The Agentic Web's Two Layers: What's Really Underneath Identity and Capability
- Heidi Schwende
- 2 hours ago
- 6 min read
A closer look at the structured data, protocols, and payment rails building the two sides of the agentic web, and why both run deeper than a single file or standard.
This one runs more technical than most of what I write. That's deliberate. The shift underway here touches how trust and transactions get built into the web itself, and it's still early. Every protocol named below is a draft, a trial, or a first-year rollout. None of this is settled, and the map will keep changing.
AI agents are pushing the web toward two distinct questions:
Identity:
Can an agent tell who a business is.
Capability:
Can an agent actually do something once it arrives.
That split is a genuinely useful way to think about where things are heading, and two examples tend to anchor it: a text file called llms.txt on the identity side, and a browser standard called WebMCP on the capability side. Both are real and worth knowing about. They're also each one entry point into a much wider set of infrastructure, and it's worth looking at the fuller picture underneath both columns.
The identity column, in full
llms.txt
llms.txt is a plain-text summary at the root of a domain describing what a business does, proposed in September 2024. The evidence on whether it gets used has only gotten thinner since.
On a June 2026 episode of Google's own Search Off the Record podcast, John Mueller argued that llms.txt can't help a model decide which site to surface for a query in the first place, since the file is self-reported by the site that wants to be chosen. As he put it, a business publishing one is essentially telling the model, "I have the best website ever."
An Ahrefs review of roughly 38,000 domains running the file found that 97 percent got zero requests for it in May 2026.
A separate 90-day study cited alongside that research measured just 84 requests to llms.txt out of more than 62,000 total AI bot visits to the sites tracked.
You're basically telling these systems, I have the best website ever. (John Mueller, Google, June 2026)
None of that thin evidence has slowed adoption. A WordPress plugin installed on more than three million sites now generates an llms.txt automatically, turned on by default, no setup required.
Structured Data
Alongside all of that sits a much older and more established identity layer: structured data.
Organization, LocalBusiness, and Person schema, the vocabulary that's existed since 2011, has become the piece AI systems lean on most to resolve who a brand is and whether to trust it. Google's March 2026 core update pulled back on schema as a rich-result display trigger while reinforcing its role as an entity verification signal.
Sites with clean Organization schema and consistent sameAs links to LinkedIn, Wikidata, or a Google Business Profile are seeing better resolution in AI Mode's answer generation, independent of whether that schema ever produces a visible rich result. That layer has been buildable for well over a decade, and it's the part of identity with an actual track record.
Agent Facing Identity
There's also a newer layer forming above both: agent-facing identity itself.
Security researchers spent a good part of early 2026 pointing out that identity, for agents, isn't only "does this business exist." It's also "is this agent who it claims to be, acting on whose authority, with what scope." That's a different problem, and enterprise identity teams are currently building toward verified, auditable agent credentials to answer it.
Taken together, the identity column includes a well-established structured data layer with a decade of evidence behind it, a newer description-file layer that current data suggests isn't being read yet, and an emerging agent-credential layer above both that's still being defined. llms.txt is one piece of that, sitting at its newest and least proven edge.
The capability column, in full
Web MCP
WebMCP is a W3C draft, first announced in February 2026 through the W3C Web Machine Learning Community Group with Google and Microsoft co-editing, that lets a website expose callable functions, checking inventory or starting a booking, directly to a browser-based agent. Google opened a public origin trial in Chrome 149 following the announcement at Google I/O 2026, with Gemini in Chrome as the primary agent using it so far. Companies including Expedia, Booking.com, Shopify, Etsy, and Target are already experimenting with it during the trial period. It's genuinely early.
The API is expected to keep changing before anything close to a finished standard, and Chrome's own documentation frames it as something to test, not something to depend on yet.
Instead of an agent guessing the purpose of an interface element, you declare their purposes. (WebMCP, Chrome for Developers documentation)
Model Context Protocol
It sits alongside a broader set of standards doing related work. The Model Context Protocol, the server-side counterpart WebMCP borrows its name from, has already become a widely adopted way for agents to connect to tools, databases, and business systems well beyond the browser. Google's A2A protocol handles agent-to-agent coordination. And one layer down from all of it sits the piece that determines whether a completed task becomes a transaction: payment authorization.
