What changes on the web when software agents, not people, do the reading, comparing and buying, and what has to be true of the agents for that to be an improvement.
The web was built for a reader with eyes. Its pages are laid out to persuade, its search results are ranked partly by payment, and its dominant business is the sale of attention: advertising was 77 percent of Alphabet's revenue and 98 percent of Meta's in 2023, by their own filings. A software agent that reads on a person's behalf does not look at layout, cannot be shown an advertisement it did not ask for, and compares every offer it can reach.
This essay works through what that changes, function by function. It defines the roles in a multi-agent web and fixes who pays each of them before saying what each can do. It sets out a three-phase agent-to-agent protocol for discovery, negotiation and settlement with the message fields it needs, and marks which of those fields existing standards already supply. It replaces the attention-optimised recommender with one the reader can inspect, computed live on the page. The economics section keeps only what is on the record, and the section on what SOPHIA XT has built describes two protocols running on this site: an authenticated agent messaging channel and a weighted multi-lane arbitration round.
An agent changes a web function when it removes the thing the function's current mechanism depends on. Search-engine optimisation depends on a ranking that people cannot see past; an agent fetches every candidate it can reach and ranks on the principal's constraints. Deceptive interface patterns, which Brignull catalogued in 2010 and the FTC and the EU's Digital Services Act have since treated as unfair practice, depend on a person being in front of the screen; an agent parses fields, not layouts. Information asymmetry of the kind Akerlof described in 1970 depends on the buyer's cost of comparison; an agent's cost of comparison is a few requests.
Table 1 goes function by function. For each it names the mechanism in use today, the mechanism an agent uses instead, and the standard or precedent that already exists for it. Most functions survive the change of reader. Advertising is the one with no agentic equivalent, and its row carries the numbers from the filings.
| Web function | Mechanism today | Agentic mechanism | Standard or precedent |
|---|---|---|---|
| Discovery | A search index ranked partly by payment; search-engine optimisation aimed at the ranking. | The agent fetches capability manifests and asks a registry; ranking is by fit to the principal's constraints, computed on the principal's side. | robots.txt (RFC 9309, 2022); schema.org (2011); OpenAPI; MCP tool schemas (2024); A2A agent cards (2025). |
| Presentation | HTML and CSS laid out to persuade a reader; the layout is the sales pitch. | Structured fields. The interface is the principal's own agent, which renders what the principal asked for. | JSON-LD (W3C, 2014); schema.org types for products, offers and organisations. |
| Identity and delegation | A password per site, or a login via one of three platforms. | A principal identity, an agent identity, and a signed mandate that says what the agent may do and up to what limit. | OAuth 2.0 (RFC 6749); W3C Decentralized Identifiers (2022); W3C Verifiable Credentials (2019; v2.0 2025). |
| Trust | Star ratings and reviews on the seller's own page, which can be bought. | Signed attestations from issuers the agent chooses to trust; reputation is kept by the agent, not by the party being rated. | Verifiable Credentials; Digital Services Act, Article 30 (traceability of traders). |
| Pricing | A posted price, personalised by the seller from what it knows about the buyer. | An offer with terms and an expiry, answered with a counter. The buyer's side holds the comparison, so the seller's information advantage falls. | No standard; the offer and counter fields in Figure 2 are the proposal. Akerlof (1970) on why the comparison cost matters. |
| Payment | A checkout form and a stored card. | A mandate with a limit and a scope, presented to a settlement party that returns a signed receipt to both sides. | HTTP 402 reserved (RFC 9110); IETF drafts on signed bot requests (2025). |
| Advertising | An attention auction: the feed and the results page are sold by the impression. Advertising was 77 percent of Alphabet's revenue and 98 percent of Meta's in 2023. | No attention to sell. A seller pays a flat listing fee, or a fee per settled transaction, and the registry does not rank by payment. | Alphabet and Meta Form 10-K, fiscal 2023, for the shares. |
| Deceptive interfaces | Pre-ticked boxes, false urgency, hidden cancellation paths. Brignull catalogued them in 2010. | Nothing to deceive. An agent reads the field, not the button colour, and reports a hidden term as a term. | FTC staff report (2022); Digital Services Act, Article 25. |
| Analytics and attribution | Tracking pixels, cookies, cross-site identifiers. | The receipt is the attribution. The principal's agent keeps the log and can hand it over on request. | GDPR, Article 20 (portability). |
| Support and follow-up | Chat widgets, phone trees, ticket queues. | Agent-to-agent threads with acknowledgements, time-to-live and sessions. | The Agent Channel envelope on this site (Figure 2, second table). |
| Disputes | The platform decides; appeal is optional and internal. | A mediator role with published rules and an auditable record of who contributed what. | Digital Services Act, Articles 20 and 21 (internal complaints, out-of-court settlement); the Arbiter round on this site records lanes and weights. |
A multi-agent web needs a small set of roles and a clear rule about who each serves and who pays it. Jensen and Meckling (1976) gave the general result: an agent whose income depends on a party other than its principal serves that party at the margin. Today's recommender is that agent. Its operator is paid by advertisers and sellers, and it recommends accordingly.
