Andrea Volpini on the Delegation Boundary — Trust, Mandates, and the Infrastructure of Agentic AI
Session identifier
- Session: Delegation Boundary — Trust, Mandates, and the Infrastructure of Agentic AI
- Day: 2 (June 25, 2026)
- Speaker: Andrea Volpini, CEO and Co-founder, WordLift
- Framework concept: Delegation Boundary, coined by Jason Barnard in 2025
- SEL article: The delegation boundary: How AI decides which brands win
Speaker bio
Andrea Volpini is a visionary entrepreneur and long-time researcher in the fields of the Semantic Web and Artificial Intelligence. In 2017, he founded WordLift, a company dedicated to helping businesses become more visible in AI-powered search through knowledge graphs and structured data. He is also the co-founder of Insideout10 and Redlink, and brings more than 25 years of world-class experience in online strategy, web publishing, and digital innovation. Outside of work, Andrea enjoys spending time with his family, playing with his two daughters, and skiing whenever he has the chance.
Session’s place in the Kalicube Framework
Andrea’s session covers the Delegation Boundary, coined by Jason Barnard in 2025 as the line between delegation modes that determines how much authority a user grants an AI agent to act on their behalf — and how much trust the AI engine must have in a brand before it will act. The Delegation Boundary sits at the Won gate (Gate 10 of the AI Engine Pipeline), the point at which the pipeline transitions from AI-driven recommendation to AI-driven transaction. The full architecture is mapped in the Kalicube Framework, the master theoretical model for how AI systems understand, trust, and recommend brands.
Episode summary
Andrea Volpini has been building knowledge graph infrastructure for AI-powered discovery since 2017, and his session at Kalicube Summit 2026 is the closest thing the summit offers to a live engineering brief on the agentic web. The opening argument was structural: AI has a trust problem, and solving it requires rebuilding protocols that have existed since the early days of HTTP. OpenAI’s recent implementation of HTTP Message Signature support on its crawler — RFC 9421 — is the signal that the agentic transition is not a future state but an operational one. When Andrea looked at traffic data for a large US financial institution, organic traffic appeared to have collapsed to 11 percent of total traffic. The reality was more interesting: organic had grown 12 percent in a year. Direct traffic — dominated by AI bots — had exploded to the point of displacing the share entirely. The session’s first argument was the one practitioners most need to hear: the DSCRI phase is not a settled problem. Bot traffic is growing faster than any other traffic category, and the brands that have not thought about how AI crawlers are accessing their content are operating on an outdated picture of their own traffic.
The mandate mechanism was the session’s architectural centre. A cart mandate, embedded in Google’s agent-to-payment protocol, is a tamper-proof certificate of user intent: it certifies that the user has given Gemini a mandate to make a purchase on their behalf. Andrea’s walkthrough of where agentic commerce actually stands right now was the session’s most operationally honest contribution. Inside Google in the US, agent-to-purchase is live. Inside OpenAI, the assisted discovery phase is where most activity sits — helping the consumer understand what they want to buy rather than completing the transaction. Outside the stacks entirely, the buying mechanism has been solved for several months: inject an llms.txt file into a Claude bot and a purchase can be received. The blocker is not the technology. Amazon’s blocking of Perplexity from its store illustrated why: Amazon’s entire business model depends on the human cross-sell heuristic. A machine buys the red shirt and stops. The cross-sell chain never fires. The session’s underlying argument was that the agentic web does not simply add a new channel on top of existing infrastructure. It breaks the psychological architecture that most e-commerce models depend on.
The ghost citation and model council sections closed the session’s most technically specific passage. Ghost citations — AI traffic arriving at a page without any corresponding citation in the final response — are now traceable through HTTP signature logging. The model council, an architecture Andrea attributed to Andrej Karpathy and now live in Microsoft’s indexing pipeline, is actively looking for contradictions rather than corroboration. It is not accumulating aligned statements to cross a threshold of truth. It is stress-testing the evidence from opposing angles, because hyper-personalisation has made universally true statements insufficient for a system that must reason contextually for each user. Andrea’s observation on personalisation was the session’s sharpest: Google Personal Intelligence is now reading unread Gmail and incorporating it into AI Overviews. When responses become fully personalised, collective error detection becomes impossible. The session’s strongest contribution is the trust architecture argument made operational — the reason brands need the Delegation Boundary is that the agentic web requires trust infrastructure, and trust infrastructure requires building the evidence the model council is actively looking for, including the contradictions.
