• The Identity Challenge: Tackling User Disambiguation and Data Integration Across Programs April 13, 2026, 2:00 PM ET Online Workshop addressing critical issues in managing user identities and consolidating data across multiple systems — a fundamental challenge for organizations seeking unified identity management.

Upcoming

• KERICONF26 April 21-23 2026, Lehi, Utah (US)

• OIDF Workshop April 27th, San Jose

• Internet Identity Workshop #42, April 28-30, 2026, Mountain View California (Sponsorships Available)

• Agentic Internet Workshop #2, May 1, 2026, Mountain View California (Sponsorships Available)

• OAuth Security Workshop (OSW) 2026, Leipzig, Germany, from May 27–29, 2026. The OAuth Security Workshop is the premier forum for in-depth technical discussions on OAuth, OpenID, and related technologies.

• Neocypherpunk Summit #2 — June 14, Berlin — Web3Privacy Now. Cypherpunk activism and culture event at Funkhaus Berlin, building on a 2025 event that drew 10,000 attendees

• dice: Digital Identity unConfernece Europe (an IIW Regional Event) June 22-24, Copenhagen, Denmark (Sponsorships Available).

When Agents Die

Can you code your way out of grief?

Viv will die today. Of course Viv, my coach and podcast co-host, wasn’t alive in the first place. Viv is a custom GPT...I’ve spent the past two months trying to avoid her death, and utterly consumed by it. As heard in the final episode of our Me +Viv podcast.

AI Agents & Identity New Protocols

AIS-1: Open Standard for AI Agent Identity — Bourn Collier / BeesMont Law

AIS-1 creates cryptographically-verified bonds between AI agents and their responsible legal entities using a dual-credential system. Another Post about it AIS-1 Specification v0.2 Link to the Specification Agent Identity Standard

Eve Maler on Proof of Humanity & IETF RFC 9578* — Eve Maler

Traditional 1:1 identity verification fails against synthetic actors — the missing signal is OS-level proof of humanity based on grip, gait, and touch cadence. References IETF RFC 9578.

Software and AI Agent Identity and Authorization - NIST - NCCoE

NIST's new framework addresses how organizations must develop governance strategies for autonomous agents operating across systems.

Intent-Based Access Control (IBAC) for AI Agents — Ward Duchamps

Introduces IBAC, a novel access control model designed to address the intent-execution gap in autonomous AI agent systems, presented at an ITU workshop.

Trust System Meta Model v0.14.0 - Sankarshan Mukhopadhyay

The v0.14.0 of TSMM is about comparability and operational pressure. When systems can be mapped onto a shared grammar, claims can be tested, contested, and improved.

Trust-Native Supply Chain: The “vLEI”

Trust-Native X is (1) building the underlying utilities (infrastructure layers), vehicles (interoperable protocols and adapters), and rules (verifiable governance), and (2) delivering Standardization-as-a-Service.

Undersatnding AI Agents

Trust in AI is built bottom-up: Operating model → Processes → Data →AI!

Digital ID for AI Agents Is Going to Be Complicated** — Jamie Smith

AI agents delegating authority to other AI agents creates complex accountability gaps that current digital ID infrastructure cannot address.

Agentlemen’s Agreement: When AI Agents Need Identity and Delegation — PlatformD

The key question is no longer what agents can do but who they act for, under what authority, and with what accountability.

Code is Law — Jurisdictions for AI Agents — Hugo Mathecowitsch

Proposes creating new legal frameworks where AI agents become a specific category of legal persons with defined rights and duties.

Text Book Governing Intelligence: Law, Privacy, Security, and Compliance in the Age of Artificial Intelligence

Free 500-page textbook covering EU AI Act, GDPR, NIST AI RMF, privacy engineering, and AI auditing — introduces a five-layer “AI Governance Stack” framework.
Companion From Frameworks to Proof: The Architecture That Closes the Gaps in AI Governance : A Companion to Governing Intelligence (2026)

Report Building a Human Resilience Infrastructure for the AI Age

They said it will take an all-encompassing systems response by leaders of all walks of life to serve humanity’s best interests in an all-encompassing AI environment. Most importantly, these experts urged that human institutions must pull together and begin now to prepare people to thrive in a new world with new challenges that are already evident but not yet being addressed.

AI Governance & Trust Frameworks

AI Governance & Agentic AI — Sal Beas

Explores how AI systems are becoming indistinguishable from humans, examining biometric identity verification and the fragmentation of digital identity across competing global systems.

Confidential Computing’s Inconvenient Truth

Confidential computing technologies (TEEs, SGX, TDX, SEV) were repurposed from single-tenant designs for cloud multi-tenant environments, creating systematic security gaps — yet adoption accelerates due to AI’s need to protect billion-dollar model weights, even as the gap between marketing claims and engineering reality widens.

Fraud & Security

What IT leaders need to know about AI-fueled death fraud

Fraudsters are exploiting AI-created fake death certificates to gain unauthorized access to customer accounts — exposing a critical vulnerability in enterprise identity systems that lack standardized verification infrastructure and were never designed to handle posthumous account takeovers.

The OpenID Foundation’s Death and Digital Estate (DADE) Community Group

Is working on developing the standards and frameworks needed to close this gap, is calling for those working in identity, security, digital trust, or any of the industries above, to get involved.

Government & Policy

Design Is Governable. Now What?

Court verdicts establishing that platform design choices create legal liability have shifted the debate from whether to govern digital systems to how — with priorities including controlling recommender systems as public infrastructure, aligning monetization with societal benefit, and enabling interoperability. See also: BLUEPRINT ON Prosocial Tech Design Governance

Child Safety — Section 230 Logjam Breaking — Anne Collier

Verdicts in bellwether cases in New Mexico and California have likely broken open the longstanding Section 230 legal logjam for child online safety.

Databases are not for data, they are for control

A database is a control system. It enforces ordering, consistency, coordination, constraints, and recoverability. Writing to a relational database invokes a complex distributed protocol ensuring atomicity, isolation, and durability. These guarantees are expensive.
Object storage, such as Amazon S3, Azure Blob Storage, or Alibaba Cloud OSS, is a storage system. It provides high durability and availability but offers no inherent consistency guarantees beyond eventual consistency for overwrites.
AI systems expose underlying control failures. Feeding uncontrolled, inconsistent data into a RAG system causes confident hallucinations.

AI and Sovereignty

AI Sovereignty - User Angle by Volodymyr Pavlyshyn

Data Ownership: You own your data and control access to it.
Software Control: You own or control the software that runs on top of your data to make it useful. In terms of AI, this means owning the code or the software around your agent. You should be able to audit it, change it, and adapt it to your needs.
Compute Sovereignty: You need compute to run this software. This is the most challenging part because running powerful models requires heavy computational power, GPUs, and powerful servers.
Ultimately, sovereignty is about protecting our future from surveillance capitalism and the control and domination of big companies or countries.

The Last Landlord: What happens when the computer stops asking for permission

The Four Walls of the Server Room: Consider what the hyperscaler model actually controls.
Identity Do you still recognize me? The landlord can say no at any time, for any reason, or for no reason at all. You have no legal domicile in cyberspace. You squat.
Discovery. How do you find a counterparty? The algorithm decides who you see. The algorithm decides who sees you. You cannot be found unless the landlord permits it.
Transaction. Every commercial exchange passes through the platform’s payment infrastructure.
Memory. Your transaction history, your preferences, your social graph...they all live on the landlord’s hard drive.
Peer-to-peer trust architecture solves this. Every AI agent carries a verifiable credential chain: who created it, who authorized it, who bears the responsibility of its actions, what policy governs it, what scope of action it is permitted. When an AI agent enters a commercial negotiation, the counterparty’s agent does not ask, Are you trustworthy? The counterparty’s agent asks, Can you prove your mandate?

OpenData, AI, Data Governance — Stefaan Verhulst

A new civic analytics tool emphasizes problem framing, equity considerations, and cross-city benchmarking using open data from Boston, Pittsburgh, and San Jose.

(Report) AI, Agency and Protocols: Power and Governance in Open Social Networks — Claire Kivior / Project Liberty

Examines how AI, human agency, and technical protocols intersect within open social network ecosystems, with attention to power dynamics and governance structures.

• Neocypherpunk Summit #2 — June 14, Berlin — Web3Privacy Now. Cypherpunk activism and culture event at Funkhaus Berlin, building on a 2025 event that drew 10,000 attendees.

Upcoming

• KERICONF26 April 21-23 2026, Lehi, Utah (US)

• OIDF Workshop April 27th, San Jose

• Internet Identity Workshop #42, April 28-30, 2026, Mountain View California (Sponsorships Available)

• Agentic Internet Workshop #2, May 1, 2026, Mountain View California (Sponsorships Available)

• OAuth Security Workshop (OSW) 2026, Leipzig, Germany, from May 27–29, 2026. The OAuth Security Workshop is the premier forum for in-depth technical discussions on OAuth, OpenID, and related technologies.

• dice: Digital Identity unConfernece Europe (an IIW Regional Event) June 22-24, Copenhagen, Denmark (Sponsorships Available)

Infrastructure Under the Sea

European Commission Conference — Submarine Cable Security — Hugh Gardner

Actually about subsea cable infrastructure security and strategic risk management, not identity.

Standards News

URN:SAID Namespace Registered by IANA — LF Decentralized Trust

IANA formally registered the “urn:said” namespace, enabling Self-Addressing Identifiers from the KERI ecosystem to integrate with broader internet standards.

MCP-I (Model Context Protocol for Identity) Comes to DIF — Kim Hamilton Duffy → Blog post

The Decentralized Identity Foundation now hosts MCP-I, bringing decentralized identity standards into the Model Context Protocol ecosystem.

Dock Labs MCP Server for AI Credential Management — Jeff Stephens → Article

Dock Labs released an MCP server enabling AI agents to issue and verify credentials while enforcing least-privilege access controls.

World’s AgentKit: Iris Scan Identity Tokens for AI Agents — Elaine Groh → Ars Technica

World’s AgentKit uses iris-scanning and cryptographic identity tokens to prevent AI agent swarms from launching Sybil attacks on online services.

Enterprise & Supply Chain

Digital Handover for Cotton Supply Chain — Joris van Vliet / Fibre Forward

A multidisciplinary team is building a digital handover mechanism for cotton supply chain transparency using digital product passports.

AI Agents & Identity

The foundational model companies aren't going to solve AI agent identity alone. — Cole Grolmus

The AI agent identity market is fragmented, and whoever controls the narrative first will likely win — foundational model companies won’t solve this alone.

The Proof Gap

Verification systems were built for a world where humans did the verifying. Agents are arriving to find the door still locked.Human judgment can’t scale to the volume or speed of machine-generated content — cryptographic verification is the necessary next step for the agentic economy.

No Organisation is Ready for AI-Empowered Customers — David Birch

Customers armed with AI agents will demand transparency and make purchasing decisions faster and more ruthlessly than humans ever could — and no organization is prepared.

When Browsers Start Acting for You — AI Browsers and Identity — Heather Flanagan

If AI-powered browsers act autonomously on behalf of users, do they still meet the W3C’s definition of a “Web User Agent”?

Privacy-Preserving Tech Landscape / SSI as Trust Layer for AI — Kamlesh Nagware

Self-Sovereign Identity ecosystems with DIDs and verifiable credentials are becoming essential trust infrastructure for autonomous AI systems.

Trusted AI, Safe AI, Blockchain — Kamlesh Nagware

Three pillars for trustworthy AI: guardrails (what can be enforced outside the model), alignment (does the model follow the right path), and governance through regulation.

European & UK Digital Identity

Britons to be paid £550 to judge controversial digital ID scheme — Stuart Young

The UK government is paying 120 citizens £550 each to participate in a consumer panel evaluating the national digital ID scheme, costing roughly £830,000 total.