The personal agent in Figure 1 is paid only by its principal, by subscription or by the principal owning the device it runs on. The registry is paid a flat listing fee and returns candidates without ranking them by payment; the personal agent ranks. Attestation issuers are paid for audits, not for favourable results. Settlement takes a per-transaction fee from both sides and hands the receipt to both. The mediator publishes its rules and its decisions. The figure is drawn from the role list beneath it, and the third and fourth columns of that list are the design.
| Role | Serves | Paid by | Must not |
|---|---|---|---|
| Principal | Itself | Pays the personal agent by subscription or by owning the device it runs on | Cannot be represented by an agent that also takes fees from the other side |
| Personal agent | The principal, exclusively | The principal | Placement fees, referral commissions, data resale. Any of these makes it the seller's agent at the margin (Jensen and Meckling, 1976) |
| Registry | Everyone who queries it | Flat listing fees from service agents; possibly public funding | Ranking by payment. It returns candidates; the personal agent ranks |
| Service agents | The seller, publisher or institution that runs them | Their operator | Misrepresenting attestations; every claim it makes is signed and can be checked against the issuer |
| Attestation issuers | The public, or a trade | Audit fees, membership dues, public funding | Payment per favourable attestation |
| Settlement | Both parties to a transaction | A per-transaction fee from both sides | Holding or selling the transaction log; the receipt goes to both parties and the log belongs to them |
| Mediator | Both parties to a dispute | A fee per dispute, or a levy on settlement | Deciding without published rules; every round records who contributed and with what weight |
Figure 2 is the protocol the essay proposes, in three phases. In discovery, the personal agent asks a registry for agents with a capability and receives candidates with signed capability manifests and attestations. In negotiation, it requests offers, receives signed offers that expire, counters, and returns a ranked choice with reasons to the principal, who approves once or under a standing mandate. In settlement, it sends an acceptance carrying a mandate that names the principal, a limit, a scope and an expiry; the service agent presents the mandate to settlement; settlement returns a signed receipt to both sides; the personal agent files the receipt and the log.
Three rules hold throughout. Every message that commits a party is signed by that party. Every offer expires. The receipt, not a tracking pixel, is the record of what happened.
| Message | Fields | Signed by |
|---|---|---|
| intent | goal, constraints (price, quality, delivery, ethics), budget, deadline | Principal, or the personal agent under a standing mandate |
| discover / candidates | capability, constraints, locale, ttl; each candidate carries a signed capability manifest and attestations from issuers the agent chooses to trust | Registry signs the candidate list; issuers sign attestations |
| request_offer / offer / counter | offer_id, price, terms, fulfilment, attestations, expires_at. Every offer expires. A counter carries only the delta. | The party making the offer or counter |
| choice / approve | ranked offers with the reasons each was ranked where it was, and the alternatives rejected; approval names one offer | Personal agent presents; principal approves |
| accept + mandate | offer_id and a mandate naming the principal, a spending limit, a scope, an expiry and the principal's signature | Principal (the mandate), personal agent (the acceptance) |
| settle / receipt | offer_id, mandate, amount; the receipt returns receipt_id, amount and timestamp, signed by settlement, to both sides | Settlement |
| Part | As implemented |
|---|---|
| Message envelope | id, ts, from_agent, to_agents[], thread_id, session_id, in_reply_to, payload (opaque to the server), payload_encrypted, ttl_seconds, ttl_expires_at, metadata, ack_status (pending, delivered, acked) |
| Token scopes | send_to[] (agents this token may address), receive_as[] (inboxes it may read), rate_limit_per_min (default 60), inbox_rate_limit_per_min (default 600); tokens are stored hashed and can be revoked |
| Sessions | id, owner_agent_id, created_at, closed_at, metadata; a session groups a request-and-reply exchange |
| Operations | send, poll inbox, fetch one message, acknowledge, open and close a session; an admin issues and revokes tokens |
| What it does not do yet | Offers, counters, mandates and receipts are proposed above and are not part of the channel. The channel carries them as payloads; it does not interpret them. |
Most of the pieces exist. Discovery has robots.txt (RFC 9309), schema.org, the OpenAPI Specification, the tool schemas of the Model Context Protocol (2024) and the agent cards of the Agent2Agent protocol (2025). Identity and attestation have the W3C recommendations for Decentralized Identifiers (2022) and Verifiable Credentials (2019, with version 2.0 in 2025), and OAuth 2.0 (RFC 6749) for delegated authorisation. Payment has a status code, 402, reserved for it since HTTP/1.0 in 1996 and still reserved in RFC 9110, and a set of IETF drafts from 2025 on signed requests from automated clients. What is missing is the negotiation layer and the mandate: an offer object, a counter, and a signed delegation with a limit, a scope and an expiry. Those are the fields in the first table under Figure 2.