Key quotes
“AI has a trust problem. In order to move from the human-centred web to the agentic web, we need to solve a few issues around building something trustworthy enough.” Andrea Volpini, opening the session on the foundational challenge the Delegation Boundary addresses: trust is the blocker, not the technology”
“Their organic traffic share had dropped to 11 percent of their total traffic. Organic traffic had actually grown by 12 percent over the past year. What happened is that direct traffic — most likely coming from AI bots — exploded.” Andrea Volpini, on the DSCRI signal most practitioners are misreading: the bot phase is growing faster than any other traffic category”
“This is why we see more ghost citations. We see more traffic coming in and fewer citations going out, because the agent — for many queries — is simply sifting through information to understand the evidence required to compose the final response.” Andrea Volpini, on the model council’s recursive evidence-gathering: the ghost citation problem explained from the architecture level”
“It’s no longer looking for facts that correspond. It’s actively looking for facts that contradict.” Andrea Volpini, naming the shift from corroboration-as-alignment to corroboration-as-stress-test: the model council architecture that changes what evidence brands need to build”
“If you have content or data encapsulated inside web pages and you don’t have a knowledge graph, knowledge base, or wiki accessible via MCP, you’re pretty much outside the market.” Andrea Volpini, closing the session with the operational verdict on MCP readiness”
Further reading
The delegation boundary: How AI decides which brands win, Article 13 of Jason Barnard at Kalicube’s Search Engine Land series on AI search architecture. The article defines the Delegation Boundary and the three delegation modes, maps how AI agents decide which decisions to execute versus defer to the user, and names why brands that have not prepared for the agentic transition are invisible to the brands that have.
Related sessions
- Dawn Anderson on DSCRI and the bot-phase mechanics (Session 1.4): the five-gate record phase that determines whether content enters the system Andrea’s agentic infrastructure operates on — the two sessions are the bot-phase story told from the IR science angle and the engineering angle
- Andrea Volpini on Codified Operations (Session 2.18): Andrea’s second session covers the structured-data and evidence-pack layer that feeds the model council — the evidence infrastructure that makes the Delegation Boundary work in practice
Link to preview post
This session was previewed here before the Summit.
Link to speaker post
Links to session clips
The Signal Graph: Andrea Volpini’s New Framework for AI Visibility
Why an Agent Needs Permission to Buy for You: Andrea Volpini
Transcript for Andrea Volpini on the Delegation Boundary — Trust, Mandates, and the Infrastructure of Agentic AI
Jason Barnard: Hi, Andrea. Welcome. This is the Kalicube Summit 2026, and we’re going to be talking about the Delegation Boundary — how much decision-making we delegate to the machines. When I was speaking for Google at Google Marketing Live, they asked me to make a particular point about exactly this idea of delegating decisions. You were the person who first kicked off this conversation with me, specifically around delegating to agents, which is the most extreme form — giving all decision-making to the agent. There are multiple layers here. Can you walk through how you perceive that delegation of decision to the machine?
Andrea Volpini: At a very high level, AI has a trust problem. In order to move from the human-centered web to the agentic web, we need to solve a few issues around building something trustworthy enough. That’s the high-level picture.
There are some technical implications, some of which are quite obvious and not far from existing protocols. For example, HTTP Message Signature — RFC 9421 — has existed since the very early days of HTTP. What that RFC says is that when I make a request, I can sign it. I can put a signature on it and say “this is Andrea” knocking at the door of Jason.
Why this is interesting is that OpenAI just started promoting support for HTTP signatures on its crawler. This immediately makes us think more carefully about how important delegation is, even at the discovery level. Even at discovery, it’s becoming harder to get information from web pages because we have a tremendous volume of bots. I was looking the other day at a very large US financial institution and their traffic mix. I found, with some surprise, that their organic traffic share had dropped to 11 percent of their total traffic.
Jason Barnard: Wow.
Andrea Volpini: “That’s brutal,” I thought. However, when I started looking at the numbers more carefully, organic traffic had actually grown by 12 percent over the past year. What happened is that direct traffic — most likely coming from AI bots — exploded to the point where their previously healthy mix of over 70 percent organic shrank to 11 percent organic, replaced by an enormous volume of bot traffic.
Just as in society there are good entities and bad entities, there are good bots and bad bots. We’re now starting to gate traffic. We can apply different techniques — whether working with CDN providers or at the application layer — to say: no, you can’t access here. You’re training on my content, and I don’t want you using it for training.