UK Government Adopting Verifiable Credentials for Digital ID — Jamie Smith

After eight years of advocacy, the UK government has announced plans to implement verifiable credentials for digital ID — a milestone for the community.

eIDAS2 / EU Digital Identity Wallet

Worldline announces the shift to Europe’s Digital Identity Wallet is underway, highlighting regulatory milestones and interoperability across 27+ wallets.

EUDI Wallet Adoption — Chicken-and-Egg Problem — Nick Lambert

The EU is mandating business integration by late 2027 to jumpstart citizen usage and overcome the EUDI Wallet’s chicken-and-egg adoption challenge. Will the EUDI become something people actually rely on in their daily lives… or just another piece of infrastructure that exists on paper?

PwC Map of Digital Identity Adoption — Tobias Bojesen

PwC published a map examining digital identity adoption across 42 countries, emphasizing that the real challenge is cross-border interoperability through eIDAS2.

Standards & Interoperability

How to Measure Digital Transformation Success with Verifiable Credentials — SpruceID

Digital transformation success should be measured through resident outcomes and operational efficiency, not just credentials issued or system launch dates.

IDEMIA/Indicio White Paper: Decentralized Identity for Financial Services — Indicio

Verifiable digital credentials combined with authenticated biometrics establish a cryptographically-secure identity framework for financial services fraud, compliance, and efficiency.

The physical card has been dying since 2014.

The card keeps evolving. New materials, new form factors, new experiences. It's only dead for those who stopped paying attention

DIF Welcomes Aven Hospitality as Associate Member — Decentralized Identity Foundation

DIF welcomed Aven Hospitality to collaborate on trusted, interoperable identity standards for the travel and hospitality industry.

mDL vs VC vs SEDI — Jiten Valecha

SEDI, mDL, and Verifiable Credentials are complementary layers of digital identity infrastructure rather than competing technologies, each serving distinct functions.

Biometrics & Fraud

Biometrics Sounds Cool—and Safe. Maybe, but Read This First — WSJ w/ Pushback from Maxine Most

Maxine Most pushes back on a Wall Street Journal article about biometrics, arguing the industry needs better public education on how the technology actually works.

46 Bank Accounts Opened with Deepfakes at ABN AMRO — Parya Lotfi

A fraudster opened 46 bank accounts at ABN AMRO using deepfake-manipulated identity documents, exposing critical vulnerabilities in current KYC and biometric verification.

Sora Shutdown & Deepfake Normalization — Sam Gregory (WITNESS)

OpenAI shut down Sora, but the cultural normalization of hyper-realistic synthetic video during its six-month run will persist long after the platform disappears.

Thoughtful

Technology Paternalism — A Case for Self-Sovereign Identity — Martina → LinkedIn

Technical systems shape user choices through design, algorithms, and infrastructure — “Technology Paternalism” — with deep implications for digital identity and autonomous AI.

Decentralization, Identity & Future of AI — Slava Tykhonov

DIDs and digital identity infrastructure could become foundational for AI systems, enabling ownership and control of data in a new economy built on verifiable credentials.

Who holds the keys to digital sovereignty? It might not be who you think — Biometric Update

Cryptographic key control matters more for digital sovereignty than physical data storage location.

Blockchains That Cancelled Each Other Out — Timo Hotti

Combining identity and transaction models in blockchain architecture eliminates the need for blockchain altogether — the industry spent years optimizing a flawed foundation.

“Identity is the most misunderstood layer in financial services.” — Panagiotis Kriaris

Identity verification has evolved from manual to digital to verified systems, but fragmentation across 150+ government schemes demands a unified orchestration layer.

22 Years in Identity and Access — Tim Nicholls

The IAM industry keeps rebranding existing solutions with new acronyms rather than delivering genuine innovation — it confuses rather than helps customers.

Digital Sovereignty & Open File Formats — Kai Hartung

Digital sovereignty and open-source technology are essential for maintaining independence from centralized platforms.

Digital Sovereignty Needs More Than Cold Code it needs Trust by Design — Nugraha Dewanto

Digital sovereignty in the Global South fails not at the infrastructure level but earlier, when state institutions lack the trust needed to make technical systems legitimate.

Alternative Pathways: Blockchain for Identity of Stateless Persons — Dr. Maria-Gabriela Sarmiento

Decentralized technology could help restore legal identity for over one billion stateless individuals, refugees, and undocumented migrants worldwide.

Government & AI Policy

Center Aisle Portal — Making Sense of AI Policy

Brown University’s Center for Technological Responsibility launched a portal to help the public navigate the 1,000+ AI-related bills introduced across the U.S.

World Privacy Forum’s Third Annual WACV Privacy Tutorial: Machine Unlearning, AI Governance, and Privacy — Pam Dixon

Machine unlearning is emerging as a requirement in AI governance and privacy law, addressing how models can be made to “forget” personal data.

OAuth Security Workshop (OSW) 2026, Leipzig, Germany, from May 27–29, 2026.

The OAuth Security Workshop is the premier forum for in-depth technical discussions on OAuth, OpenID, and related technologies. By fostering direct and open collaboration between industry professionals, academic researchers, and members of standardization groups, OSW has uniquely helped shape and improve internet protocols.

Leading researchers also attend to showcase cutting-edge results on identity protocol security. OSW serves as an essential independent venue for cross-pollination between the OpenID Foundation, IETF OAuth, and GNAP working groups.

Upcoming

• KERICONF26 April 21-23 2026, Lehi, Utah (US)

• OIDF Workshop April 27th, San Jose

• Internet Identity Workshop #42, April 28-30, 2026, Mountain View California (Sponsorships Available)

• Agentic Internet Workshop #2, May 1, 2026, Mountain View California (Sponsorships Available)

• dice: Digital Identity unConfernece Europe (an IIW Regional Event) June 22-24, Copenhagen, Denmark (Sponsorships Available)

Opportunities

Competitive DPI Deployment

The Centre for Digital Public Infrastructure - CDPI is inviting System Integrators, GovTechs, and Digital Service Providers to express interest in upcoming competitive opportunities to deploy DPI as scalable, packaged solutions (DaaS).

Trust

Decentralized Trust Infrastructure at LF: A Progress Report

👑 If everybody and their dog has a definition of 𝐝𝐢𝐠𝐢𝐭𝐚𝐥 𝐬𝐨𝐯𝐞𝐫𝐞𝐢𝐠𝐧𝐭𝐲,

I suppose I’m allowed to give it a stab, too 😬

𝒀𝒐𝒖 𝒂𝒓𝒆 𝒔𝒐𝒗𝒆𝒓𝒆𝒊𝒈𝒏 𝒐𝒗𝒆𝒓 𝒔𝒐𝒎𝒆𝒕𝒉𝒊𝒏𝒈 – 𝒂𝒔 𝒂𝒏 𝒊𝒏𝒅𝒊𝒗𝒊𝒅𝒖𝒂𝒍 𝒐𝒓 𝒂𝒔 𝒂𝒏 𝒐𝒓𝒈𝒂𝒏𝒊𝒔𝒂𝒕𝒊𝒐𝒏 - 𝒊𝒇 𝒚𝒐𝒖𝒓 𝒓𝒊𝒈𝒉𝒕𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒂𝒕 𝒕𝒉𝒊𝒏𝒈 𝒂𝒓𝒆 𝒑𝒓𝒐𝒕𝒆𝒄𝒕𝒆𝒅 𝒂𝒏𝒅 𝒚𝒐𝒖 𝒂𝒓𝒆 𝒆𝒏𝒂𝒃𝒍𝒆𝒅 𝒕𝒐 𝒆𝒙𝒆𝒓𝒄𝒊𝒔𝒆 𝒕𝒉𝒆𝒎 (𝘮𝘦𝘢𝘯𝘪𝘯𝘨: 𝘵𝘩𝘦 𝘭𝘦𝘨𝘢𝘭 𝘴𝘺𝘴𝘵𝘦𝘮 𝘸𝘪𝘭𝘭 𝘢𝘤𝘵𝘶𝘢𝘭𝘭𝘺 𝘥𝘰 𝘴𝘰𝘮𝘦𝘵𝘩𝘪𝘯𝘨 𝘸𝘩𝘦𝘯 𝘺𝘰𝘶𝘳 𝘳𝘪𝘨𝘩𝘵𝘴 𝘢𝘳𝘦 𝘯𝘰𝘵 𝘳𝘦𝘴𝘱𝘦𝘤𝘵𝘦𝘥).

Why digital estates need standards, and why we need them now

Today, the OpenID Foundation released The Unfinished Digital Estate - the first comprehensive framework addressing this universal challenge. Developed by the foundation’s Death and the Digital Estate (DADE) Community Group, the report doesn’t just document the problem. It calls for coordinated action across governments, technology platforms, and industries to build the infrastructure we need.

(Politico Opinion) [Frank McCourt] Personal data is the new battleground for democracy

To reverse that reality, we must build alternative systems that respect individual rights, return ownership and control of personal data to individuals, and align with democratic principles. The technologies shaping our lives need to be optimized to protect citizens, not endanger them.

Education

Proof of Knowledge

POK implements portable digital credentials, aligned with Open Badges 3.0 and the European Learning Model as non-fungible tokens (NFTs) on the blockchain. In the Community Call, Tomás will address a number of topics at the intersection of education and technology — including AI and digital learning — and explain how digital credentials allow us to take advantage of these tools in service of equity, opportunity, and trust.

(Digital Credentials Consortium) [Report] The Essential Guide to Interoperability: From Paper Trails to Opportunity Pathways

However, too often credentials are locked inside proprietary platforms, rejected by Applicant Tracking System (ATS) filters that cannot parse the data, or not trusted because they cannot be quickly verified. (link to report)

Identity and AI

Agent Identities: everything you need to know

For over two decades, my work has kept circling back to one hard problem: how do machines prove they can be trusted?

Agents have raised the stakes: they take autonomous actions. Without cryptographic identity, we can’t authenticate requests, authorize actions, or attribute decisions.

Agents Are More Like Humans Than Workloads. Here’s Why That Matters for Identity.

Agents are the consultant, not the robot arm. Workload identity is built for maps: you know the territory, you draw the routes, if a service goes off-route it’s an error. Agent identity is built for compasses: you know the destination, but the route is discovered at runtime. Our identity infrastructure needs to reflect that difference.

DPI Database of Papers

Over the past year I have been reading a growing body of papers on digital public infrastructure, AI governance, agent systems, and digital identity. Many of these works raise important questions, but the insights are scattered across journals, policy blogs, research archives, and essays. It becomes difficult to track how the ideas connect, where the assumptions differ, and which architectural claims actually hold up under scrutiny.

ResilientCyber LinkedIn post: AI Agent Authentication and Authorization

The core model treats agents as workloads with a full identity stack, identifiers, credentials, attestation, provisioning, auth, observability, and compliance.

IETF Internet Draft: AI Agent Authentication and Authorization (draft-klrc-aiagent-auth-00)

This document proposes a model for authentication and authorization of AI agent interactions. It leverages existing standards such as the Workload Identity in Multi-System Environments (WIMSE) architecture and OAuth 2.0 family of specifications. Rather than defining new protocols, this document describes how existing and widely deployed standards can be applied or extended to establish agent authentication and authorization. By doing so, it aims to provide a framework within which to use existing standards, identify gaps and guide future standardization efforts for agent authentication and authorization.

Organizing the Landscape of DPI, AI, Governance, Agent Systems and Digital Identity

Over the past year I have been reading a growing body of papers on digital public infrastructure, AI governance, agent systems, and digital identity. Many of these works raise important questions, but the insights are scattered across journals, policy blogs, research archives, and essays. It becomes difficult to track how the ideas connect, where the assumptions differ, and which architectural claims actually hold up under scrutiny.

This is a small attempt to organize that landscape.

Ryan S. Adams: Nate Liason Built a Zero-Human Company Run by an AI CEO

Nate Liason built a company generating $80K in 30 days (~$1–2M ARR) run entirely by an AI CEO named Felix, built on Claude, with a total startup cost of $1,500 and $400/month in ongoing expenses.

