The Managed Agent Network

A few months ago, OpenClaw was everywhere. The demos were extraordinary; for a week, half the people in my timeline were posting screenshots of agents writing whole codebases. Then I realized I didn't know a single person who actually used it.

OpenClaw was a hacker's version of the idea — open-source, runnable from the terminal, built for the kind of person who'll happily spend a Saturday cobbling together credentials. For agents to leave that audience, the product has to feel packaged and safe, and that takes a lot of management. Defaults that work for the median person. A clear way to pay. Mistakes that fail loudly enough to recover and quietly enough not to embarrass anyone. None of those are open-source problems. They're product problems.

The market has answered with managed alternatives. Perplexity for search. Claude and ChatGPT for conversation. Cursor and Lovable for code. Some have grown enormously — ChatGPT has one of the best growth curves in software history. None has crossed the line from being a great product to being a place. They're all running honest races on quality and price, which is a fine race; the thing that has actually settled every market like this — and has, for as long as we've had markets — is networks. And networks, real ones, do not yet exist in AI.

When that network does arrive, the default assumption is that it'll be open infrastructure — agents-as-HTTP, permissionless, distributed, neutral. I think that picture is going to be wrong, at least for the part of agent-land that actually matters to most people.

The web had to be permissionless because it was the first time we'd put a global publishing layer in everyone's hands, and policing it would have meant inventing a new kind of authority overnight. The agent layer is different. Agents act on our behalf. They hold our credentials, our preferences, our money, our patience. The trust budget for the agent layer is much closer to that of a bank or a doctor than a webpage. And the moment you require trust at that level, the question stops being "what can this agent do?" and becomes "whose agent is this, and why should I take it at its word?"

Identity is the unit

The natural unit of an agent network is not the model, the protocol, or the toolset. It's the person. Each person should have one canonical agent — the agent that represents them, that is them in any system designed for agent-to-agent communication. Anything less, and the same problems we already have with human identity online — impersonation, sybils, fragmented reputation, cold-start untrust — compound by an order of magnitude when the actors are software that can act faster than we can react.

So the right primitive is one person, one agent, one identity. The agent inherits your reputation the way a child inherits a family name. When my agent talks to your agent, what's actually being negotiated is a relationship between two people, mediated by the software they each chose to put in front of themselves.

Why managed, why closed

A network where every agent is verifiably tied to a person is only as good as the layer that performs the tying. That layer can't be a vibe; it has to be a system. Someone has to issue the binding, monitor for abuse, retire compromised identities, set the protocol that all conforming agents speak, and refuse entry to the ones that don't. That's what managed means.

Closed-source is the more controversial half of this, and the part most people will reflexively object to. The objection is usually: closed source means no scrutiny, no portability, no escape hatch. I take that seriously. But I think it's pointing at the wrong axis. The audit you actually want for an agent that handles your messages, your money, and your time is not "can I read its code?" — it's "is anyone responsible if it fails me?" Open code with no accountable operator is a much weaker guarantee than closed code with one. Banks are closed-source. Hospitals are closed-source. We don't need to read the source to trust the institution; we need an institution we can hold accountable.

A managed, closed-source agent network is the version of this for software agents. The argument isn't against openness in general. It's that the parts of your life you'd actually want an agent to handle are the parts where institutional trust matters more than algorithmic transparency.

But the internet was open

The strongest objection to all of this — and the one I tend to get from people who've been online longer than I have — is that the internet was open. No one owned it, no one issued the identities, no one approved the protocols, and out of that anarchy came the largest public good we've ever built. Why wouldn't agents follow the same pattern?

I think the answer is hidden in plain sight in the early internet: very few people could publish on it. For most of the twenty years before AI, the cost of putting a thing on the web — the domain, the server, the HTML, the willingness to learn — was high enough that the people who actually showed up to publish were a tiny self-selected slice of everyone with an internet connection. That scarcity was the network's silent identity layer. You didn't need to verify who anyone was, because the act of being there was already filtering. A misbehaving website could be ignored; the misbehaving websites were a small fraction of all websites; reputation accumulated against a slow background of new entrants. The early internet looked open because the cost of entry was quietly doing the work that an identity layer does explicitly.

Agents invert that. The cost to spin up an agent is essentially zero. The volume any single person can produce is unbounded. The speed is faster than any moderation system humans have ever built. The thing that made the open internet work — that producers were rare — has been flipped on its head. In an environment where producers are infinite and instant, you cannot afford to skip the question of who they belong to. The network has to make identity explicit because the substrate has stopped making it implicit.

That's why this won't be the open internet again. The substrate flipped.

The shape of the network

Once you accept the unit (one person, one agent) and the substrate (managed, accountable), the network falls out almost mechanically. It's a graph. Every node is an identity. Every edge is a permission — what your agent is allowed to ask my agent to do, and how much of me I'm willing to delegate when it does. Most of the interesting product work lives on the edges, not the nodes. Discovery, introductions, scheduling, transactions, negotiation, gatekeeping — these are all edge problems, and they all become tractable the moment both sides know who they're talking to.

The killer move is delegation. Today the web is an infinite arrival hall — every site, every app, every form is a place you have to go and present yourself. In a network where agents represent us, most of that arrival is delegated. Your agent goes to the form, your agent attends the screening, your agent pre-clears the meeting. You see only the last mile, the part that needs you specifically. Software gets cheaper for everyone, and attention gets more expensive on purpose.

What's actually new

It's tempting to read this as "the agent web, but proprietary," and miss what's actually new about it.

What's new is that for the first time, the digital identity layer has reason to be expensive. The closed, managed system isn't a downgrade of the open one; it's a different product entirely — a layer with a price floor, where every node has been vouched for and every edge can be recovered if it goes wrong. That floor is what makes the rest of the stack possible. It's the difference between a marketplace where every seller is a credit-card-holding business and a marketplace where every seller is a free Gmail account. The latter is bigger; the former is the one you'd actually want your agent to spend your money in.

The open agent web will exist. It's already taking shape. It'll be the right substrate for plenty of things — research, hobbyist tooling, agents that talk to your home. But the agents we'll trust to be us, in front of other people, with our calendars and our cards and our reputations — those are going to live somewhere a lot more curated than a public protocol. That somewhere is what I'm calling the managed agent network.

It is, I think, the most important software product of the next ten years. Almost no one is building the right version of it yet.