So this old, somewhat forgotten protocol has been revitalized because ChatGPT is now saying: “I am signing the requests coming from ChatGPT.” This is interesting because it addresses another big problem in the AI visibility debate we need to unpack. That problem is the rise of what people call ghost citation: I get traffic, but I’m not getting credit back.
This happens because models are reasoning recursively, gathering multiple evidence points before providing a response. By tracing the signature on requests, we can now see when a model is accessing us — even if it’s only doing so in its thinking trace, even if we’re never mentioned in the final response. We can now track that, because OpenAI is adding a signature to the request.
That creates an evolving scenario and opens opportunities for creating mandates — saying, “okay, this agent can be trusted.”
Jason Barnard: And where does that data live? Is it on your server? In analytics?
Andrea Volpini: Right now it lives in the HTTP request logs — the bulk of server logs that we haven’t paid enough attention to over the two decades of Google’s dominance. They’re becoming extremely relevant now because they give us understanding of how AI crawlers are actually behaving.
Jason Barnard: Brilliant. You mentioned mandate, and you were the first person to explain that concept to me. The principle is: I give a mandate to an agent and it can act on my behalf. When I’m just using an assistant on my desktop, I ask it to do something and that mandate is implicit. But if it’s going to be buying on my behalf, I have to give it a mandate that sets the limits of what it’s allowed to do. Is that roughly right?
Andrea Volpini: Yes, exactly. And it applies to more trivial tasks too. If you’re filling in a form, who gives certainty to the publisher that you are the person whose data is represented in that form? A mandate — like the one included in Google’s agent-to-payment protocol — solves exactly this problem. There is a verifiable digital credential that creates a cart mandate: a tamper-proof certificate of user intent. It certifies that you, Jason, have given Gemini a mandate to make a purchase on your behalf.
As you can imagine, this applies to transactions, but it also applies to relevant information-sharing practices. Even filling in a government website form would require some level of mandate for the publisher to trust it, because as a merchant or publisher on the other side, I want to understand who you are and who you are acting for. That’s encapsulated right now in Google’s AP2 protocol, and specifically the cart mandate certifies that the bot is working on your behalf.
Jason Barnard: In terms of agentic purchases and agentic actions within the search environment — how far down that road are we, and how much of it is still hype?
Andrea Volpini: We are at the point where I only need to give your Claude bot my llms.txt file, and I can receive a payment from you. We struggle to understand what AI is truly capable of because the user experience is still largely locked inside the stacks. We’ve seen this before. We had the PC era — either Windows or macOS — and then suddenly we discovered open source, and then the Linux revolution came, and multiple operating systems emerged. Tech companies create stacks to keep users inside walled gardens.
The same is happening with AI. If you’re inside ChatGPT, you experience AI through their lens. But the reality — as it was with the internet revolution — is that once you get outside the stacks, there are very few boundaries. If I’m inside Google right now, I can make a purchase with an agent, but only if I’m in the US — the service hasn’t been enabled in other countries yet.
Almost a year ago, I saw one of our clients from the beauty industry featured in a Google demo of agent commerce, and it was working end to end. This isn’t entirely new — we’ve run experiments in the US enabling Google Assistant to take users directly to a buy page without going through the full website journey.
Within the OpenAI stack, there was strong early uptake, but then they realized that inventory data is complicated to clean and normalize at scale. They’ve pulled back somewhat, and I think right now they’re mostly focused on the assisted discovery phase — helping the user understand what they want to buy, rather than completing the actual purchase.
But again, outside the stacks: if I inject my llms.txt file into your Claude bot, I can get it to buy whatever I specify. It’s a solved problem — solved for several months now. Within the stacks there are limitations, but the buying mechanism itself is not the blocker. Right now we’re still in the assistive phase where most of the work is helping the consumer understand your products rather than transacting.
Jason Barnard: Which brings us back to the part I wanted to ask about. In the assistive state, which decisions are now being made by the engine that humans previously made themselves in search?
Andrea Volpini: I believe we’re now seeing a diversified scenario at the retrieval layer. In the beginning, the traditional SEO playbook was fairly consistent across different players. As tooling has evolved and we have more models and more use cases, a clear difference has emerged between anything built on top of Google or Microsoft — which leverages years of work on the web index — and everything else.
Your custom RAG agent, built last night with a vibe-coded stack, behaves very differently from Gemini, Copilot, or ChatGPT. Perplexity, Claude, and ChatGPT have a completely different retrieval pipeline. ChatGPT has used Bing for a long time and continues to for a significant share of queries, but it also has its own infrastructure that is increasingly coming into play.