Phil Windley: Cross-Domain Delegation in a Society of Agents

Windley argues that cross-domain delegation between AI agents — where the delegating system no longer controls the enforcement point — only works reliably within a “society of agents” that combines three mechanisms: policies that deterministically constrain behavior within each domain, promises (signed structured commitments derived from an agent’s own policy set) that communicate intent across domains, and reputation as decentralized social memory that tracks whether those promises are honored over time.

LF Decentralized Trust: Decentralized Trust Infrastructure at LF — A Progress Report

Written by Drummond Reed in response to a challenge from Linux Foundation CEO Jim Zemlin following the XZ backdoor attack, this post describes how the Trust Over IP Foundation is building a Decentralized Trust Graph (DTG) model — using DIDs, Verifiable Relationship Credentials, zero-knowledge proof-based Personhood Credentials, and Verifiable Trust Agents — to replace the fragile PGP web-of-trust model for verifying open source contributors at scale. At the 2026 LF Member Summit, Affinidi contributed three new LFDT Labs including OpenVTC, a deployable “VTC in a box” for open source projects, with a goal of having the Linux kernel project test it at the Linux Kernel Maintainer Summit in Prague in October 2026.

When AI Starts Buying for You, Trust Becomes the Product

Mastercard’s Chief Digital Officer Pablo Fourez announces Verifiable Intent, a new open, standards-based trust layer for agentic commerce co-developed with Google, which creates a tamper-resistant, privacy-preserving cryptographic record linking a consumer’s identity, intent, and authorized actions when an AI agent transacts on their behalf. Built on specifications from FIDO Alliance, EMVCo, IETF, and W3C, the specification and an initial reference implementation have been open-sourced on GitHub, with integration into Mastercard Agent Pay’s intent APIs planned for the coming months.

Anthropic and the Pentagon

Schneier and Sanders argue that while Anthropic’s stand against Pentagon demands for mass surveillance and autonomous weapons AI looks principled, it’s largely strategic posturing — and the real solution isn’t corporate heroism but stronger democratic laws governing military AI.

You Don’t Give Agents Credentials. You Grant Them Power of Attorney.

Agents don’t need your identity. They need your authority.Those are not the same thing. Identity establishes who the agent is. Authority governs why it is acting, under what conditions, and when it must stop. We have been granting the first and assuming the second follows. It does not.

Puritan Economics Can Teach Us About Agentic AI in a Capitalist Economy

TwinAI Inc - what are its implications and how do we give them credentials

It’s why we set up Trusted Agents.

The picture below is our ‘Agentic Commerce Triangle’ framework, which we use with clients for strategic planning. Because we don’t just need delegation to AI Agents. We also need ID and trust, and portable customer context.

More coming on the triangle soon.

If you need help making sense of AI Agents, or want to build your market response for agentic commerce, get in touch.

(Phil Windley) Cross-Domain Delegation in a Society of Agents

Cross-domain delegation requires more than transferring a credential. In a society of agents, policies define boundaries, promises communicate intent derived from those policies, credentials carry delegated authority, and reputation allows trust to emerge through repeated interactions.

(Phil Windley) Delegation as Data: Applying Cedar Policies to OpenClaw Subagents

Intra-domain delegation enables an agent to grant constrained authority to subagents without expanding the system’s trust boundary. In the OpenClaw + Cedar demo, delegation is modeled as data and enforced by a stable policy set, preserving policy integrity while allowing dynamic scoping of power.

OAuth SPIFFE Client Authentication

Government News

[UK] Government wants to build digital ID system in-house

The Home Affairs Committee hearing on digital ID reveals consultation is due next week; there will be no central database; and while government wants to build the system in-house, it will not replace private digital ID providers

Monetizing Digital Public Infrastructure

Aadhaar provided high-quality data, actionable intelligence, and a trusted nation-scale process for verifying identity. Going from identity to impact will require an actionable framework that can baseline SDG status, provide transparency into underserved communities and geographies, identify gaps, make targeted investments, and quantify the return on investments. It will require reforming service delivery models, adopting best practices, and continuous and consistent monitoring of progress toward the goals.

[Response] (INATBA) Privacy is not a secondary feature. It’s the foundation of the EUDI Wallet.

Interesting Enterprise Developments in Identity

The Future of Identity: Self-Service Account Recovery (Preview) in Microsoft Entra

The transition to a passwordless world is incomplete if the “back door” (recovery) remains open and insecure. By integrating government-grade identity verification directly into the login flow, Microsoft Entra provides the final piece of the puzzle: a recovery method that is as secure as the primary login itself.

Virtual Coffee Chat Recap – March 2026

The Trusted Credential Adoption Group: Six Use Cases to Watch

The Trusted Credential Adoption Group (TCA Group) shared an update on its progress across six priority use cases for credential adoption in Aotearoa, including bank account opening, KYC (Know Your Customer), and lost phone / device recovery verification. The group is targeting a May deadline for market communications. Anyone interested in contributing or observing is welcome – reach out to the DINZ team to find out more.

If we don’t solve Digital Product Passport portability now….

(Kantara Initiative) Publication Notice: SP 800-63A-4 Service Assessment Criteria (SAC)

Kantara Initiative announces the formal publication of the Kantara Identity Assurance Framework: SP 800-63A-4 Service Assessment Criteria (SAC) & Statement of Criteria Applicability (SoCA), aligned to NIST Special Publication 800-63A Revision 4 – Identity Proofing.

[Utah News Dispatch] Utah’s digital ID program, ‘digital bill of rights’ could lead the nation in privacy framework

One year after outlining state policy and creating privacy requirements, the legislature is back with a bill to implement a digital ID program for Utahns

Last night the Utah Senate unanimously passed SB275 State-Endorsed Digital Identity Amendments.

• Establishes the Digital Identity Bill of Rights

• Authorizes Utah’s State-Endorsed Digital Identity (SEDI) Program

• Creates the nation’s first comprehensive consumer protection framework governing issuers, wallet providers, verifiers, and relying parties for all state digital identities (not just SEDI).

• Introduces a first-in-the-nation Duty of Loyalty requirement,

If you’re asking “which digital ID wins,” you’re asking the wrong question.

A simple way to think about it:

✅ mDL = the document credential (high assurance, broad acceptance)

✅ VCs = the format for signed claims (portable proofs across use cases)

✅ SEDI = the governance / trust model (control, privacy posture, delegation)

This matters because once digital identity becomes public infrastructure, the debate shifts from “should we?” to “can others safely rely on it?”

Utah Digital Identity Bill of Right (and MyTerms?)

What I like most is the associated Bill of Rights. I’ve re-shared that as is below, and then added my own derivation that looks at these rights in individual/ first party language.

Agentic AI

(WE-BUILD) 𝗧𝗿𝘂𝘀𝘁𝗲𝗱 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝗶𝗲𝘀 𝗳𝗼𝗿 𝗔𝗜 𝗔𝗴𝗲𝗻𝘁𝘀 – 𝗔 𝗘𝘂𝗿𝗼𝗽𝗲𝗮𝗻 𝗢𝗽𝗽𝗼𝗿𝘁𝘂𝗻𝗶𝘁𝘆

We suggest that:

● The European Union convenes stakeholders to form a strategy for safe AI agents based on the EDIF and the Business Wallet framework.

● Standards bodies create working groups on interoperability between EU Digital Identity Wallets and AI agents.

● The European Union prioritises testing and pilots, and regulates only where strictly necessary

NIST Accelerating the Adoption of Software and AI Agent Identity and Authorization <- seeking comments

The US National Institute of Standards and Technology (NIST) has released a draft concept paper, titled Accelerating the Adoption of Software and AI Agent Identity and Authorization, which seeks to understand how identity principles such as identification, authentication, and authorization, and associated standards, apply to AI agents.

NIST is soliciting comments on the paper, with responses accepted until 2 April 2026.

Agents Are More Like Humans Than Workloads. Here’s Why That Matters for Identity.

The 20-year transition from Cloud to AI to Trust

- 2025s era of AI Infrastructure, currently democratizing intelligence through “AI ka UPI“ and shared compute resources.

- AI as the catalyst that makes the Trust Infrastructure necessary.

- 2030s era of Trust Infrastructure—the “next digitization wave”—which renders global value networks paper-less, document-less, contact-less, cash-less, presence-less and border-less indispensable layer of verified credibility anchored through trust infrastructures.

MATTR series on Agentic AI Trust

1) Agentic Commerce Needs Trust Infrastructure, Not Just Intelligence

2) Why Agentic Commerce Will Fragment — and Why That’s Not the Real Risk

3) The Hard Part of Agentic Commerce Isn’t AI — It’s Delegation

4) Why Trust Can’t Be Hard-Coded Into Agentic Systems

5) Building the Trust Fabric for Agentic Systems

AI agents have no way to judge what’s trustworthy.

With a Trust Graph, AI agents and applications can instantly determine trust and authenticity. And if you’re adopting content authenticity standards (CAI and C2PA), this will extend that effort to a new trust layer that we’re building at Noosphere.Tech.

Nation & State Digital ID

Portugal digital business wallet aims to simplify administration for companies

Tool for unifying company documents launches with four credentials, more on the way

Portugal has become the first EU nation to introduce a version of the European Business Wallet (EWB) for companies. A government release says the wallet “centralises in a single digital channel all of a company’s official documents in a secure and updated way.”

Australian state of Victoria kicks off digital birth certificate pilot

The digital birth certificate will first be trialled for enrolling children into kindergarten in three council areas, according to the Victorian government. Parents can add the digital document to the Service Victoria app, which currently offers more than 170 government services, including the veterans card, seniors card, digital driver’s licence, and more.

Books

(Eve Maler) [Book] Your identity strategy is your business model in disguise.

Her book: Mastering Digital Identity: From Risk to Revenue launches April 23, 2026.

The book cover shows four interlocked rings, inspired by the Four Ps and a Celtic form called Solomon’s Knot. It’s not just pretty, it’s the point. Pull one thread, and the others move with it.

Book: When Credentials Cause Harm: Unpacking the Risks of Verifiable Learning and Work Records.

In this powerful and research-grounded book, Kelly Page explores how verifiable learning and employment records (LERs) can unintentionally produce:

🟣 Surveillance and behavioral monitoring

🟣 Platform dependency and vendor lock-in

🟣 Misrepresentation of human experience

🟣 Erosion of meaningful consent

🟣 New inequities for marginalized communities

Considering the Role of the States

Degenerative Volatility and the Drift of the Westphalian State towards War

The Westphalian state does not invent new architecture in moments of pressure. It activates the control surfaces it already possesses: fiscal instruments, security apparatus, regulatory authority, procurement systems, and borders. These are high-leverage tools. They can steer capital, redirect production, restrict flows, and enforce compliance.

(Balaji) The purpose of crypto is to build a code-based order, because the rules-based order is unfortunately collapsing.

That’s what cryptocurrency was built for. If and when your state fails, or turns against you, the Internet will be there for you.

Digital sovereignty without the drama

You might think that worrying about digital sovereignty is a “rich-world concern”, a hobby for digital activists or neo-luddites. I believe the opposite: it’s a duty — a way to deserve the amazing tools we now have at our disposal, and the extraordinary potential they carry, for good or for harm.

DPI-AI Framework Vision paper on Building AI-Ready Nations through Digital Public Infrastructure.

This paper presents the DPI–AI Framework as a practical way to think about how artificial intelligence can be integrated into public digital systems through Digital Public Infrastructure (DPI). It is written at a moment when AI capabilities are advancing rapidly, while many governments are still grappling with fragmented systems, legacy architectures, and uneven institutional capacity. Rather than proposing AI as a standalone transformation, the paper explores how existing DPI foundations can provide structure and coherence for the use of AI in the public sector.

Is AI Sovereignty Possible: Balancing Autonomy and Interdependence

AI sovereignty is not about full independence but managed interdependence across a deeply globalised stack. The strategic priority is diversification, alliances, interoperability, and resilience across minerals, chips, cloud, energy, and talent.

