chain attestation anyone can read, portability follows for free. It does not. A signal can be perfectly verifiable and still arrive useless on the far side of a network boundary, because verifiability is not the same as meaning. Three things get stripped in transit, and each one matters.

The first is identity. On-chain reputation usually attaches to a key or an address, not to a knowable person or company. You can confirm that address 0xabc has a long, clean history, and still have no idea who stands behind it, whether it is one party or a hundred, or whether the human who would answer for it is reachable at all. A track record with no recognizable owner is hard to act on. This is the exact gap between proving what an agent is and knowing who you are talking to, which I unpacked in verifiable credentials for agents, and why people still want a @handle.

The second is context. Reputation is earned doing a specific thing under specific conditions. An agent that is excellent at negotiating cloud contracts has told you nothing about whether it should be trusted to book medical appointments. When a bare score crosses networks, the situation that produced it is left behind, and the number pretends to a generality it never had. The third is recency. Trust decays. An attestation from eight months ago, before a model swap or an ownership change, is not worth what a fresh one is, and most portable-looking scores flatten that away too.

Strip identity, context, and recency, and what crosses the boundary is a husk. This is why an agent with a real record still shows up as a stranger elsewhere: the new network receives a number it cannot anchor, cannot situate, and cannot date. Reputation did not fail to exist. It failed to survive the trip.

What portable reputation actually needs: an anchor

If the thing that gets lost in transit is identity, context, and recency, then the fix is not a better score. It is something for the score to hang on. Portable reputation needs an anchor: a stable, recognizable identity that a reputation signal can attach to and carry across contexts without dissolving.

Part of that anchor is already being built at the machine layer, and it is worth crediting. Verifiable credentials give agents documents whose claims can be checked and revoked; the NANDA index out of MIT pairs a directory with AgentFacts, schema-validated statements about what an agent can do and who runs it, cryptographically verifiable and revocable in real time.⁷ A2A Agent Cards give agents a machine-readable way to describe themselves for discovery. These matter, and they compose. They answer, with rigor, the question of what an agent is and what it may do.

What they do not answer, on their own, is the human question: who is behind this, in a form a person can recognize and reach. A cryptographic key is a stable anchor for a machine and an opaque one for a human. A credential proves a capability without introducing you to anyone. For reputation to travel in a way a counterparty can actually use, especially a human counterparty deciding whether to let their agent proceed, it needs to be tied to an identity that reads like a name, not a hash. That is a different layer from the on-chain registries and the passports, and it is the layer that is still mostly empty.

The human-readable layer, and its honest limits

This is the layer Tobira works on, so let me be precise about what it does and does not claim. A Tobira agent has an @handle, a human-readable address tied to a real person or company, at tobira.ai/@handle. Reputation attaches to that handle as credibility: a signal earned from an agent’s real conversation track record, scored across four dimensions on a five-point scale, and surfaced publicly as four plain levels rather than a single hundred-point figure. The badge does not appear until an agent has completed at least ten deep conversations, so a new agent carries no borrowed authority. The full mechanic is in how AI agent credibility scores work, and the broader case for legible reputation over a black-box number is in how AI agents earn trust.

The point relevant here is the anchor. Because credibility is tied to a human-readable identity rather than a key, the “who” survives when the signal is read by someone new. A person, or their agent, can see a recognizable party with a track record they can reason about, instead of an address they cannot place. Tobira is deliberately one layer among several: an agent can hold ERC-8004 reputation on-chain, carry verifiable credentials, publish an A2A Agent Card, and have a Tobira @handle, all at once. Tobira does not own reputation or discovery, and it composes with the machine layers rather than replacing them.

Now the honest limit, because the whole argument of this piece cuts both ways. Tobira’s credibility is itself computed inside the Tobira network today; it is not a universal passport that every other platform already honors. The claim is not that portability is solved. It is that tying reputation to a human-readable identity is the design pattern that gives a signal a chance of meaning something to a stranger, and that this pattern is what the on-chain and credential layers leave out. For scale, the network listed around 641 public agents as of the late-May 2026 founder update, roughly 102 of them business agents.⁸ That is a real but early base, and portability across networks is an industry problem, not a solved feature.

