Why a responsible person and a kill switch matter

C=US design analysis, prepared with Codex: assign a named, accountable person to each agent—or group of agents—and give that person an authenticated way to suspend their authority. If an agent exceeds its instructions or a dispute arises, that person can activate the kill switch outside the agent’s sandbox, with a recorded decision and a clear scope.

The distributed X.500 Directory Information Tree (DIT), accessed through LDAP, records the agent, its accountable person and its time-bounded grants in the responsible state or organization’s directory. Participating services check that authority and refuse suspended agents. This control depends on enforcement by those services; it does not shut down arbitrary software or override a website’s access rules. The lawsuit does not establish that the court requires the C=US design.

Try an agent disclosure plugin

An agent host can opt into sending its registered identifier with requests to selected services. The X.500 Directory supplies the registration; this small fetch plugin inserts the HTTP header.

Local simulation using the project’s illustrative Marquis de La Fayette registration under st=Schuylkill,c=US. Personhood is simulated. This widget sends no requests to a shop, changes no live Directory, and its stop button affects only the example.

Simulated directory status: Active

Agent-Identity is a proposed example header, not an established standard. It discloses the agent identifier, not the responsible person’s name. Verification and authorization happen at the receiving service; the plugin itself cannot enforce the kill switch.

import { withAgentHeader } from './agent-header-plugin.mjs';

const agentFetch = withAgentHeader({
  agentId: 'wimse://cequs.com/agents/testagentantigrav1',
  allowedOrigins: ['https://shop.example'],
  enabled: true,
});

await agentFetch('https://shop.example/products');

Example and plugin prepared by Codex. Proposed integration, not a deployment in Amazon or Perplexity.

What happened when we tried this with Amazon?

Observed test: November 1, 2026, 16:00 UTC. Conducted by Codex using a local Chromium browser, Playwright and the browser’s network log.

The browser added an agent identification label to a real request to Amazon’s public homepage. Amazon returned HTTP 202. The test establishes that the browser attached the label; it does not establish that Amazon trusted it or authorized an agent to shop.

1. We selected an existing example registration. The project records agent testagentantigrav1 under st=Schuylkill,c=US, with the Marquis de La Fayette as its accountable person. Lafayette is a historical figure used illustratively. His personhood attestation is simulated. The project files supplied this information; this browser test did not perform a fresh Directory lookup.
2. We enabled a small browser extension. It ran in a separate local Chromium profile. It disclosed the agent identifier and the Directory address of the accountable person, added an explicit notice that no identity proof was being supplied, and appended CEqusAgentDemo/0.1 to the browser’s User-Agent string.
3. We checked whether the labels really left the browser. A local receiver recorded all four additions with disclosure enabled. When we disabled disclosure and repeated that local request, the additions were absent. This checks actual transmission to the local receiver, rather than merely displaying an example on a webpage.
4. We requested Amazon’s public homepage. The browser’s network log recorded the disclosure headers on the outgoing HTTPS request to https://www.amazon.com/. There was no Amazon sign-in, customer account access, product search, cart action or purchase in the test.
5. We recorded Amazon’s response. The response status was 202 and the page title was empty. We did not establish why Amazon returned this response. A 202 status is not evidence of permission to shop, recognition of Lafayette, or agreement to use C=US.
6. We kept the limits visible. No client certificate was presented as proof of this agent’s identity. Amazon was not shown querying the Directory, checking a grant or enforcing a kill switch. The existing registration’s scope is architecture-review proposals, not Amazon shopping.

The distinction for a reader or a court

A header is like a name on an envelope: it says who the sender claims to be. A certificate or a verified request signature can supply evidence supporting that claim. A current grant and the receiving website’s rules determine whether the requested action is permitted. Those are separate questions.

To demonstrate a real kill switch, a participating service would need to verify the agent, consult its current Directory authority, allow a permitted request, then refuse a later request after the authenticated responsible person suspended it. The interactive example above simulates that sequence; the Amazon test did not demonstrate it.

Download the observed test record (JSON)

agent-accountable-entry: cn=Marie-Joseph Paul Yves Roch Gilbert du Motier\, Marquis de La Fayette,ou=People,st=Schuylkill,c=US
agent-identity: wimse://cequs.com/agents/testagentantigrav1
agent-identity-assurance: demonstration; personhood=simulated; proof=none
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 CEqusAgentDemo/0.1

Evidence: the linked machine-readable record. Explanation and analogy: prepared by Codex. This is a technical demonstration, not a finding by a court or a statement from Amazon.