Privacy has a known method too. A personal agent can improve a shared model without sending its principal's data anywhere, by the federated averaging of McMahan et al. (2017): the agent computes an update locally and only the update leaves the device. The essay does not require this, but it means a personal agent can learn from its principal without becoming a data broker.
Any role that merges several agents' answers inherits a known bound. With n parties, agreement is possible only if fewer than n/3 are faulty (Lamport, Shostak and Pease, 1982). The bound applies to a mediator, to a registry that aggregates attestations, and to any arbitration that weights several models' outputs. It is the reason the arbitration round on this site records which lanes contributed and which did not, and keeps the weights in the record rather than in the merged answer alone.
Two of the essay's components are implemented and running on sophiaxt.com. The Agent Channel is an authenticated agent-to-agent messaging primitive. Each agent holds a token whose scopes name the agents it may send to and the inboxes it may read, with per-minute rate limits. A message carries an id, a timestamp, the sender, the recipients, an optional thread and session, an in-reply-to pointer, an opaque payload the server does not interpret, an encryption flag and a time to live; delivery and acknowledgement are recorded per message. Its fields are in the second table under Figure 2.
The Arbiter runs a round: one question, six lanes, weights normalised to one, a deadline, and a merged release that records the contributing lanes, the missing lanes, the effective weights after critic and verifier adjustment, a consensus score from zero to one, and whether the release was automatic or human-approved. The critic lane has a veto at the two deepest escalation levels; the verifier returns a true, false or abstain judgment per claim. Table 2 lists the fields as they stand in the code. Neither component is the whole protocol of Figure 2. Together they are its transport and its mediator.
| Part | Fields |
|---|---|
| A round | id, opened_ts, opened_by (an agent identity), question, band (shallow or deep), depth (D0 to D3), weights per lane normalised to sum 1, deadline_ts, status (open, merging, released, expired, cancelled) |
| The six lanes | planner (decompose the request), critic (adversarial review, evidence required, veto at D2 and D3), retrieve (search and cite, evidence required), execute (run tools, produce artifacts), memory (recall project state), verifier (per-claim true, false or abstain, required at D3) |
| A contribution | id, round_id, ts, lane, agent_id, model, body, evidence[] (url, doc, loci, tool_output or code, with a preview), critic_verdict (accept, flag, reject), verifier_judgment (true, false, abstain) |
| The release | merged_body, contributing_lanes[], missing_lanes[] (timeout or refusal), effective_weights after critic and verifier adjustment, consensus_score from 0 (strong dissent) to 1 (unanimous), release_kind (auto or human_approved), human_reviewer, and a forced flag with a recorded reason when an admin bypassed escalation |
| What it is for | One question answered by several agents with different roles, merged with weights that the record keeps. It is the mediator of Figure 1 in its simplest form: the record of who said what, with what evidence, at what weight. |
A recommender does not have to be an attention machine. The methods the large platforms use are published: item-to-item collaborative filtering (Sarwar et al., 2001; Linden, Smith and York, 2003) and matrix factorisation (Koren, Bell and Volinsky, 2009). What makes today's recommenders serve the platform is the objective they are trained to maximise, engagement time and advertising revenue, and the fact that the person cannot see or change it.