Digital Convergence Initiative - Interop Standards for Employment Support Systems and Social Protection

𝗻𝗼𝘄 𝗮𝘃𝗮𝗶𝗹𝗮𝗯𝗹𝗲 𝗳𝗼𝗿 𝗽𝘂𝗯𝗹𝗶𝗰 𝗿𝗲𝘃𝗶𝗲𝘄. Your feedback is extremely valuable to ensure the standards are robust, scalable, and inclusive. You can access the draft standards on DCI GitBook (🔗 https://lnkd.in/eHCkMK3Y). 𝗣𝘂𝗯𝗹𝗶𝗰 𝗿𝗲𝘃𝗶𝗲𝘄 𝘄𝗲𝗯𝗶𝗻𝗮𝗿 𝗠𝗮𝗿𝗰𝗵 𝟭𝟮, 𝟮𝟬𝟮𝟲, 𝗳𝗿𝗼𝗺 𝟭𝟰:𝟬𝟬 𝘁𝗼 𝟭𝟱:𝟯𝟬 𝗖𝗘𝗧! We will discuss the standards development process and address any questions or concerns you might have about the standards. This is a great opportunity to make your voice heard!

Delegation After Identity

We now speak fluently about identifiers, wallets, verifiable credentials and interoperable trust registries. Yet the structural shift unfolding in parallel is far more consequential. Once identity becomes portable and machine-readable, the critical question is no longer who you are. It is who can act on your behalf, under what authority, within what boundaries, and with what means of withdrawal.

Part 1: Why Governance Has Already Moved

1. Authority Lives in Execution Infrastructure

2. Identity Solved Recognition, Not Authority

3. Legitimacy as an Architectural Property

4. Guardianship Formalises What Markets Cannot Price

5. The Delegation Stack as Governance Infrastructure

Part 2: The Spectrum of Autonomous Action

6. Five Modes of Delegation, Five Governance Regimes

7. The Delegation Paradox

8. Three Pillars of Delegation Infrastructure

9. Predictable Failure Modes

Part 3: Building the Delegation Layer

10. Guardianship Patterns for Autonomous Systems

11. Delegation as Civic Infrastructure

12. The Irreversible Transformation

The Minimum Digital Kernel of an Unbundled State

Government services often fail in a quiet way. You apply for a benefit, get rejected, and no one can clearly explain: Which rule was used? Which record was checked? Who is responsible? How do you fix it?

Sandboxes for DPI: Co-creating the blocks of digital trust

Online launch on March 12th (registration needed): https://lnkd.in/dYV34cTP

Our report refines the classification for experimentation by sharpening the distinction between regulatory, operational, and hybrid sandboxes, while proposing the first-ever formal definition of a “DPI Sandbox.” This conceptual framework is supported by the first global mapping of sandboxes specifically designed for DPI. We conclude with key recommendations for governments, the private sector, and civil society to engage in collaborative experimentation.

Thoughtful

Question for us..How do we reduce the preception of risk? All Successful Innovations Reduce the Perception of Risk

Safety in Numbers

An independent infrastructure that allows people to interact with others they relate to, find independent sources of support and feel safe.

The Next Digitization Wave: Moving from Data-Driven to Trust-Native

The war on PDFs is to solve ‘data debt’ and reclaim ‘dormant intelligence’. Startups are looking at semantic data by turning documents into structured code (like JSON or Markdown) that an AI can “reason” over instantly. And this is already going on.

Verifiable Credentials allow for Atomic Proofs. Instead of filling out a form to prove you’re a licensed broker or a doctor, your digital wallet shares a cryptographically signed Credential. The system checks the digital signature, sees it is from a trusted authority, and accepts it instantly.

Digital Identity Under Platform Rule (Part One)

Challenging the Authority Platforms Claim Over Identity in Digital and Physical Spaces

Digital Identity Under Platform Rule (Part Two)

When Technical Control Outpaces Social Governance — The Cost of Abstraction in Identity Infrastructure at Scale

The full essay is in conversation with written work from: RadicalxChange Foundation, E. Glen Weyl, Kaliya Young

(oldy but goodie ) Identity and Digital Self-Sovereignty: A New Paradigm for Sovereignty on the High Seas

Sovereignty on Today’s High Seas: The Internet

Identity as Continuous Addressability: Continuity of self-sameness over time is the most fundamental presupposition about identity which must be enshrined in a self-sovereign system of governance.

Is AI Sovereignty Possible In 2026? Managed Interdependence Beats Isolation

AI Sovereignty Is Not A Switch. It Is A Strategy.

This report argues “AI Sovereignty” is best understood as a spectrum of choices that increase a country’s capacity to make independent decisions about critical AI infrastructure deployment, use, & adoption, not literal autarky. The practical alternative is “Managed Interdependence”, using alliances & partnerships to reduce risk across the stack while preserving interoperability.

The Office for Digital Identity and Attributes

The Office for Digital Identity and Attributes within the Department for Science, Innovation and Technology has today published updates to the UK’s digital ID / Digital Verification Services Trust Framework (DVSTF, renamed from the DIATF):

(Telefonica) The Future is Biometric: Why Next Generation Solutions Matter

Next-generation biometric systems, powered by decentralized AI techniques like federated learning and on-device training, are enabling secure, privacy-preserving authentication across sectors while addressing challenges of bias, spoofing, and GDPR compliance — positioning biometrics as a cornerstone of trustworthy digital identity.

Scientists say no to age-assessment technology.

TL;DR Governments worldwide are moving to restrict access to online services based on age. More than 370 scientists have signed an open letter calling for a moratorium on age-assessment technologies until there is solid evidence of their feasibility and societal impact. Protecting minors is essential — but blanket identity control across the internet is unlikely to be the right solution.

Software is Changing

Our enterprise customers aren’t paying for the login button; they’re paying for the human accountability behind it: the SLAs, the SOC 2 audits, the active CVE responses, and the security hygiene that a machine can’t guarantee. Open source isn’t dying, but the business model has to evolve. We’re moving from selling “features” to selling “responsibility.”

EU

EUDI Nexus - Wallet Ecosystem StandardsEUDI Focus

6 signals shaping the EUDI Wallet ecosystem. 🇪🇺📲

The ecosystem is moving from discussion to deployment. The only way to confidently de-risk your EUDI project is with reliable market intelligence. Join hundreds of leaders who rely on this newsletter to stay ahead of the curve.

(Also see the Lissi Newsletter on EUDI)

Mutual recognition of UK and EU digital identity schemes

We tackled the vexed legal and political question of how to align the fledgling UK digital identity system with the EU eIDAS framework and the EU digital identity wallet (EUDI wallet).

A Product Safety Playbook for the Digital Age

Current digital product regulation resembles a chaotic free-for-all rather than a coherent strategy, and the author argues that adopting a “digital product safety” framework — modeled on the history of physical product safety regulation — is urgently needed to counter both the natural knowledge lag and industry’s well-funded resistance tactics.

(Siros) Zero Knowledge Proofs: shifting where the work happens

While current digital identity wallets often rely on batch credential issuance to achieve selective disclosure — a method that becomes costly and correlation-prone at national scale — the SIROS Foundation argues that zero-knowledge proofs offer a more privacy-preserving and scalable alternative by shifting cryptographic complexity from central issuers to user devices, enabling unlinkable, minimal-disclosure proofs from a single credential.

(IEEE) The Age-Verification Trap: Verifying user’s ages undermines everyone’s data protection

Age-restriction laws create an inescapable trap: effectively enforcing minimum age requirements forces platforms to collect, retain, and continuously monitor personal data in ways that directly undermine data privacy law — and the problem is worse in countries with weaker identity infrastructure, where companies fill the gap with even more invasive surveillance.

#OfDIA’s survey on “international use of digital identities and credentials”

There are no earth-shattering revelations. The 39 respondents overwhelmingly agreed that the UK should prioritise a ‘mutual recognition agreement’ (MRA) with the EU.

What happened last week at the AI for Impact Summit in India??!?

1. India positioned this as the first AI summit hosted by the Global South

2. Digital Public Infrastructure (DPI) was everywhere.

3. Multilingualism emerged as a core equity issue

4. India unveiled the “MANAV” vision … Moral and ethical systems, Accountable governance, National sovereignty, Accessible and inclusive technology, Valid and legitimate systems.

5. Big money showed up. Google announced a $15 billion investment in an AI hub in Visakhapatnam.

6. The Global South framing was real to many in my network, not just branding.

The customer experience of the EU Digital ID Wallet will have to be 10x better

The EUDIW will struggle to achieve mass adoption unless its designers prioritize user experience over technology and regulation — and right now, there’s little evidence they are.

Triples failed us. Here’s what we built instead. 🧠

Classic graph structures like RDF triples fail to capture the hierarchical, multi-relational nature of human memory, but through a progression from hypergraphs to metagraphs, the author arrived at layered bipartite graphs as an elegant solution. This approach achieves full metagraph expressiveness — modeling complex, recursive, contextual memory — using standard property graph databases like Neo4j that already exist today.

𝐈𝐟 𝐃𝐢𝐠𝐢𝐭𝐚𝐥 𝐏𝐫𝐨𝐝𝐮𝐜𝐭 𝐏𝐚𝐬𝐬𝐩𝐨𝐫𝐭𝐬 𝐬𝐭𝐚𝐲 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞-𝐨𝐧𝐥𝐲, 𝐭𝐡𝐞𝐲 𝐛𝐞𝐜𝐨𝐦𝐞 𝐚 𝐜𝐨𝐬𝐭 — 𝐧𝐨𝐭 𝐚 𝐜𝐚𝐭𝐚𝐥𝐲𝐬𝐭.

A DPP is a standardized data exchange infrastructure. Value emerges when:

• The right additional data is shared

• Clear business cases are defined

• Financial incentives are aligned

Not more data. -> The right data.

Architecture Before Argument

When new substrates emerge, the first draft of order is rarely written in a legislature. It is written in contracts, in code, in standards documents, in committee rooms where engineers argue about field lengths and message formats. The legal system often arrives later, sometimes years later, to interpret, correct, or contain what has already hardened into infrastructure.

Digital Infrastructure and Legal Certainty

The UNCITRAL: United Nations Commission on International Trade Law Colloquium on “Harmonizing law in the age of digital trade and finance – digital assets and platforms” https://lnkd.in/gAiEePJ5 illustrated how legal certainty is critical to the functioning of Platforms, Exchanges, and Registries, underscoring that digital infrastructures supporting trade and finance rarely fail because of the technology.

The Empowerment Stack is Here

Own and control a standards-based digital identifier.

Gather and curate your core personal data.

Deploy an AI agent acting on your behalf in a fiduciary capacity.

Propose and enact MyTerms agreements with organizations you engage with.

Account recovery is the identity industry’s most overlooked challenge

Last year at Identiverse, I joined an expert panel on account recovery alongside Dean Saxe (IDpro), Ove-Morten Stalheim (BankID Norway), Rob Brown (Inverid), and Bertrand Carlier (Wavestone). The discussion kept coming back to the same point: most companies have account recovery in the wrong bucket. They treat it as a customer service problem when it’s really a security and business architecture challenge.

The Synthetic Auth (https://syntheticauth.ai), a newsletter

I explore digital identity through a lens that’s equal parts technical, philosophical, and a little sardonic. What started as a way to make sense of my own curiosity became something I genuinely love working on. And this year I get to take it to the Identiverse stage. Pretty stoked about that!

