Wallet auth in standards and regulation.

OpenSea's official SDK supports a proposed wallet-state requirement kind

ERC-8257 (Agent Tool Registry) defines an open requirement-kind namespace for gating agent tool access. A wallet-state attestation requirement kind proposed in the ERC's review process is now supported in OpenSea's official SDK: cross-chain wallet state, evaluated off-chain, signed, and verified on-chain by the issuer's own predicate contract via the RIP-7212 P-256 precompile. The SDK recognizes and decodes the requirement kind, and its reference documents it as a third-party predicate type; the SDK does not call InsumerAPI.

• @opensea/tool-sdk exports the requirement kind with a typed decoder and documents it in the SDK's known-predicates reference. Proposed May 2026; SDK support re-verified October 2026 (version 0.31.1).
• The reference names insumer-examples as the reference implementation for the predicate.

Draft ERCs revised, or changes agreed by their authors, following review contributions

• ERC-8481 (Agent Pre-Sign Risk Report, November 2026): the draft was revised the same day as the review, with a follow-up the next day. A report anchored on chain is now judged by the keys in force when it was anchored, including a smart-contract signer's own key, so removing, losing or rotating a key no longer erases a source's earlier reports. A checker that cannot read that past state reports the result as not read, not as unsigned. A registration file that lists signing keys SHOULD be content-addressed, so the keys in force at a past block can be read again.
• ERC-8426 (Wallet Pass Extension for NFTs, August to October 2026): the merged draft carries changes from review: two checks before any action a pass can trigger (a signed challenge naming the token, the action, a single-use nonce and an expiration, plus a fresh ownership read at request time), a split between public and gated passes so a published pass link is never proof of ownership, ERC-1271 support for contract accounts, and limits on unsigned action links.
• ERC-8291 (SIWE-gated NFT media, August 2026): two draft revisions followed review. The binding grammar now includes ERC-20 balance-threshold and ERC-1155 minimum-quantity forms beside the single-NFT binding; attestation-based entitlements are left to a future ERC.
• ERC-8210 (Agent Assurance, April 2026): the author's published v2 changelog credits review input, including the pre-commitment facts gap and the risk-hook resolution path.
• ERC-8240 (Trust Infrastructure, April 2026): in a clarifying review exchange, the author agreed that per-methodology context hashing and per-call condition identity are separate, and queued revisions. Neither revision is in the draft yet.
• ERC-8273 (Attestation-Gated Agentic Actions, June 2026): in review discussion after the ERC merged, the author agreed with and extended a storage-proof-as-evidence design, using EIP-1186 proofs so a signed verdict can be rechecked against chain state. The merged text does not include it.

Authored proposals in active protocol review

• UCP pull request 415 (opened May 2026): proposes wallet attestation as an identity-linking mechanism alongside OAuth. A typed provider, JWKS-based offline verification, signed booleans. Open, awaiting maintainer review.
• Verifiable Intent pull request 22 (opened April 2026): a sole-authored RFC proposing environment.wallet_state as a constraint type in Verifiable Intent, the open specification for agent payment authorization that Mastercard introduced in March 2026. A mandate can require a signed wallet-state attestation, verified against the issuer's published keys, before an agent executes. In review, not merged.
• A2A trust signals (opened March 2026): the five-signal taxonomy for agent trust, first discussed in an earlier issue, is consolidated in a proposal we opened and co-author, including the on-chain credentials and on-chain activity signal types with shared JWKS verification.
• ERC-8183 (agentic commerce hooks): a wallet-state hook implementation (April 2026), open in the project's review queue. A maintainer suggested consolidating it into a score-based trust gate hook; our reply set out why one checks a condition and the other gives a score, and the pull request has not moved since May 2026. Also a day-one maintainer of the Envelope-in-Action case library.
• x402 (machine payments): contributed the signal taxonomy and the on-chain credential and activity sections to the cold-start trust work (February 2026), credited by name in the open spec pull request 3238; plus an authored extension proposal for self-scaling conditions (June 2026) and a signer-authentication proposal (May 2026).

Merged vocabulary and Internet-Drafts

• Agent governance vocabulary: contributions merged into an external agent-governance specification (first merge April 2026), with ongoing review participation.
• IETF Internet-Draft: wallet state attestation: a formal IETF Internet-Draft describing signed wallet-state attestation, filed with IPR disclosure (May 2026; revision -01 September 2026, adding the domain-separated signing scheme, the post-quantum signature, and a verification procedure).
• IETF Internet-Draft: environment state: a joint draft extending the attestation shape to environment state, co-authored with an independent implementer (May 2026; revision -02 August 2026).

Regulatory submissions

Written comments and input to regulators, each linked to the copy the regulator itself published where it has posted one. Each letter states our commercial interest. Filing a comment means it was received; it does not mean a regulator agreed. Several letters propose signed records. A signed result is InsumerAPI's statement that it read chain state, evaluated the stated conditions and got the result shown; the conditions and result cannot be changed afterwards without breaking the signature. On its own it is not proof of the chain state. For token balance, ratio, account code and delegation revocation conditions on EVM chains, where available, a Merkle proof lets anyone check the value against the chain's state root, using a block header from a node they trust. What a signed result shows, and what it does not.

• SEC, File No. S7-2026-30 (proposed Transfer Agent Rules, October 29, 2026): a wallet address names a key arrangement, not a holder, so a transfer agent should get evidence that the holder controls an address before recording it. Control can change with no transfer, and a whitelisting approval reflects the day it was made, so both should be checked again when a transfer is presented. A signature is one way to show such records are unaltered, but it has to stay trustworthy for the whole retention period: a six-year record made in 2030 is kept into 2036, past the date NIST's transition plan disallows ECDSA (after 2035). We suggest the adopting release say that, where a transfer agent relies on signatures, the method should be expected to stay secure for the retention period; signing with ML-DSA (FIPS 204), alone or alongside a classical signature, is one way to do that with standards available today. All comments on the file.
• NIST NCCoE, DevSecOps practices (October 29, 2026): comments on the project's next build, where agents develop, build and test code and which NCCoE builds with its agent identity and authorization project. We ask that each agent action be decided by a condition checked when the agent acts, and that the record show who delegated the agent's authority and that it was still in force. NCCoE has not published the comments on this document, so the link goes to the project page.
• SEC, File No. S7-2026-27 (proposed Regulation Crypto Assets, September 25, 2026): asks the Commission to confirm that an issuer may rely on a professional's confirmation of accredited status, including one tied to the purchaser's wallet and checked at the time of sale. All comments on the file.
• SEC Crypto Task Force, written input (September 25, 2026): what a relying party's record should show when it accepts a proof in place of collected data: made when eligibility matters, limited to the decision, and verifiable for as long as it must be kept. All written input.
• CFTC Innovation Task Force, written input (September 25, 2026): when software acts for a customer, the record should show that its authority was in force at the moment it acted, as a signed check that can be verified for as long as the record must be kept. The CFTC posts written input on its Innovation Task Force page and has not posted this letter yet, so the link is our own copy of what was sent.
• SEC, File No. 4-927 (Tokenized Securities Venue exemption, September 17, 2026): proposes that a venue's access check be made when access is used and leave a signed, independently verifiable record. All comments on the file.
• NIST NCCoE, AI agent identity and authorization (March 12, 2026): comments on the concept paper for the Software and AI Agent Identity and Authorization project. NCCoE has since published a summary of the comments received (September 2026); the link is our own account of what we submitted.