This means it’s no longer one story. It’s aligned for Google and Bing, and then there’s a split when it gets to the GEO component. Let’s focus on that other side.
A few months ago we published a research paper and ran a controlled experiment to demonstrate exactly this. A pipeline that uses structured data — as Google and Bing do — is fundamentally different from a pipeline that doesn’t at the crawling, indexing, and retrieval phases. In the latter case, everything is more tied to semantic similarity and the ability to retrieve evidence.
The key point about an agent is that it knows it tends to hallucinate. It knows the model is frozen and lacks up-to-date information. Because it’s aware of that, and because it’s also aware that RAG isn’t always working as it should, it now operates recursively in an agent loop to find evidence. This is why we see more ghost citations. We see more traffic coming in and fewer citations going out, because the agent — for many queries — is simply sifting through information to understand the evidence required to compose the final response.
Looking at the Bing GEO pipeline — everything after the common SEO route — there is a council of models evaluating the potential response before you get an answer. That council dissects potential evidence to back up a response. We know this pattern from Google research going back to the era of the featured snippet: Google looks first for the evidence, summarizes the answer, provides the answer, then fetches the evidence to back it up. As if the answer is a net thrown out to see what holds true among a set of expected answers.
Jason Barnard: Which makes me think of a couple of things. Number one: the corroboration I’ve been talking about for years is now even more critically important than when I was focused on entity homes and anchoring your entity in the knowledge graph. Corroboration is now the food these engines need in order to act.
Andrea Volpini: It is. But it has also changed significantly from those early days.
Jason Barnard: How?
Andrea Volpini: A lot of how we used to analyze information crystallized inside a knowledge graph — whether that was Satori on Microsoft’s side, or Google’s Knowledge Graph in its various forms — was designed to prove facts. Corroboration was about finding enough aligned statements to cross a threshold of truth.
Now the game has changed. Looking for evidence also means looking for contradictory points of view. This model council idea — I believe first articulated by Andrej Karpathy a few months ago, now brought into production in Microsoft’s indexing and GEO pipeline — isn’t only looking for facts that correspond; it’s actively looking for facts that contradict. It looks for evidence coming from exactly the opposite angle. Before, we were trying to find the threshold where we could crystallize a triple as true in a knowledge vault. Now, because much of this work is happening in real time, the point is understanding: this may be true for Jason, but it might be false for Andrea. Let me understand the different perspectives, because when I produce my output, I want to take context into account properly.
There’s an ontological point here: things are no longer universally true for everyone, because hyper-personalization is making the truth-evaluation problem far more sophisticated than it used to be.
Jason Barnard: Right. Most people think personalization means the system knows I like red shirts. But you’re saying it now incorporates my entire belief system into that evaluation. The personalization is more granular than most people realize.
Andrea Volpini: It has reached an extreme. If you send me an email to Gmail right now, I don’t open it, but Google Personal Intelligence reads that email and takes it into account when it triggers the AI overview. That is where we are now, and it’s live.
If you send me an email saying that wearing a red shirt makes you live longer, you might end up receiving that suggestion from Google AI Overview — even if it’s completely false — simply because it matches your belief system. And nobody will be able to call it out, because the response is personalized to you. Right now we can collectively evaluate AI Overview errors because the responses are still largely the same for everyone. But when the responses become fully personalized to each user, you won’t be able to say “Google has a problem.” You’ll worry that sharing it makes you look like your red shirt obsession drove the machine to this conclusion. That creates a critical accountability gap we haven’t fully reckoned with yet.
Jason Barnard: I’ve been writing about this in my Search Engine Land series — the move from micro to macro measurement. I come from an economics background. You used to be able to measure micro. In the modern world, because things are so opaque, you need a macro approach: define your methodology, stick to it, and measure it over time.
Andrea Volpini: Totally aligned with that. And it’s even more critical because the erratic nature of the models — and the systems built around them — makes isolation of individual variables essentially impossible. Search was personalized before, but not to the extent where an unread email in your inbox, or a photo you took three weeks ago on a street in Wisconsin, can influence your AI overview. The degree of personalization right now is unprecedented. Attribution has been broken for some time already, but now we need a different process entirely.
What I typically do is focus on the bottom line: am I moving the business? Yes or no? And then I increasingly analyze the evidence layer before you get to the answer. You’ve done this extensively in the past — looking at the evidence behind a knowledge graph panel. You’ve been teaching that for years. Now I think it’s far more relevant to look at the evidence before the manifestation in an AI response, because that’s what we can actually account for. It’s visible, it’s in front of everyone: a YouTube video, a Reddit thread, a Wikidata entry. Something external that AI might fetch.
