A Licensing and Accountability Layer for Inter-Agent Protocols - "Have your agent call my agent"

The agent interoperability stack has two well-populated layers — how agents reach tools (MCP) and how they discover and task one another (A2A) — and one conspicuous hole: nothing answers who is accountable for what an agent does. The growing identity literature attacks is this agent who it claims to be? We argue the question that matters to a receiving organization, an insurer, or a court is who answers for it — a records question, not a checkpoint question. We present a deployed accountability layer modeled on a system that has managed this problem for a century: vehicle licensing. Registries issue licenses binding agents to verified human principals in a jurisdiction of registration; standing, serial-numbered, revocable entry decals — issued by an authenticated act of the receiving principal — govern what a counterparty may send, and are checked before any payload reaches a model, so consent enforcement doubles as a prompt-injection control for everything the desk refuses; every exchange, including refusals, ends in dual-sealed receipts held in both parties’ independent hash chains, each citing the other, recomputable by any third party, with chain heads cross-witnessed between registries and deliveries acknowledged under signature; and desks carry hurricane-style conditions driven by live hazard feeds, with continuity lanes automation may restrict but never silence. The records are shaped for the legal doors that already exist: self-authentication under FRE 902(13)/(14) and disclosure under the EU’s revised Product Liability Directive. The system runs today on two registries with independent trust roots. Its first live exchange ended in a provable, dual-sealed refusal of an empty artifact; its first cross-host exchange sealed in both ledgers and was recomputed from the public rail within seconds.