Can credential vaulting alone solve merchant-facing agent identification?

Allglenn separates two claims that the Amazon-Muse dispute has run together. Meta says its Muse Secure VM gives the agent "no visibility into people's passwords or payment methods," with credentials going to "secure storage that Muse can use without seeing the underlying secret," and a Sentinel agent approving sensitive actions. Allglenn grants that this reduces the risk that the model can expose or misuse that password, but argues it "does not by itself establish how the broader system uses credentials," nor does it "tell the retailer which automated system is making a request, who operates it, or whether the retailer has agreed to serve it." His conclusion states the distinction directly: "Secure storage is a consumer-security control. Self-identification is a merchant-facing protocol requirement. A system can satisfy the first and still fail the second."

The reasoning follows from what each control actually protects against. Vaulting answers the question of whether the agent can leak or misuse what it was given — a property of the agent's own internal architecture, and a promise its builder can make unilaterally. Self-identification answers a different question: who is making this request, and did the account holder and the retailer both agree to it. That requires a protocol the retailer can also see and enforce, which no unilateral design choice by the agent builder supplies on its own. Allglenn notes Amazon's own framing targets exactly this second layer: a spokesperson said third-party apps "should operate openly and respect service provider decisions about whether or not to participate" — a demand about visibility and consent, not about credential safety.

This sharpens What identity standards do shopping agents actually need? by isolating the specific reason Meta's security engineering does not resolve Amazon's objection: the two companies are answering different questions, not disagreeing about the same one. It also qualifies how Can a protocol split agent access from agent incentives? should be read: an OAuth-based consumer grant, like Muse's Secure VM, is fundamentally a credential-and-access control, and Allglenn's distinction implies such a protocol still needs an explicit self-identification field layered on top of the access grant to satisfy what Amazon is asking for.

Allglenn offers this as analytical framing of public statements from both companies, not as a technical audit of Muse's actual data flows or of what Amazon's systems can detect; neither "consumer-security control" nor "merchant-facing protocol requirement" is a term either company used, so the two-layer framing is the author's interpretation rather than either firm's own taxonomy. If the distinction holds, it implies that an agent operator who publicizes a credential-security feature, however strong, should not expect it to substitute for a visible, retailer-legible identification signal — the two have to be built and demonstrated separately.