That layer has moved quickly, and it's the part of the capability column that's furthest past the draft stage. Google's Agent Payments Protocol launched in September 2025 with more than sixty partners, including Mastercard, PayPal, Coinbase, American Express, and Salesforce, built around signed digital credentials recording what a user authorized, what an agent selected, and what got charged.
Visa and Mastercard each launched network-specific agent commerce programs within a day of each other in April 2025, Mastercard's built around tokenized cards scoped to a specific agent and merchant, Visa's around a verified agent identity issued by the network. By January 2026, Mastercard had publicly committed to supporting all the major protocols at once, reflecting an industry expectation that agent commerce will run on more than one standard at a time rather than settle on a single winner. PayPal and Google Cloud have had a working conversational commerce integration live since October 2025.
McKinsey has estimated agentic commerce could influence between three and five trillion dollars of global commerce by 2030.
Taken together, the capability column includes:
a browser-native entry point still in trial
a broader tool-connection layer already in wide use, and
a payments and authorization layer that several of the largest networks in commerce are actively building on right now.
WebMCP is one piece of that too, and probably the piece with the most changing still ahead of it.
Why the fuller map is useful
Seeing both columns as stacks rather than single examples changes where the near-term work sits.
On identity, the structured data foundation is mature, has actual usage data behind it, and is available to strengthen right now, independent of anything happening with description files that the evidence currently says aren't being read.
On capability, a business doesn't need to wait for a browser standard to mature to start thinking about the question at all, since the more foundational tool-connection layer is already usable today at the server level, and the payments layer underneath it is already processing real transactions at several of the largest networks in commerce.
Agentic AI is still a moving target. Every protocol and standard named here is somewhere between a draft and a first-year rollout. Adoption data, partner lists, and even the APIs themselves will look different a year from now. That's not a reason to wait. It's a reason to build on the layers with the most evidence behind them already, and keep watching the rest.
Two starting points
First, on identity:
Organization, LocalBusiness, and Person schema, done well and kept consistent across a website, LinkedIn, and Google Business Profile, is proven infrastructure that AI systems are already using to resolve trust. It's worth confirming that layer is solid, alongside whatever happens with newer description files.
Second, on capability:
For most mid-market service businesses with a transactional surface, quotes, bookings, scheduling, a useful question is whether the systems already running the business, the CRM, the booking calendar, the quoting tool, could be connected to an agent through MCP at the server level. That layer is closer to ready today than the browser-native standard still in trial.
The identity and capability split holds up well as a way to think about the agentic web. The two examples usually attached to it are just the visible tip of two much larger stacks, both still being built in real time, and knowing what's underneath both makes the next set of decisions easier to make well.
Sources
Southern, Matt G. "Google's Mueller Says llms.txt Can't Help LLMs Differentiate Sites." Search Engine Journal, June 15, 2026.
"What Is llms.txt, and Should You Care About It?" Ahrefs Blog, 2026.
Spriestersbach, Kai. "The llms.txt is dead. More precisely: a dud." Medium, February 23, 2026.
All in One SEO (AIOSEO) plugin listing and LLMs.txt Generator documentation.
"Structured Data in 2026: The Schema Markup AI Actually Uses." Globerunner, 2026.
"Schema Markup After March 2026: Structured Data Update." Digital Applied, March 20, 2026.
"Identity becomes the 2026 battleground as AI erases trust signals." SC Media, January 6, 2026.
"Join the WebMCP origin trial." Chrome for Developers Blog, June 9, 2026.
"What Is WebMCP? Your Website's API for AI Agents." No Hacks, February 11, 2026.
"Chrome 149 origin trial puts WebMCP in developers' hands at last." PPC Land, May 20, 2026.
"AP2 Protocol Explained: Google's Agentic Commerce Standard 2026." Eco Support, 2026.
"What Is Mastercard Agent Pay? AI Agent Commerce Protocol in 2026." Eco Support, 2026.
"Mastercard Agent Pay vs Visa Trusted Agent 2026: Compared." Eco Support, May 26, 2026.
"Agentic Commerce in 2026: AP2, x402 and AI Payments." BitOnTree, 2026 (McKinsey $3-5 trillion estimate).
"AP2 (Agent Payments Protocol) Explained." Eco Support, 2026 (PayPal / Google Cloud Conversational Commerce Agent, October 27, 2025).