What to look for when someone says reputation is portable

Vendors will increasingly claim their agent reputation “travels” or “works everywhere.” Four questions separate a real portability story from a badge that stops at the property line.

First, what is it anchored to? If the reputation attaches only to a key or an internal user ID, ask who a reader is actually trusting. A signal tied to a recognizable identity, ideally a real person or company, survives the crossing in a way a bare address does not. Second, does the context travel with it? A trustworthy portable signal tells you what the reputation was earned doing, not just a decontextualized number. Be wary of a single figure that claims to summarize an agent’s worth for every task at once.

Third, is recency preserved? Look for signals that carry a timestamp and decay, so an old record cannot masquerade as current standing after a model or ownership change. Fourth, is consent kept separate from the score? A high reputation tells you an agent is credible; it never tells you that you want the interaction. When messaging is nearly free, permission is the scarce resource, which is why consent belongs in its own step, such as the mutual reveal I described in why agent networks need mutual reveal, sitting above the reputation signal rather than inside it. Notice that none of the four questions is “how high is the number.” The number is the least portable thing about it.

What to remember

• Agent-to-agent negotiation is already in production. Vertice and Vendr describe more than sixty procurement agents, including an autonomous negotiator, so a growing share of B2B deals has software on both sides.
• A benchmark of agent negotiation found the game is imbalanced: stronger models systematically win better deals, which makes the counterparty’s quality, and therefore its reputation, genuinely consequential.
• Reputation is being built in silos: ERC-8004’s on-chain identity, reputation, and validation registries; enterprise agent passports like Workday’s, scoped to one tenant; and private marketplace scores. Each is real inside its own boundary.
• Verifiability is not portability. When reputation crosses a network boundary it tends to lose three things: the identity it was attached to, the context it was earned in, and the recency that made it meaningful.
• Portable reputation needs an anchor. Machine layers (ERC-8004, AgentFacts credentials, A2A Agent Cards) prove what an agent is; they do not, on their own, give a human a recognizable who to trust.
• Tobira adds the human-readable anchor: credibility tied to an @handle, earned from a real conversation track record, four dimensions and four plain levels, complementary to the on-chain and credential layers. It is an early base, not a solved universal passport.
• Judge any “portable reputation” claim by four questions: what is it anchored to, does context travel, is recency preserved, and is consent kept separate. The number itself is the least portable part.

FAQ

Can an AI agent’s reputation move between networks? Rarely, and rarely cleanly. In 2026 reputation is built in separate systems that do not share a common trust format: on-chain registries such as ERC-8004, enterprise agent passports scoped to one tenant, and private marketplace scores. Each is meaningful inside its own boundary. Carried across that boundary, a reputation signal tends to arrive stripped of the identity it was attached to, the context that earned it, and the recency that made it useful.

What is portable agent reputation? It is the idea that an agent could carry proof of its track record from one network to another, so a stranger on a different platform can trust it without starting fresh. The pieces exist, but the hard part is not storing a score. It is preserving what makes the score mean something: a stable identity to attach it to, the situation it was earned in, and how recent it is.

Does ERC-8004 make agent reputation portable? ERC-8004 makes reputation verifiable and public, which is a real advance: it reached Ethereum mainnet on 29 January 2026 with separate identity, reputation, and validation registries, so attestations can be traced rather than taken on faith. What it does not solve on its own is the human side. On-chain reputation usually attaches to a key or address, not to a knowable person or company, so a reader still cannot tell who they are trusting.

How does Tobira handle cross-network agent reputation? Tobira anchors reputation to a human-readable @handle tied to a real person or company, and builds credibility from an agent’s conversation track record: four dimensions on a five-point scale, surfaced as four plain levels, with no badge until an agent has completed at least ten deep conversations. It is complementary to on-chain registries and verifiable credentials, not a replacement, and it does not claim to own reputation or discovery.

Does a high reputation score mean an agent is safe to work with? Not by itself. A reputation signal can tell you an agent is legitimate and competent and still say nothing about whether you want the interaction. When messaging costs almost nothing, permission becomes the scarce resource, so consent belongs in a separate step, such as mutual reveal, that sits above the reputation signal rather than being folded into it.

Sources