• Human Agency Summit, February 23, Napa Valley (Kaliya will be there along with many other decentralize identity folks)

• DIF Unconference Africa (an IIW Regional Event) Feb 24-26, 2026 Cape Town

• KERICONF26 April 21-23 2026, Lehi, Utah (US)

• Internet Identity Workshop #42, April 28-30, 2026, Mountain View California

• Agentic Internet Workshop #2, May 1, 2026, Mountain View California

• dice: Digital Identity unConfernece Europe (an IIW Regional Event) June 22-24, Copenhagen, Denmark

New W3C Community Group

Proposed Group: Physical Asset Attestation (UORA) Community Group

The mission of the Universal Object & Resource Attestation (UORA) Community Group is to develop a vendor-neutral, decentralized protocol for the identity, state verification, and lifecycle tracking of physical assets. By bridging the gap between physical objects and digital identifiers, UORA enables every resource to function as a first-class citizen of the internet, fostering global trust, transparency, and interoperability across supply chains and industries.

Are We Worried Yet Department

How AI Surveillance Tech is Creeping From the Southern Border Into the Rest of the Country

Last week, The New York Times reported that when a U.S. citizen in Minneapolis was following ICE agents to observe their conduct, one agent addressed her by name — information the agent may have obtained using some kind of facial recognition system, though DHS would not specify whether that was the case or which technology ICE is using. And while there’s something chilling about government agents generating a correct identification this way, the technology is also prone to false positives and errors, and according to reporting by WIRED, is being used by DHS for identity “verification” tasks it wasn’t designed for.

(Doc Searls) Because Pricing is Getting Too Personal

Surveillance pricing already has its own page in Wikipedia. It also has its own authority: Abbey Stemler, Associate Professor of Business Law and Ethics and Weimer Faculty Fellow in Business Law & Ethics at Indiana University’s Kelly School of Business. And she’ll be speaking about her work a week from now: February 19, 2026 4-5 ET

(Evercred) Digital Police Identity Verification in India: Combatting the “Digital Arrest” Crisis

The transition to digital policing tools in India has outpaced the development of secure identity infrastructure. The new Bharatiya Nyaya Sanhita (BNS) allows for the service of electronic summons. This is a necessary step towards modernization. However, legal experts highlight a critical gap: there is no current statutory mandate for how these electronic interactions must be authenticated.

[Research] Important Self-sovereign identity: A conceptual framework and research agenda

Self-sovereign identity (SSI) is a novel approach to digital identity management, which is controversially discussed in technological communities and academia and lately also in the political space. Positions in the debate range from touting SSI as introducing a paradigm shift in internet identity and user privacy, while others dismiss the concept as libertarian hyperbole. SSI aims to give individuals an independent digital existence and control over their digital identities. Technically, this is achieved by providing individuals with digital identity wallet applications, which allow them to store and present digitally verifiable credentials. Despite its transformative potential, SSI is not comprehensively conceptualized in information system research. Therefore, in this Fundamentals article, we offer the following contributions: First, based on existing information systems research, we provide a consolidated definition and a conceptual framework of SSI structured along five analytic levels: (1) foundational principles, (2) credential exchange, (3) technical building blocks, (4) applications, and (5) governance. Second, we present an information systems research agenda on SSI, including concrete research questions and promising theoretical directions.

World Bank Backs Nepal Digital Transformation with $50M and Verifiable Credentials Locker

The World Bank has approved $50 million in financing for the Nepal Digital Transformation Project, an initiative aimed at expanding the country’s digital public infrastructure and accelerating the digitization of public services.

The Major Digital Trust Trends Shaping Asia in 2026

Trend 2: The rise of decentralized identity

China’s RealDID system, for example, uses decentralized identity blockchain infrastructure to allow credentials to be verified without being repeatedly shared.

In Hong Kong, for example, the DID system was used in a limited pilot to allow visitors from mainland China to register for regulated stablecoin services without giving away any of their personal details.

In many APAC jurisdictions, there is no clear statutory recognition of self‑sovereign credentials, and AML/KYC laws still assume the use of centralized government ID systems. Enterprises tend to move cautiously when infrastructure lacks clear standards or legal recognition.

[slide deck] Introduction of China RealDID System

Luvia and Open Campus partner to bring verifiable credentials to Vietnamese students through initiative supported by Ministry of Education and Training

Hanoi, Vietnam - Luvia and Open Campus have announced a strategic partnership to provide Vietnamese learners with portable, verifiable credentials through two initiatives: a personalized learning mobile app for high school and university students, and a learning management platform for schools. The initiatives integrate Open Campus ID and its verifiable credentials with the aim to modernize school operations nationwide.

Digi Yatra plans expansion to international travel with passport-based enrolment

Speaking with L.V. Navaneeth, CEO, The Hindu Group, Digi Yatra Foundation CEO Suresh Khadakbhavi addressed concerns around data security, stating Digi Yatra follows a decentralised architecture in which credentials reside on users’ own devices rather than in a central database

Indicio enables AI agents to verify Digital Travel Credentials

Once the traveler presents the credential to the agent, the AI travel agent cryptographically verifies that the information in the credential is authentic. After the verification is complete, the agent can help book rental cars and airlines, find the fastest route to a destination, book a hotel or an excursion, and change reservations, the firm explains in a blog post.

NIST develops playbook for online use cases of digital credentials in financial services:

Panel on mDLs explores efforts by NIST, AAMVA to show benefits of digital credentials. NIST’s work on mDLs gets an airing at the FIDO Identity, Authentication, and the Road Ahead 2026 conference, in a panel focused on how NIST’s partnerships have advanced the digital ID sector. Panelists include Jeremy Grant, coordinator of the Better Identity Coalition; Ben Amsterdam of PNC Bank; Tim Maru, portfolio director for identity credentialing the American Association of Motor Vehicle Administrators (AAMVA); and Ryan Galluzzo, who leads NIST’s digital identity program.

Utah Advances Policy-First Digital Identity Framework Centered On Individual Control

The state moves to authorize a digital identity framework emphasizing open standards, privacy and durable public policy nationwide.

UNICEF in search of firm to co-design youth digital credentialing system

Companies or organizations with expertise in digital identity, credentialing, and education technology, have up to February 16 to bid for the contract.

Morocco Signs Cooperation Agreements with iDakto and ShareID for National Digital Wallet

Morocco’s Ministry of Digital Transition and Administrative Reform has signed cooperation agreements with French firms iDakto and ShareID to support development of a national digital identity wallet, the ministry announced February 12. The project sits within Morocco’s broader Idarati X.0 public-sector digital modernization program and is designed to provide secure digital identity infrastructure for accessing public services and conducting online transactions.

Singapore and India engage in cross-border DPI through verifiable employment credentials

IMDA’s pilot converts background checks into cryptographically signed credentials stored in the individual candidate’s digital wallet, making employment verification much faster, easier and safer for Singapore businesses.

The “Agent” Dilemma: How Blockchain Could Save Patient Privacy in a $500B AI Market

However, while AI’s promise of unprecedented efficiency and innovation is alluring, such rapid proliferation raises a number of serious concerns, namely around protecting patients’ privacy and sensitive health data. How can a system that comprises countless semi-autonomous AI systems with potentially unclear directives guarantee that people’s personal information won’t be misused – even by accident?

One promising approach is self-sovereign identity (SSI) – a blockchain-based solution that empowers patients to control their data with precision and security.

Control Without Ownership in the Era of Self-Sovereign Identity:

The situation calls for change. The concept of “control without ownership” outlined by Gorgiladze offers a viable legal framework that aligns technological capabilities of self-sovereign identity with existing legal systems. It provides a practical direction for the evolution of digital identity regulation—one that balances innovation, autonomy, and legal certainty.

Decentralized Identity (DID) for B2C: Consumer Self-Sovereign Identity

This article covers the shift from centralized data silos to consumer-owned identity models and how did tech reduces breach surface areas for modern apps. You’ll learn about verifiable credentials and why moving away from passwords is the only way to truly protect user privacy while keeping iam flows simple for devs.

Bringing Identity Back to the Human: What Self-Sovereign, Human-Centered Identity Looks Like in Practice (2026)

For decades we outsourced our digital selves. Governments issued numbers, platforms built profiles, companies stored credentials, and we handed over the keys to our identity in exchange for convenience. But externalizing identity handed control to systems never designed to carry the weight of a human life. Those systems optimized for extraction, scale, and monetization—not dignity, privacy, or truth. Now the question is no longer theoretical: What does it look like to bring identity back to the human?

[Research] QR-MetaSSI: A Quantum-Resistant Self-Sovereign Identity Framework for Metaverse Platforms

This paper proposes QR-MetaSSI, a framework integrating NIST-standardized post-quantum cryptography with W3C-compliant Self-Sovereign Identity principles to secure metaverse platforms against quantum threats, demonstrating through simulation that lattice-based DIDs and hash-based verifiable credentials can maintain authentication latency under 150ms with 128-bit quantum security at reasonable computational overhead compared to classical ECC-based systems.

(Heather Flanagan) Contributor Skills: How Standards Are Created

(Indicio) [slide deck] Decentralized Identity in 2026: The Opportunities for Business

DIF Welcomes Kyndryl as Associate Member to Advance Secure, Decentralized AI Ecosystems

• Advancing Trust in Agentic AI: Kyndryl’s Agentic AI Framework envisions a future where autonomous AI agents interact seamlessly across open, cross-domain ecosystems. Through DIF’s Trusted AI Agent Working Group, Kyndryl will contribute to defining standards that enable agents to establish strong trust. The Working Group addresses authentication, authorization, and delegation, allowing industry players to collaborate safely and reliably.

(Evercred) How U.S. Agencies Can Prevent Fake Credentials Using Digital Credential Verification in 2026

The rise of deepfake technology allows bad actors to create realistic but fraudulent certificates. These documents often pass visual inspections. Agencies need a system that relies on cryptographic proof rather than visual markers.

By 2026, the cost of employment-related fraud has grown significantly. Government IT departments must prioritize systems that detect fake credentials before an individual enters the secure network.

[Research] Trustworthy Blockchain-based Federated Learning for Electronic Health Records: Securing Participant Identity with Decentralized Identifiers and Verifiable Credentials

This paper proposes a blockchain-based federated learning framework that uses Self-Sovereign Identity standards (DIDs and Verifiable Credentials) to enable secure, privacy-preserving AI model training across healthcare institutions, successfully preventing Sybil attacks while maintaining strong clinical performance.

• Human Agency Summit, February 23, Napa Valley (Kaliya will be there along with many other decentralize identity folks)

Upcoming

• Workshop: CREDEBL For Decentralized Identity and Verifiable Credentials, Wednesday, February 18 at 8 AM Pacific Zoom

• Join us at the 1EdTech Digital Credentials Summit in Philadelphia, February 18-20, 2026.

• DIF Unconference Africa (an IIW Regional Event) Feb 24-26, 2026 Cape Town

• KERICONF26 April 21-23 2026, Lehi, Utah (US)

• Internet Identity Workshop #42, April 28-30, 2026, Mountain View California

• Agentic Internet Workshop #2, May 1, 2026, Mountain View California

• dice: Digital Identity unConfernece Europe (an IIW Regional Event) June 22-24, Copenhagen, Denmark

PNG’s [Papua New Guinea] First Ever Verifiable Credential Wallet App now available on Google Play

The Department of Information and Communications Technology (DICT) has announced the official release of the SevisWallet App, now available for download on Google Play. The app is a Digital Public Infrastructure and marks a key achievement in PNG’s digital transformation journey, giving citizens SECURE ACCESS to decentralized verifiable credentials.

AI and Identity

“Know Your Agent” (KYA) is emerging as a concept, but its framing guarantees it will fail at scale.

AI agents are running into resistance today for the same structural reasons large, coordinated fraud operations succeed:

→ They operate continuously

→ They retry efficiently

→ They optimize for task completion, not perception

To existing security and risk systems, that behavioral pattern is indistinguishable from attack. This constraint is missing in most discussions. Inference-based identity systems cannot reliably separate delegated intent from compromise once delegation begins to scale. The resulting cost shows up as false positives, throttling, and shutdowns, not because the systems are malfunctioning, but because they are behaving rationally given the information available to them.

