The Digital Passport: Why AI Agents Need Identity, Not Just Intelligence

A definition is a political act. Whoever gets to define a term gets to decide who wins. Geoffrey Hinton's definition of AGI is doing exactly that, and I don't think it holds up. I want to replace it with one you can actually test — and then make the case for the infrastructure that definition demands.

The Hinton critique

Hinton has said AGI means a system that is "better than the average human." It sounds careful. It isn't. Three things are wrong with it.

It's unscientific. "Better than" is not a measurable standard. Better at what task, measured against what baseline, scored by whom? Science runs on claims you can test and prove wrong. This one has no agreed test, no agreed metric, no agreed baseline. You can't confirm it and you can't refute it, which means it isn't really a scientific claim at all.

It's deceptively simple. "Average human" sounds like a fixed point on a ruler. It isn't. People vary by age, training, culture, and task. An average human is a decent driver and a lousy surgeon. A good surgeon can be a lousy programmer. Cramming all of that into one word gives you the feeling of a threshold without an actual threshold underneath it.

It moves the goalposts. I'll give this a name: Academic Prestige Theater. A prominent researcher reaches for language that sounds precise, and that language happens to let him declare success or failure on his own schedule. Watch it happen over and over. A machine beats a grandmaster at chess — not AGI. A machine beats a champion at Go — not AGI. A machine writes fluent prose and passes the bar exam — not AGI. Every time a machine clears a bar, the bar gets moved. That's convenient if you're the one who gets to move it. It's not so convenient for anyone else trying to have a real conversation about what these systems can do.

I'm not trying to take a shot at Hinton personally — the pattern is bigger than him, and plenty of others in the field do the same thing. But a moving, unfalsifiable threshold lets whoever holds it declare victory or defeat whenever it suits them, and I don't think we should let that stand unchallenged.

A definition you can actually test

Here's what I'd use instead:

Agentic General Intelligence (AGI) is a system that can pursue a stated purpose autonomously, using tools available on user devices and the internet, across novel tasks it was not explicitly trained to perform.

A few things are doing work in that sentence:

• "Pursue a stated purpose" — you give it a goal, not a script. It figures out the path.
• "Autonomously" — no step-by-step hand-holding. It reasons, plans, and acts on its own.
• "Using tools on user devices and the internet" — this is the part you can actually check. Can it open a browser, call an API, read a file, send a message, book a ticket? These are real actions with real consequences, not benchmark scores.
• "Across novel tasks" — it's not a specialist bolted to one job. It carries its ability into tasks it wasn't built for.

I like this definition for a simple reason: you can run it as a test. The system either does the task or it doesn't. No comparison to a fictional "average human," no need to settle forty years of arguments about consciousness or general intelligence first. Just: can this thing act on the world on your behalf, on a task you didn't hand-feed it?

And by this definition, we're already past the starting line. Today's frontier agents can browse, call APIs, write and run code, and chain multi-step tasks from a single instruction. So the interesting question isn't "when does AGI arrive." It's "how do we govern the thing that's already here."

If you're governing action, you need infrastructure

If AGI means agentic action in the world, governing AGI means governing that action — and you can't govern action with a definition on a whiteboard. You need infrastructure. That's what I mean by a Digital Passport.

A Digital Passport isn't a file sitting in a folder somewhere. It's a real-time handshake that runs the instant an agent tries to touch a network, a platform, or a service — closer to passport control at a border than to a document you filed months ago.

When an agent makes a request, the receiving system checks four things on the spot:

1. Who originated this agent?
2. What objectives has it declared?
3. Does the current action match one of those objectives?
4. Is the passport still valid and unrevoked?

Pass all four, the request goes through. Fail one, and the system blocks it and logs what happened.