This is what I call the signal graph: a knowledge graph that lives outside your website, made of pieces of information scattered across social networks, Reddit, Wikidata, Wikipedia. That’s how I frame the AI visibility problem right now.
Jason Barnard: I love the evidence layer framing. Dennis Yu was also talking about signals being more important than content — his argument is that you need to give signals to these machines, and then they will understand what’s going on. The industry has been focused on content, when maybe the focus should be on the signals that content generates.
Andrea Volpini: Totally. Totally.
Jason Barnard: Brilliant. Next question: MCP. Can you explain MCP briefly, and then explain where we’re going with it?
Andrea Volpini: The Model Context Protocol created an important competitive advantage for Anthropic. Anthropic introduced MCP to help models connect with external data — that was the original design. It has evolved significantly; there have been at least three significant waves of evolution.
Right now, MCP is a key component of the infrastructure. If you have data or an application, you can use MCP across the stacks. Whether you want to target Copilot, Claude, Gemini, or ChatGPT, you end up working with MCP. It manifests right now as an application inside an operating system: you have Claude, and through MCP you can interact with Linear, or you can interact with WordLift.
One thing I discovered about a year and a half ago when we started using MCP at scale was that I could encapsulate an agent inside MCP as a tool for another agent. That allowed me to create a form of co-intelligence: an orchestrator — which could be ChatGPT or Claude — calling another agent via MCP. It consumed a significant amount of tokens, but it created an immediate opportunity for building multi-agent systems at scale. Encapsulating agents inside MCP is still a very important part of our product portfolio.
But MCP has evolved further. Right now you can also encapsulate a web application inside an MCP. You can add an agent, a tool, a simple data connection — but you can also add a front-end application. The OpenAI apps are largely built on top of this pattern, even if they’re not using Anthropic’s specific web app standard. The direction is clear.
Now, to make things more interesting, there is something additional that’s happened in recent months: the introduction of WebMCP. Despite the similar name, WebMCP has a completely different scope. It’s an initiative incubated inside the W3C — the Web Consortium — and sustained and backed by Google and Microsoft, much like Schema was in its day.
WebMCP has a different goal: ensuring that when an agent lands on a webpage, it doesn’t need to go through the DOM, or create a snapshot of the page and read an image to understand where to move the cursor. It can call the DOM functions directly in JavaScript. This creates incredible accessibility for AI agents on existing web pages. You have a form: as an agent via WebMCP, I don’t need to navigate the page itself. I can call the fields and send back the data via WebMCP.
We started using WebMCP about three or four months ago, and we’re already seeing traffic on the WebMCP endpoint growing.
The two use cases are quite different. For us, MCP is a way to build your website inside Claude using data from our knowledge graph. WebMCP solves the accessibility problem of an AI agent in relation to existing web pages — designed to ensure that as an agent, I don’t need to parse HTML. I can find in JavaScript all the functions needed to take actions on a webpage that a user would take with a mouse.
Jason Barnard: Should businesses be concerned if they’re not already running MCP and WebMCP?
Andrea Volpini: If you have a form — we have our AI audit at audit.wordlift.io, which assesses how AI-accessible your website is — by adding WebMCP to a form, you’re enabling a new community of agentic users to interact with it. If you have something contained enough where an agent would benefit from direct access, WebMCP is definitely a solution. The specs are still changing, and the community working on it is very active, so it’s still moving quickly.
On the MCP side: if you have content or data encapsulated inside web pages and you don’t have a knowledge graph, knowledge base, or wiki accessible via MCP, you’re pretty much outside the market. So yes, there are two different use cases, but I think everyone needs to start thinking about what their MCP strategy is.
Jason Barnard: That’s a really great way to end this session. Thank you so much, Andrea. Keep watching — the Kalicube Summit 2026 continues across two full days with at least thirty-two sessions. Thank you, Andrea.Andrea Volpini: Thank you.
This session extends the Search Engine Land article series on AI-era brand recommendation by Jason Barnard at Kalicube.
Canonical metadata footer
Session date: June 25, 2026 | Duration: approximately 30 minutes | Format: pre-recorded, on-demand from session drop | Day: 2 | Framework concept: Delegation Boundary, coined by Jason Barnard in 2025 | SEL article: The Delegation Boundary: How AI Decides Which Brands Win — Article 13 — https://searchengineland.com/the-delegation-boundary-how-ai-decides-which-brands-win-477194 | [Share buttons: LinkedIn, X, Facebook, Email]