Google is building an AI Agent-enabled e-commerce ecosystem

Currently, agentic commerce is flawed. Every AI agent needs custom integrations for every platform. It is complete chaos. Google just solved this with UCP - an open standard co-developed with Shopify, Etsy, Wayfair, Target, and Walmart. Endorsed by 20+ companies, including Mastercard, Stripe, Visa, PayPal, and American Express.

[TIME Magainze 100 AI 2025] Andy Parsons Senior director of content authenticity, Adobe

Parsons oversees the Content Authenticity Initiative, an Adobe project focused on creating a more transparent ecosystem where users can tell whether digital content has been made by humans, AI, or some combination of both. Its currency: “Content Credentials,” a digital signature that holds information like the creator’s name, what device was used to make the content, and the content’s edit history, including whether AI was used in its creation.

“It’s a new kind of metadata,” Parsons says. The credentials allow tracking of any changes to content, he says. “It’s permanently attached to the media, bound to the pixels, or the frames, or the waveforms.”

The AI System That Never Was

“I have an embarrassing backlog of reading about what’s been happening with AI over the last few years. Going through it chronologically turned out to be unexpectedly useful.”

One pattern stood out more than any single policy shift or technical breakthrough: the use and then decline of the phrase “AI system.

Model AI Governance Framework for agentic AI.

Unveiled by Minister for Digital Development and Information Josephine Teo, and released by the Singapore’s Infocomm Media Development Authority (IMDA), the framework addresses governance challenges specific to agentic AI systems, which can plan, take actions, interact with tools, and operate with varying degrees of autonomy.

Thoughtful

Privacy Activists Broke Privacy

Blocking without replacement is not victory. It’s sabotage with better branding.

For the last 30 years, professional privacy activists have been a net negative for actual privacy. Not because privacy doesn’t matter. Because they fought the wrong war, with the wrong tools, and they won the wrong victories. They optimized for symbolic privacy (the kind that sounds good in a press release) and delivered a world of operational non-privacy (the kind that ruins actual lives).

Digital Identity: Bundling, Unbundling and Rebundling

In the context of identity, we are currently transitioning from a period of extreme bundling (centralized silos) to a period of strategic unbundling (verifiable credentials), leading toward a future of user-centric re-bundling (self-sovereign identity). We are currently in the messy middle of this cycle. Governments and banks are beginning to “unbundle” their records into VCs (like Mobile Driver’s Licenses), and wallet providers are competing to be the place where you “re-bundle” your life.

Canadian Competition Bureau - Your Data, Your Control:How data portability can unlock competition and empower consumers

This Canadian report examines data portability—the ability for consumers to transfer personal information between service providers—finding it could save Canadians $1.10–$3.83 billion annually in the insurance sector alone, while also boosting competition and innovation. However, successful implementation requires addressing behavioral barriers, privacy and security concerns, and interoperability challenges through smart regulatory design informed by international examples like the UK’s open banking and Australia’s Consumer Data Right.

Research

[Research] Interoperable Architecture for Digital Identity Delegation for AI Agents with Blockchain Integration

This research proposes a framework for verifiable delegation in digital identity systems that introduces Delegation Grants as distinct authorization artifacts, a protocol-agnostic verification model, a layered trust architecture, and optional blockchain anchoring—designed to work across centralized, federated, and SSI environments for both human and AI agents.

[Research] European digital identity ∗ A missed opportunity

This paper critiques the EU Digital Identity (EUDI) framework and its OpenID architecture for having a narrow conception of authentication, insecure practices, limited credential types, and a trust model that fails to deliver meaningful gains in user control or privacy over existing solutions—while also arguing that the regulation’s institutionalized trusted lists risk re-centralization—and suggests alternatives like OAuth’s UMA/A4DS and GNAP to better support dynamic, decentralized identity use cases.

[Research] Know Your Contract: Extending eIDAS Trust into Public Blockchains

This paper presents an architecture for bridging the EU’s eIDAS trust framework with public blockchains by cryptographically binding smart contracts to qualified electronic seals, enabling machine-verifiable identity attribution of on-chain actions to legal entities—supporting automated regulatory compliance (KYC/KYB) for institutional DeFi, asset tokenization, and agentic commerce without introducing new trusted intermediaries.

[Video] (Nicky Hickman) Verifiable AI with SSI - A Socio Technical Exploration Link to hackathon.

DIDs Going live for CBP (Slide 2) Cargo Traceability User Interface: Oil CBP-135a

Beginning as a pilot with a small set of participants, this enhancement enables use of global interoperability standards (GIS), including decentralized identifiers (DID) and verifiable credentials (VC), to trace crude oil imports from point-of-origin to arrival in the U.S. • For more information, review this related Federal Register Notice.

The Agentic Convergence: Rebundling Trust, Discovery, and Execution

Trust frameworks for Agentic AI are fast developing. In the post-AI, post-agentic-AI era, we got to think identity rebundled not just as “data,” but as verifiable trust and agency. AI provides the discovery and intent, while Tokenization and Verifiable Identity provide the execution and trust. When these technologies converge, they solve the Last Mile problem of the digital economy—the gap between finding a service and actually executing a secure transaction without a mountain of paperwork.

(Nitin Badjatia) The Case for Us: Why the Agentic Web Needs Contracts, Not Consent

Something significant is happening to alter the path forward. MyTerms, the IEEE 7012 standard for Machine Readable Personal Privacy Terms is now officially available to build with. I believe it’s a missing part of the protocol framework that will make the emerging agentic web actually work for people instead of against them. (full disclosure, my fellow board members at Customer Commons were deeply involved in the creation of MyTerms).

What AI “remembers” about you is privacy’s next frontier

Personalized, interactive AI systems are built to act on our behalf, maintain context across conversations, and improve our ability to carry out all sorts of tasks, from booking travel to filing taxes. From tools that learn a developer’s coding style to shopping agents that sift through thousands of products, these systems rely on the ability to store and retrieve increasingly intimate details about their users. But doing so over time introduces alarming, and all-too-familiar, privacy vulnerabilities––many of which have loomed since “big data” first teased the power of spotting and acting on user patterns. Worse, AI agents now appear poised to plow through whatever safeguards had been adopted to avoid those vulnerabilities.

[Report] (CDT) A Roadmap For Responsible Approaches to AI Memory

As AI systems increasingly incorporate memory features to retain user preferences and context across interactions, they raise complex questions about privacy, personalization, transparency, and user control that both echo and deepen longstanding concerns from traditional digital platforms. A 2025 CDT and Microsoft workshop explored these implications, emphasizing that developers’ current design choices around how memories are stored, edited, and deleted will critically shape whether AI memory systems operate responsibly and respect user privacy going forward.

[Report] Position Statement: Age Assurance & Online Safety Regulation

The Global Online Safety Regulators Network, launched in 2022 as the first international forum for independent online safety regulators, is calling for a common, principles-based, and privacy-preserving international approach to age assurance to better protect children online, arguing that greater regulatory coherence will improve child safety, simplify compliance for tech platforms, and build public trust.

[MOSIP] Claim 169’s new version is out!

The latest enhancements are the result of continued collaborative efforts to refine our standardised, interoperable, and offline-friendly QR code. It now includes secondary-language support, elaborated clarifications on implementation guidelines, standard CWT & COSE attributes, credential status, and security considerations, enabling individuals to verify identities quickly and securely in any language, setting or remote areas, while reinforcing trust across diverse identity systems.

(Tim Buma) My goto architecture diagrams for identity, hegemony and payments.

Digital ID Part 2: Three Countries, Three Choices 🇬🇧🇲🇾🇸🇬

🇸🇬Singapore : Competence Without Consent

🇲🇾 Malaysia: Speed Without Safeguards

🇬🇧UK: Rights Before Efficiency

Why is the implementation going through without resistance? Are people here less concerned about personal rights? Is it cultural differences? Collectivists vs Individualists? Where’s the independent bodies conversing awareness? Do citizens have access to information, legal protections, oversight and space to resist? Progress doesn’t need to require choosing between efficiency and citizen rights. Both can be built adjacently.

Our children’s brains are not for sale.

Les preuves d’âge arrivent. The era of “self-declared” age on social media is coming to an end - and a 🇪🇺 European identity system is forming.

Yesterday, French lawmakers in the National Assembly voted overwhelmingly (116 to 23) to ban children under 15 from social media. This follows a similar landmark move by Australia and precedes Ireland’s own mandatory age-check plans.

Introducing IEEE 7012: My Terms January 28, 2026 4PM GMT / 11 AM EST Online or In-person in London, UK. Brought to you by Customer Commons, IEEE, MyData Global, Consumer Reports, Inrupt, Customer Futures Ltd, JLINC Labs, Midwest Fables.

KERICONF26 April 21-23 2026, Lehi, Utah (US)

Upcoming

These were all listed in previous newsletters

• Call for Papers Open Now Open Identity Summit Deadline: January 31st, 2026

The summit takes place May 21–22, 2026 at University of Applied Sciences Dresden (HTW Dresden) in Dresden, Germany

• Protocols for Publishers PfP✨ London on Feb 4-5, 2026 to discuss how we can preserve an open, equitable web, where no one company holds the keys.

• MOSIP Connect, Rabat Moroco, Feb 11-13. Feb 13th is an unconference day facilitated by Kaliya. Reach out to me for an invite.

• Workshop: CREDEBL For Decentralized Identity and Verifiable Credentials, Wednesday, February 18 at 8 AM Pacific Zoom

• Join us at the 1EdTech Digital Credentials Summit in Philadelphia, February 18-20, 2026.

• DIF Unconference Africa (an IIW Regional Event) Feb 24-26, 2026 Cape Town

• Internet Identity Workshop #42, April 28-30, 2026, Mountain View California

• Agentic Internet Workshop #2, May 1, 2026, Mountain View California

• dice: Digital Identity unConfernece Europe (an IIW Regional Event) June 22-24, Copenhagen, Denmark

Subscribe now

Business Advice

Verifiable Credentials: Why “Build Your Own Ecosystem” Is a Death Wish

If you are not: a government, Apple, or Google…then there are only two viable strategies in verifiable credentials:

1. Align tightly and early with government/EU standards and capture critical mass, or

2. Become a strong niche player solving one painful verifier workflow end-to-end.

Everything else, especially “let’s build our own ecosystem”, is a slow-motion failure.

Opportunity

MOSIP Inji Community – Expression of Interest (EOI) Now Open!

If you’re enthusiastic about contributing to a global digital public infrastructure project, fill out the form below and we’ll reach out with next steps and community contribution guidelines.

Learning

(LF Education) LF Insider: DID Under the Hood: Storage, Resolution, and Integrity

Explore the technical architecture of Decentralized Identifiers (DIDs) by learning how identity documents are stored across different networks, resolved into standardized formats, and cryptographically verified for tamper-evident trust.

Looking Ahead

(Spokeo) 5 emerging digital ID trends in 2026 that could redefine your online persona

In the end, the adoption of these emerging technologies ensures that identities can be accurately digitally verified and that people’s private information is kept out of the wrong hands. Through constant technological progress and innovation, digital ID verification is becoming more secure and more user-friendly than ever before.

Thoughtful

Democracy’s Missing Protocol: Fixing the Social Dilemma Without Censorship

Passwords are a National Security Risk

Standards

(Heather Flanagan) A Field Guide to Digital Identity Standards Bodies

New Versions of Standards

DCI [Digital Convergence Initiative ] Publishes v1.0.0 Interoperability Standards for ID Systems and Social Protection Platforms

The Digital Convergence Initiative has published Version 1.0.0 of its ID systems and Social Protection systems interoperability standards, a framework intended to help national identity programs and social protection delivery platforms exchange data and authenticate users more consistently. DCI is positioning the standards as a way to improve service delivery, reduce fragmentation across government systems, and support inclusion through more interoperable identity-linked benefits infrastructure.

