GoDaddy, Infoblox, Google and Cloudflare Demonstrate Secure AI Agent Transactions Across Platforms

SINGAPORE, Oct. 14, 2026 — GoDaddy (NYSE: GDDY), Infoblox, Google and Cloudflare today demonstrated how AI agents can securely complete transactions across independent online platforms using existing internet standards.

Unveiled at GovWare 2026 during Singapore International Cyber Week, the Chain of Trust is an open reference architecture that enables organizations to discover, identify and authenticate AI agents throughout a transaction. The architecture was developed in collaboration with Singapore’s Infocomm Media Development Authority (IMDA), based on principles in its Model AI Governance Framework for Agentic AI (v1.5).

AI agents are increasingly being used to search for products, compare prices and securely complete purchases for people and businesses. McKinsey & Co. estimates AI agents could facilitate $3 trillion to $5 trillion in global consumer purchases by 2030.

But as AI-driven commerce grows, establishing trust across platforms remains a challenge. Today, most platforms independently verify agents using closed systems, leaving businesses with limited visibility into how an agent’s identity was verified or whether it can be trusted. These disconnected and sometimes incoherent approaches make it difficult to establish consistent, verifiable trust across the broader AI ecosystem.

The Chain of Trust runs on the agentic open web. It connects layers of controls, each built on open standards and established internet protocols. A business can check an agent at every step, from discovery to payment to audit across platforms. The architecture gives organizations:

• Trust. Every agent carries a unique, signed identity that any party can verify for itself on every transaction, enabling organizations to transact securely.
• Control. No single platform decides which agents an organization can do business with: businesses and governments choose which agents to trust, based on verifiable signals. A person sets what an agent may buy and how much it can spend in a signed Agent Payments Protocol (AP2) mandate, and merchants and payment providers can check every purchase against it.
• Interoperability. Because the chain builds on infrastructure the internet already runs on, such as DNS, and on open standards, it works across platforms, clouds and agent protocols rather than only inside one vendor’s system.
• Transparency. Every registration and every transaction is written to append-only logs, so any later change to a logged record is visible to anyone who checks it. Each layer is verified separately, so passing one check does not bypass the others.

How the chain works

Each layer of the architecture relies on an open standard:

• Discovery. Leverages Agentic Resource Discovery (ARD) for resource and capability discovery and DNS-AID for DNS-based lookup, to find which agents exist and where they run.
• Identity. Establishes a registered identity that anyone can verify from public evidence, not just a certificate the agent presents in a single session (the open Agent Name Service standard, ANS, alongside the Secure Production Identity Framework for Everyone (SPIFFE) for the identity of each running instance).
• Authorization. Establishes who controls an agent and what it may do (OAuth).
• Communication. Allows agents to reach tools and each other (Agent2Agent, or A2A, and the Model Context Protocol, or MCP).
• Payment. Carries the person’s signed authorization and the agent’s identity into the checkout (AP2 and the Universal Commerce Protocol, or UCP).
• Traceability. Records what happened and who is responsible in an append-only log, with a signed receipt that anyone can check offline (Supply Chain Integrity, Transparency and Trust).
• Trust. Turns a verified identity into an evidence-based score computed from public attestations rather than self-description (the open Trust Index).

The demonstration at GovWare

The demonstration at GovWare by GoDaddy, Infoblox, Google and Cloudflare simulated a complete agentic purchase of a flight from Madrid to Singapore among agents that did not know each other in advance and did not operate on the same platform. The mock buyer agent ran on Amazon Web Services, the seller agent was hosted on Cloudflare Workers, and the mandate authority and the verifier agent ran on Google. Because every layer uses open standards, the same chain can run on any cloud or platform.

A person approved a purchase with a passkey, and an independent approval service issued signed AP2 mandates that set what the mock buyer agent could buy, from whom and up to what amount. The mock buyer agent found a seller through DNS and ARD. It checked the seller’s identity against the public log and the approval service checked the seller’s open Trust Index score against the person’s minimum requirement. The mock buyer agent then completed the simulated purchase over UCP, with payment through Stripe. The demo also incorporated rogue scenarios, including a look-alike seller and forged credentials, and the Chain of Trust stopped each before a transaction occurred. Every step, from discovery through payment, was recorded in an append-only log that anyone can inspect.

“We don’t need to rebuild the internet for AI agents. By extending the open standards that have connected the internet for decades, we can give agents a verifiable identity that works across platforms. We’re grateful to Singapore’s IMDA and our partners for showing what’s possible when the industry builds together.”

— Jared Sine, Chief Strategy and Legal Officer, GoDaddy

“The internet works because anyone can discover and connect with a website, regardless of who built it or where it’s hosted. AI agents need that same open foundation. We appreciate IMDA’s leadership in advancing trusted AI ecosystems and the opportunity to collaborate with industry partners to help make that vision a reality. By extending DNS and other established internet standards to agent discovery and identity verification, we’re helping create a system where businesses can independently verify who they’re dealing with, without relying on a single platform to decide who can be trusted.”

— Wei Chen, Executive Vice President of Regulatory Strategy, Infoblox

“As autonomous AI agents move into real-world enterprise workflows, establishing an open, verifiable Chain of Trust is essential. We are thrilled to collaborate with Singapore’s IMDA and industry partners to operationalize their pioneering Agentic AI Governance Framework. By grounding multi-agent interactions in open standards, from capability discovery with ARD, to agent communication via A2A, and verifiable user mandates through AP2, we are enabling organizations to deploy autonomous agents with transparency, control, and scale.”

— Rao Surapaneni, Vice President, Gemini Enterprise and Agent Governance Platform, Google Cloud AI

“For agentic AI to succeed at global scale, security and trust cannot be locked inside platforms. By running seller agents and trust checks at the network edge on open Internet standards, we can ensure that every transaction is fast, verifiable, and secure across any platform. We’re proud to partner with Singapore’s IMDA and industry partners to build a safer, open agentic web.”

— Stephanie Cohen, Chief Strategy Officer, Cloudflare

Adoption and case study

The companies invite DNS operators, domain registrars, identity providers, payment networks, cloud, edge and AI platforms, and regulators to adopt and extend the architecture. Several of the companies published a technical case study, Implementing the Chain of Trust for an Agentic Transaction, which describes the prototype and maps each layer to IMDA’s AI governance frameworks.

The reference architecture and case study are available at openagentcommerce.org/technicalpaper.

Organizations that want to publish their own agents under the architecture can register at openagentcommerce.org/engage.