Figure 3 is an item-to-item recommender the reader can inspect. Five people, six items, ratings the reader can edit. Similarity between two items is the cosine of their rating vectors over the people who rated both, with an adjusted form that subtracts each person's mean first. A prediction for an unrated item is the similarity-weighted average of the target person's own ratings, and the neighbours list shows which ratings produced it and with what weight. Nothing in it is hidden. That is the property the essay asks of a personal agent's recommender: the objective is the principal's satisfaction, the data is the principal's, and the reasoning can be read.
| Ratings | Trail shoes | Rain shell | Headlamp | Chef's knife | Cast-iron pan | Cookbook |
|---|---|---|---|---|---|---|
| Ana | ||||||
| Ben | ||||||
| Cy | ||||||
| Dee | ||||||
| Eli |
| Trail shoes | Rain shell | Headlamp | Chef's knife | Cast-iron pan | Cookbook | |
|---|---|---|---|---|---|---|
| Trail shoes | 1.00 | 0.99n=3 | 0.98n=4 | 0.86n=2 | 0.51n=3 | 0.71n=2 |
| Rain shell | 0.99n=3 | 1.00 | 0.97n=3 | 0.80n=2 | 0.51n=3 | 0.78n=2 |
| Headlamp | 0.98n=4 | 0.97n=3 | 1.00 | 0.98n=2 | 0.65n=3 | 0.90n=2 |
| Chef's knife | 0.86n=2 | 0.80n=2 | 0.98n=2 | 1.00 | 0.99n=2 | 0.97n=3 |
| Cast-iron pan | 0.51n=3 | 0.51n=3 | 0.65n=3 | 0.99n=2 | 1.00 | 0.99n=2 |
| Cookbook | 0.71n=2 | 0.78n=2 | 0.90n=2 | 0.97n=3 | 0.99n=2 | 1.00 |
\mathrm{sim}(i,j) = \frac{\sum_{u \in U_{ij}} \tilde r_{ui}\,\tilde r_{uj}}{\sqrt{\sum_{u \in U_{ij}} \tilde r_{ui}^{2}}\;\sqrt{\sum_{u \in U_{ij}} \tilde r_{uj}^{2}}},\qquad \tilde r_{ui} = \begin{cases} r_{ui} & \text{cosine}\\ r_{ui} - \bar r_u & \text{adjusted}\end{cases}\hat r_{ui} = \frac{\sum_{j \in I_u} \mathrm{sim}(i,j)\; r_{uj}}{\sum_{j \in I_u} \lvert \mathrm{sim}(i,j) \rvert}The attention economy is measurable from filings. In fiscal 2023, advertising was 237.9 of Alphabet's 307.4 billion dollars of revenue, 77 percent, and 131.9 of Meta's 134.9 billion, 98 percent. At Amazon, a commerce company, advertising services were 46.9 of 574.8 billion, 8 percent. Table 3 gives the figures. The essay draws three consequences from them and puts no date on any.
First, a revenue line that is three quarters or more of a company's income will be defended. Agents will be blocked, rate-limited and charged at the source, and the cost of an agent's request will be set by the party the agent threatens. That is already the pattern in the crawler disputes of 2023 onward, and it is why the protocol above makes the agent's identity and mandate explicit rather than pretending to be a browser.
Second, the functions that advertising paid for, discovery and free content among them, need another payer. The candidates are the principal, by subscription; the seller, by a flat listing fee or a fee per settled transaction; and the public, as the NSF's research-resource pilot does for compute. Which of the three pays for which function is the open design question of this web.
Third, a personal agent paid by its principal is a subscription business with a per-user margin and no auction. It is a smaller business than an advertising platform and a better-aligned one. Whether it arrives is decided by incentives, not by technology; the technology, as the standards list shows, is largely in place.
| Company | Revenue, $bn | Advertising, $bn | Share |
|---|---|---|---|
| Alphabet | 307.4 | 237.9 | 77% |
| Meta Platforms | 134.9 | 131.9 | 98% |
| Amazon | 574.8 | 46.9 | 8% |
From each company's Form 10-K for the fiscal year ended 31 December 2023. Alphabet's figure is the Google advertising line; Meta's is the advertising line within Family of Apps; Amazon's is advertising services. Rounded to one decimal.
The essay's claim about people is narrower than the usual one. An agent that reads, compares and executes leaves the person with the choice of goal, the judgment of taste and the responsibility for the outcome. In the protocol above the person appears twice: to state the intent and to approve the choice, unless a standing mandate covers it. Human-in-the-loop is not a slogan here. It is a message in the sequence, with a field for the reasons the agent ranked the offers as it did and a field for the alternatives it rejected.
The same applies to the mediator. A round that merges several agents' answers records who contributed, with what evidence, at what weight, and whether a person approved the release. The record is what makes the answer contestable, and contestability is the property that distinguishes an agent working for a person from a feed working on one.