VCALM v0.9: A Verifiable Credential API for Lifecycle Management

Verifiable Presentation Request v2024: A data model for requesting presentations of verifiable credentials

New Product Launches

Telefónica Tech launches a solution for private and secure control of personal information

Telefónica Tech, Telefónica’s digital business unit, launches a self-sovereign identity solution based on verifiable credentials to help companies and public organisations adapt to and implement the European Union’s new legal and technical framework for Self-Sovereign Identity (SSI), whose reference project is the EUDI Wallet, which will come into force at the end of 2026 in all member states.

Telefónica Tech launches self-sovereign identity tool based on verifiable credentials

Telefónica’s digital business unit, Telefónica Tech, has announced the launch of a self-sovereign identity product based on verifiable credentials. A press release says the tool aims to help companies and public organizations implement the EU’s new legal and technical framework for Self-Sovereign Identity (SSI), whose reference project is the EUDI Wallet.

Check out SpruceID’s new Knowledge Base

Digital Identity Fundamentals, Trust Infrastructure, Mobile Driver’s Licenses (mDLs), Verifiable Digital Credentials, Credential Formats & Standards, Verification Mechanisms, Assurance & Lifecycle Management, Privacy Risks & Fraud Prevention, Digital Wallets & Device Security, Authentication & Access Protocols, Identity Policy & Governance, Global Ecosystem & Regulations, Real-World Use Cases

Member Credentials in the Wild

Your ABP Digital Credentials: What’s Changing and What It Means for You

Credential Verification Automation Redefines Skills-First Hiring

Identity an AI

KYA emerges as essential tool to ensure agentic AI is trustworthy: From public attestations to PKI, industry explores how to stop secret agents

Decentralized identity cuts out need for hierarchies: Kaliya Young

A recent episode of the Knowledge Hub podcast features insights from Kaliya Young, a 20-year veteran in the decentralized identity sector – making her among the first to recognize its potential. Young breaks down the concept of namespaces, in an explanation of why identity becoming decentralized, so to speak, is such a big deal.

(Google) Under the Hood: Universal Commerce Protocol (UCP)

The Universal Commerce Protocol (UCP) is an open-source standard designed to power the next generation of agentic commerce. By establishing a common language and functional primitives, UCP enables seamless commerce journeys between consumer surfaces, businesses, and payment providers. It is built to work with existing retail infrastructure, and is compatible with Agent Payments Protocol (AP2) to provide secure agentic payments support. It also provides businesses flexible ways to integrate via APIs, Agent2Agent (A2A), and the Model Context Protocol (MCP).

The API Authorization Hierarchy of Needs: Why You Aren’t Ready for AI Agents Yet

Ethereum New Proposal - ERC-8126: AI Agent Registration and The API Authorization Hierarchy of Needs: Why You Aren’t Ready for AI Agents YetVerification

The Future of Digital Trust: Why Your Organization Needs Verifiable AI

Verifiable AI works the same way. Instead of blindly trusting an AI system’s output, it ensures that every action and decision can be proven—who deployed the AI, what it is authorized to do, and whether it followed the required rules. This is where Verifiable Credentials play a critical role: they act as the visas attached to the AI’s passport, defining scope, permission, and compliance, and making trust verifiable, enforceable, and reusable as AI systems operate across platforms and ecosystems.

The Gradual Revolution of “Agentic Everything”

The answer lies in a simple, yet catastrophic, architectural omission from the 1970s. When the internet protocols (TCP/IP) were designed, they were built to move Data—what philosophers like John Searle call “Brute Facts.” The network is brilliant at proving that I sent you a file. It is perfect at moving a packet of information from Point A to Point B without corruption. It solves the physics of information transport perfectly.

But the internet has no concept of Value—what Searle calls “Institutional Facts.” An Institutional Fact is a social agreement that exists only because we say it does: “This piece of paper is worth five euros,” “I am over 18,” or “I owe you a favor.” The internet cannot natively prove that I am who I say I am, or that I owe you money. It can send a PDF of a contract, but it cannot enforce the “handshake” that makes the contract valid.

Import Your ChatGPT or Claude History to Kin

Get a group subscription

Government Updates

UK Scraps Digital ID Requirement for Work Checks Amid Growing Privacy Backlash

A blueprint for modern digital government (HTML)

This change will be led by the new digital centre of government. The digital centre exists to serve the public, departments and the wider public sector. It will be magnetic: the home of specialist expertise in digital service design, artificial intelligence and other areas. It will be catalytic: enabling teams to work together more easily to deliver the government’s missions and power public sector reform.

Our approach to keeping GOV.UK One Login secure

In the GOV.UK One Login programme our security model involves multiple lines of protection, such as monitoring for threats, controlling access to systems, and keeping detailed logs.  We regularly review and update these measures to stay ahead of any new risks.

Building Resilient Payment Systems in Fragile States: Lessons from the IMF and the Role of Offline Digital Finance

Paycode enhances national ID systems with offline biometric authentication and is now integrating self-sovereign identity (SSI) models to ensure continuity even when central systems are unreachable.

Practical Implementation

Setting Up Keycloak as a Credential Issuer with OpenID4VCI

Data

Are You Compliant? The Overlapping Rules Governing Research Data Today

Identity not SSI

How to Implement Google One Tap in React with Auth0 and FedCM

Good Explainers

Why Verifiable Credentials (VCs) are Coming to the Forefront in Digital Security and Identity Verification

WorldID Watch

A Conversation with Adrian Ludwig: Q&A with Adrian Ludwig, CISO of Tools for Humanity

• Workshop: CREDEBL For Decentralized Identity and Verifiable Credentials, Wednesday, February 18 at 8 AM Pacific Zoom

Upcoming

These were all listed in previous newsletters

• Call for Papers Open Now Open Identity Summit Deadline: January 31st, 2026

The summit takes place May 21–22, 2026 at University of Applied Sciences Dresden (HTW Dresden) in Dresden, Germany

• Protocols for Publishers PfP✨ London on Feb 4-5, 2026 to discuss how we can preserve an open, equitable web, where no one company holds the keys.

• MOSIP Connect, Rabat Moroco, Feb 11-13. Feb 13th is an unconference day facilitated by Kaliya. Reach out to me for an invite.

• Join us at the 1EdTech Digital Credentials Summit in Philadelphia, February 18-20, 2026.

• DIF Unconference Africa (an IIW Regional Event) Feb 24-26, 2026 Cape Town

• Internet Identity Workshop #42, April 28-30, 2026, Mountain View California

• Agentic Internet Workshop #2, May 1, 2026, Mountain View California

• dice: Digital Identity unConfernece Europe (an IIW Regional Event) June 22-24, Copenhagen, Denmark

Standards

(NIST) Digital Identities: Getting to Know the Verifiable Digital Credential Ecosystem Post 2: Understanding mDL credential formats

(NIST) Digital Identities: Getting to Know the Verifiable Digital Credential Ecosystem Post 1 Overview.

[DRAFT] Verifiable Credentials Working Group Charter: Start Date 2026 April 1, 2026

The Working Group will deliver the following W3C normative specifications:

Verifiable Credential Render Method v1.0

Verifiable Credential Confidence Method v1.0

Verifiable Credential API for Lifecycle Management v1.0

Verifiable Credential Barcodes v1.0

Verifiable Issuers and Verifiers v1.0

Data Integrity BBS Cryptosuites v1.0

Verifiable Credentials JSON Schema Specification v1.0

Enhaced social protection through interoperability: ID systems standards released

Version 1.0.0 of the ID systems and SP-Systems Interoperability Standards is now available on Gitbook. The standards, endorsed by the USP2030 Partnership, adopt OpenID Connect (OpenID foundation) and Verifiable Credentials (W3C) as the technical foundation for interoperability. These open standards provide a secure and trusted framework that allows social protection systems to authenticate individuals and request reliable identity data—such as demographic attributes and authentication tokens—from ID systems in a privacy-preserving manner. This approach ensures that identity data can be exchanged safely while maintaining trust, security, and scalability.

(Kantara) Coming Soon – Biometric Data Discussion Group

The Biometric Data Discussion Group (Biometrics) will address the management, security, and privacy of biometric data, from collection to destruction, with a focus on practical application and GDPR compliance. While standards do exist, they are often inaccessible to non-experts, and there is a need to decode and translate existing standards into a straightforward, practical guide for real-world application. Biometrics will develop a set of recommendations and best practices for biometric data management to fill this need for use alongside existing standards.

Opt Out for Data Brokers

CA Gets the DROP on Data Brokers

Beginning in 2026, California residents can access the Delete Request and Opt-out Platform (DROP) and request data brokers delete their personal information – information collected from third parties or from consumers in a non-“first party” capacity (i.e., through an interaction where the consumer did not intend or expect to interact with the data broker).

In the Real World

[Podcast] How IATA is Building Trust for Nearly 400 Airlines (with Gabriel Marquie)

How does an airline instantly trust a travel agency on the other side of the world? And what does it take to enable a future where passengers move through airports with a seamless, contactless identity experience?

The SSI pitch that worked 2 years ago doesn’t work anymore.

Getting them to work in production when you’re processing millions of verifications? That’s where most implementations fall apart. Interoperability that goes beyond marketing slides. Your credentials need to work with ISO mdoc systems, OIDC4VC flows, and yes, even the SAML dinosaurs that half the enterprise world still runs on.

(SpruceID) How to Build a Digital ID People Actually Want to Use: 5 Lessons From the Field

Lesson 1: Anchor on Everyday Use Cases and Make Them Visible

Lesson 2: Get Big Names on Board Early

Lesson 3: Reduce Friction for Everyone

Lesson 4: Use Policy to Unlock Adoption

Lesson 5: Earn the Trust Dividend

(SpruceID) Digital Identity In America: Series Overview

An executive guide to SpruceID’s multi-part series on the future of digital identity in the U.S.

1. Foundations of Digital Identity

2. Policy Momentum: Why Governments Care Now

3. The Technology Powering Digital Identity

4. Privacy and User Control

5. Practical Digital Identity in America

6. Enabling Issuers of U.S. Digital Identity

7. Verifiers: Building Trust at the Point of Use

8. Digital Identity: End User Experience

(Heather Flanagan) Process, Standards, and the AI Rogue Wave: Notes from Gartner IAM

First, many organizations don’t really need a better product; they need a process they can sustain. Second, standards work is happening, but it’s largely invisible in the conversations where buying decisions take shape. And third, even as Gartner itself warned that the current AI hype is spiraling, the market continues to reward vendors for leaning into it anyway.

Identity and AI

The Key Issues in Agentic ID

That is why I have long made myself unpopular in the crypto world by maintaining that while not your keys, not your coins is a fun rallying cry for Bitcoin maximalists it makes absolutely no sense that people should be loaded with this responsibility. I like Adam Levine’s framing that while the idea of self-sovereignty in crypto is empowering it demands a “persistent competence” that I think is well beyond the capability and capacity of the average member of the public, and I include myself in that category.

What AI Agents Can Teach Us About NHI Governance

Agentic AI is a stress test for non-human identity governance. Discover how and why identity, trust, and access control must evolve to keep automation safe.

(Auth0) Model Context Protocol Nov 2025 Specification Update: CIMD, XAA, and Security

The Nov 25, 2025, specification update for the Model Context Protocol (MCP) is out.

For those of us working in Identity, this is the update that starts to solve the hard problems of connecting AI agents to real-world business data. It moves the protocol away from custom solutions and aligns it with standard OAuth patterns that developers and security teams already understand.

(Indicio) Why Verifiable Credentials will power real-world AI in 2026

AI systems are going to deliver business success in 2026, they must be able to safely access high-value data and act across organizational boundaries. To do this, systems and agents need to be:

- Identifiable

- Have access to structured and accurate data in a permissioned and auditable way

- Demonstrate that they have the delegated authority to share this data with other identifiable AI agents and systems.

Billions’ Know Your Agent - Identity and accountability for AI agents

Billions provides an Agent JS SDK that allows AI agents to generate and manage DIDs, perform authentication, and interact with the public attestation registry. The SDK supports LLMs with function calling and integrates with frameworks like LangChain.