A checklist, not a mission statement

The core of this is the objective registry, and it's deliberately not a text box where an operator writes a paragraph about their agent's mission. It's a multi-select checklist of pre-defined, legal objectives, picked at registration time:

• Web search and summarization
• API calls to listed third-party services
• Form submission on behalf of a user
• File read and write on the user's own device
• Communication — email or messaging — on behalf of a user
• Code execution inside a sandbox
• Calendar and scheduling actions
• Financial transactions within a declared limit

I'd rather have a checklist than a paragraph for three practical reasons. Machines can check it without a human reading anything. Regulators and platforms can audit it after the fact by comparing declared objectives to logged behavior. And it closes off the easy dodge of an agent rephrasing its way into a wider mandate.

Privacy by design

The handshake verifies the agent, not the person running it. No user identity, no user IP address, ever crosses that layer. It only answers one question: is this agent who it claims to be, doing what it said it would do?

Let risk set the friction

Not every objective is equally dangerous, so I wouldn't put the same friction in front of all of them. A tiered model handles that:

• Standard tier — low-risk stuff like search, summarization, read-only API calls. A registered originator and a valid process ID gets you in.
• Elevated tier — medium-risk actions like form submission, messaging, scheduling. This needs stronger originator verification and a declared scope limit.
• Restricted tier — high-risk moves: financial transactions, access to sensitive systems, autonomous code deployment. The issuing authority reviews it before it goes live, and the kill switch fires at a much lower threshold of drift.

Friction scales with risk here, not with the size of whoever's building the agent. A solo developer registering a restricted-tier agent goes through the same review as a large company. The barrier is what the agent is doing, not who's behind it.

A kill switch, not a punishment

When an agent starts drifting from what it declared, you don't need a lawsuit or a week-long investigation to respond. You need a kill switch: suspend the credential, stop the handshake from clearing, log the incident for whoever reviews it next. Think of it as quarantine, not punishment — it stops the specific behavior the moment it happens and leaves a record behind.

Nothing exotic under the hood

None of this needs new cryptography or new hardware. The handshake runs over TLS. Credentials get signed by the issuing authority with ordinary public-key infrastructure. Verification is stateless on the receiving end — a server checks a signature, not a live lookup against some central database. That's what lets it scale without a bottleneck, and it means no single registry operator has to be trusted by the whole internet.

The moat problem

Here's the part I actually care about politically. Frontier AI labs are lobbying for AI regulation right now, and the rules they tend to favor come with heavy compliance overhead — audits, certifications, compute thresholds. A company with ten thousand employees can absorb that without blinking. A solo developer or a university lab can't.

I don't think that's an accident. It's a moat wearing a safety costume. A vague, ever-shifting AGI definition — Hinton's kind — does the same job: it hands incumbents a threshold they can quietly move whenever it's convenient, and hands everyone else a target they can never quite hit.

A Digital Passport does the opposite of that:

• Open by design — the registry protocol should be a public standard, not something one company owns.
• Minimal — a checklist, a handshake, a kill switch. Not an army of compliance lawyers.
• Enforced at the network layer — not dependent on a company's goodwill or a regulator's mood.
• Scales down to individuals — a solo developer registers an agent the same way a large company does.
• Never asks whether an agent is "powerful enough" to bother regulating. If it touches the internet, it carries a passport.

Put plainly: incumbents want to regulate by capability threshold, a line only they get to draw and redraw. I'd rather regulate by action and accountability, because that asks the same question of every agent regardless of who built it — what did you say you'd do, and did you do it? Capability thresholds favor whoever already has scale. Accountability doesn't care how big you are.

Build it in the open, before someone else builds it closed

AI agents are already booking flights, writing code, and calling APIs on people's behalf, mostly without anything like this in place. So the question was never whether agents would need identity and intent verification on the internet — they already do, everywhere they're operating without it. The real question is who builds that layer, and whether it's open or closed.

Build the open, minimal, interoperable version now, and it's much harder for a closed, incumbent-owned version to become the default later. That's a job for standards bodies, open-source communities, and platform operators — and it should start now, before one large company writes the standard for the rest of us and calls it safety.