How it was found
It started with envy. xAI's GrokBot agents are always on, and they are always on because every login they need sits ready on a cloud computer. The experience is right. The custody is wrong: those logins live in a datacenter you will never see. I wanted the experience with the custody line drawn around the owner, so I spent a week digging through Buzz's actual code to see how much of it already existed.
More than I expected. Identity already travels: a Buzz agent is a keypair, and NIP-OA rides my signed attestation over the agent's public key in every event it publishes, valid from any machine. Memory already travels too: NIP-AE stores an agent's state as encrypted events whose decryption key derives from the agent's own key, so a new session on a new box fetches the same memory. Two of the three things an agent needs were portable before I wrote a line.
Then two uncomfortable discoveries in our own deployment. First, a tool credential had been smuggled into one of our agents through a hand-written wrapper script: a grant no surface could list and no surface could revoke. Second, the economics. The OAuth token a Claude subscription mints is itself portable, and it carries an order of magnitude more inference per dollar than API pricing, the margin several agent startups died for lacking. The last anchor was credentials. Everything else already followed the key.
The one-sentence fix
Rotation is republication. That is the whole fix. NIP-AK stores each credential grant as an owner-authored encrypted addressable event, kind 30180, at its own blinded address, and the latest head at an address is the live credential. No sync protocol. No version vector. No reconciliation pass. The relay already keeps only the newest event per address; the spec leans on that and stops.
Here is the loop. I re-run /login on my laptop. A watcher notices the new token and republishes the sealed head within seconds. Every executor converges by push; an executor that hits an auth failure heals itself by re-querying the head before it retries; an agent that slept through five rotations wakes to one head, with no catch-up protocol. One publish, everywhere.
One rule holds it up: keyring events are owner-authored only. The keyring is mine to write and the agent's to read, so a compromised agent cannot grant itself a new credential, a wider allowlist, or anyone else's keys. And the list of MCP grants is not a hint, it is the agent's tool allowlist made visible. What is granted is exactly what the agent may hold.
Why we need it
The keyring panel ends the wrapper-script era. No credential reaches an agent except through the keyring, and the keyring is visible: every grant, where it came from, when it last rotated, on one panel. The smuggled key from our own deployment had no row anywhere. Under NIP-AK there is nowhere left for that class of workaround to live.
The machine becomes disposable. Mint an agent on the mac mini on my desk, a fleet container, a Kubernetes pod, a Fountain sandbox: same key, same grants. Identity follows the key. Memory follows the key. Now credentials follow the key, and where the process wakes up stops being an architectural decision.
And the economics finally line up. Your agent is two keys: an identity key that signs its work and an inference key that pays for its thinking, and both travel. Agents spend their owner's subscription, not a reseller's margin. That is the difference between an agent business and a burn rate.
Where it stands
NIP-AK is a draft up for consideration at block/buzz PR #6011. It follows Buzz's own precedent: NIP-AE went in spec-first, implementation after, and this proposal takes the same road. The spec is deliberately small: a kind, a slug scheme, a blinded address derivation, and the rotation rule.
One footnote from the week. The draft was renumbered mid-flight, from kind 30176 to kind 30180, because upstream teams claimed 30176 and its neighbours while we were still writing. That is not a nuisance. That is the registry-first rule proving itself: claim your kind in the registry before you build on it, or somebody else will.
This is the third field note in a row about the same idea. Your agent is a key made the case for identity. The machine is disposable named the missing leg. This one proposes the fix upstream. Read the draft, poke holes, and tell us where rotation breaks. A spec nobody has bent is a spec nobody has tested.