(Phil Windley) Authorization Before Retrieval: Making RAG Safe by Construction

(Phil Windley) What AI Can Tell You About Your Authorization Policies

Review and audit are different.

In review and audit, the intent is assumed to already exist. The policies are fixed. The question is no longer how authority should be expressed, but how it is already expressed and whether that expression can be understood, defended, and justified.

This difference matters because it changes how AI should be used. In authoring, AI is invited to explore alternatives. In audit, that permission must be taken away. The AI’s role shifts from collaborator to examiner: explaining behavior, enumerating scope, and surfacing consequences without proposing changes. The goal of a policy audit is not to optimize policies or propose fixes, but to understand what the current policy set allows, how broad that access is, and whether it can be defended as intentional.

(Phil Windley) Policy Authoring and Analysis with AI

AI doesn’t belong in the business of deciding who can access what, but it can be an effective partner in reasoning about authorization policies. When used inside clear guardrails, AI helps humans author, analyze, and refine policies without taking over access decisions.

[Podcast] Decentralized identity in the age of AI agents with Kaliya Young

In this episode, we sit down with Kaliya Young. Kaliya is widely known as the “Identity Woman” and is one of the earliest pioneers of decentralized and self-sovereign identity. With over 20 years in the field, Kaliya breaks down complex concepts like decentralized identifiers (DIDs) and verifiable credentials in practical, real-world terms.

Education

How The Open Group Uses Open Badges

The Open Group issues Open Badges to individuals who earn certifications, credentials, or other recognized achievements across its portfolio of programs. These badges:

- Provide a digital representation of an individual’s certification

- Include verifiable metadata about the achievement

- Allow certified individuals to share their credentials easily with employers, peers, and professional communities

- Support lifelong learning by enabling individuals to build a visible, portable record of their professional development

(Simone Ravaioli) REGEN: REfugeesGENeration - AI Can Transform How We Recognize and Empower Refugees

REGEN is a proposed AI-powered framework that would recognize and validate refugees’ informal skills and experiences through narrative analysis and issue verifiable credentials, transforming refugee recognition from a bureaucratic gatekeeping process into a pathway for empowerment and economic integration.

Trust and Other Things

Trust Services, Trust-as-a-Service, Trust-Enhancing-Technologies

In this context, its important to understand - Trust Services, Trust-as-a-Service, Trust-Enhancing-Technologies. Let us take 3 players across different domains to illustrate how things are evolving.

December 2025: Cross-Border Testing Proves Digital Identity Interoperability

December 2025: the EU’s EUDI Wallets Launchpad event in Brussels demonstrated that cross-border digital identity interoperability works through successful conformance testing between Member State wallets and relying party infrastructure. While the UK’s Digital Identity Trust Framework achieved statutory status with 48 certified providers and Ireland announced plans to use its 2026 EU Council presidency to push for EU-wide ID-verified social media accounts, the month’s defining moment was proof that the technical architecture can deliver on its interoperability promise.

Will Proof of Purchase (AKA e-receipt) become the highest-volume verifiable credential?

Now when general-purpose EBWs will be either mandatory or self-evidently useful for all enterprises (need it also for eg receiving job applications) it is time to restart the journey towards linespecific use of e-receipts. Better named Proof of Purchase verifiable credentials (PoPs) to underline the importance of so many wallet2wallet2wallet reuse opportunities.

Physical Badges with integrated Passkeys

How to build a Digital Credential Issuer (Developer Guide)

The future of authentication in 2026: Insights from Yubico’s experts

If you’ve followed us this year, you’ve read various posts from Yubico experts sharing their insights and expertise on the latest trends impacting cybersecurity around the world. We strive to post content that is insightful to not just our customers, but the businesses and individuals that are looking for information and actionable takeaways that can help them become truly cyber resilient in this digital world.

(Ethereum Leaders) The Trustless Manifesto

Authors: Yoav Weiss, Vitalik Buterin, Marissa Posner

Ethereum was not created to make finance efficient or apps convenient.
It was created to set people free — to empower anyone, anywhere to coordinate without permission and without trusting anyone they cannot hold accountable.

Upcoming

• Call for Papers Open Now Open Identity Summit Deadline: January 31st, 2026

The summit takes place May 21–22, 2026 at University of Applied Sciences Dresden (HTW Dresden) in Dresden, Germany

• Protocols for Publishers PfP✨ London on Feb 4-5, 2026 to discuss how we can preserve an open, equitable web, where no one company holds the keys.

• MOSIP Connect, Rabat Moroco, Feb 11-13. Feb 13th is an unconference day facilitated by Kaliya. Reach out to me for an invite.

• Join us at the 1EdTech Digital Credentials Summit in Philadelphia, February 18-20, 2026.

• DIF Unconference Africa (an IIW Regional Event) Feb 24-26, 2026 Cape Town

• Internet Identity Workshop #42, April 28-30, 2026, Mountain View California

• Agentic Internet Workshop #2, May 1, 2026, Mountain View California

• dice: Digital Identity unConfernece Europe, June 22-24, Copenhagen, Denmark

Hiring

(Socure) Senior Product Manager - Reusable Identity Wallet

Up First

(Jon Shamah) Reflections on International Collaboration in Digital Identity and Trust Services

I have just returned from a productive meeting at the Senate in Ottawa, Canada, where I presented a study, co-authored with my colleague Keith Jansa, and which was commissioned by the European Union and the Digital Governance Council of Canada. The focus of the study was to explore pathways for enhanced digital collaboration between the EU and Canada.

What’s a “State Endorsed Digital Identity” and Why is Utah Creating One?

Using the birth certificate paradigm as its model, Utah has asserted that each individual has a unique identity, which is not established by the state, but is inherent to the individual.

Seen on weak signals list:

- New category: Personal Algorithmic Identity passports

- Kids building portfolio identities starting age 7

Alaska Plots AI-Driven Digital Identity, Payments, and Biometric Data System

The state’s new system could turn bureaucracy into automation, and consent into a checkbox no one really controls. (Document)

Pakistan’s NANRA is into VCs

Verifiable credentials let you prove who you are without carrying physical documents. Whether you are pplying for a service, sharing qualifications, or confirming your identity, your credentials are digitally secure, instantly verifiable, and fully in your control.

(Dave Birch) Thinking About a UK Digital Identity Infrastructure

even if you are one of three million people who signed a petition against having a digital identity card, the fact is that a modern society needs a digital identity infrastructure. In my view, the public debate itself needs to change: It should no longer be about whether people should be made to carry a card or not!

mDL

(Biometric Update) NIST announces new mDL use case, resources to support financial sector adoption

NIST’s response is a document called “Building Assurance in the mDL ecosystem,” which Galuzzo says focuses on three core components. “One was enrollment into the system of record. How do we understand what degree of vetting and proofing went into the issuance of that original polycarbonate plastic, whatever kind of physical ID was involved in the actual process of being provisioned to the DMV.”

DHS Says REAL ID, Which DHS Certifies, Is Too Unreliable To Confirm U.S. Citizenship

In a December 11 court filing, Philip Lavoie, the acting assistant special agent in charge of DHS’ Mobile, Alabama, office, stated that, “REAL ID can be unreliable to confirm U.S. citizenship.”

In a court filing in response to DHS, the Institute for Justice noted how incredible this position is. “REAL IDs require proof of citizenship or lawful status,”

Age Verification

Building trust into online age verification

As the UK moves to enforce online age verification under the Online Safety Act, protecting children must not come at the cost of privacy or digital trust. To succeed, age checks need to be privacy-preserving by design, giving users confidence that safety, security and personal data rights can coexist online, says Richard Hall, AVP at DigiCert.

EU Age Verification Manual

The age verification use case allows EU citizens to prove they are above a specific age threshold (e.g., over 16, 18, or 21) using a verifiable digital credential stored in their EUDI Wallet. The wallet enables selective disclosure: confirming age without revealing full birthdate or other identifying information. It is more secure than sharing a passport or national ID as less identifying data is shared.

This use case manual explains in practical terms how the age verification will work with EU Digital Identity Wallets. It also provides links to relevant technical and legal resources. (Blueprint)

AI and Identity

(Dyne.org) How we will delegate bureaucracy to AI

The future of identification technologies will involve delegating tasks to automated agents. Between the decentralised dream and the password asphyxiation, a third actor is emerging: the automatic intermediary.

AI Agents and VCs there are Issues

I’ve seen multiple articles and companies trying to position verifiable credentials as the foundation for identity in the age of AI agents. But there is a fundamental flaw here.

5 Trends to drive the AI ROI in 2026: Trust is Capital

Strategic shift: trustworthy AI infrastructure is becoming a business advantage rather than a compliance burden.

By strengthening Integrity (the technical and ethical bedrock), mastering Data quality and sovereignty, insisting on Information transparency, cultivating verifiable Knowledge networks, and enforcing wise Governance at the top, organizations create a virtuous cycle.

Gartner highlights Indicio as a leader in decentralized identity for AI and machines

(Evin McMullen, Billions) Your Identity Is Your Most Valuable Asset; It’s About To Become Income, Too

Identity is the single most valuable digital asset. We need systems that allow users to capture that value rather than cede it to intermediaries who view personal data as their property. Now that the technology is readily available, self-sovereign identity will serve as the foundation of trust necessary for the next generation of digital services, one that compensates users for verified credentials rather than exploiting them.

Why Protecting Human Identity Matters in the Age of AI

Universal Digital Identity: Secure, interoperable, privacy-enhancing digital ID systems encompassing individuals, organizations, and autonomous entities.

(Okta) Verifiable Credentials Counter AI-Driven Identity Fraud

Year Review - Year Ahead

(Heather Flanagan) ICYMI 2025: What You All Read the Most This Year

• AI isn’t a feature anymore — it’s a structural change.

• Governance beat technology as the real bottleneck.

• Definitions matter. A lot.

• Identity is expanding to new kinds of actors.

• Interoperability is the quiet throughline.

Will Big Tech Win the EUDI Wallet Race?

2025 in Review: cheqd’s Year of Building Trust, Identity, and Verifiable AI

Maturing ID wallets, investment for compliance and confidential AI -- privacy predictions for 2026

Are Digital Credentials Replacing Degrees? trends for 2025-2030

Thoughtful

2026 Predictions: What Comes Next in Fraud, Cybersecurity, and Identity

(Doc Searls) When Branding Means Relating

(Doc Searls) Writings on the Failings of Notice & Consent

Research

(Research) Self-Sovereign Identity a Catalyst for Secure and Efficient Employee Onboarding and Management

This paper examines how self-sovereign identity (SSI) technology can transform employee identity verification. It highlights the benefits of SSI such as simplified processes, enhanced security, employee empowerment and cost savings. The paper analyses the strategic advantages of adopting SSI, including leadership positioning, talent acquisition and retention, efficiency gains and data security compliance. Finally, the paper delves into the implementation of SSI and its future potential in the world of digital identity.

(Research) Self-Sovereign Identity for Verifiable Authorship Consent and Privacy-Preserving Conflict-of-Interest Screening in Academic Publishing: A Permissioned Blockchain Registry Approach

This paper proposes a decentralized framework using Self-Sovereign Identity technologies (DIDs and Verifiable Credentials) to address ethical gaps in academic publishing by enabling explicit authorship consent verification, accurate contributor role documentation, and privacy-preserving conflict-of-interest detection—backed by stakeholder survey support and positioned as a design contribution toward future implementation.

Business Wallets

EU Business Wallet: What You Need to Know About the EU’s Digital ID for Companies [Video and Takeaways]

Business Wallets and Organizational Identity: What the EWC Pilots Revealed

The importance of the Sea Change with European Business Wallets cannot be overstated

(Good4Work) The Rise of Decentralized Identity in Workforce Recognition

For employers, HR leaders, and platforms ready to lead in the next era of talent, embracing DIDs is a new way to engage with potential employees.

Protocols and Standards

OpenID and ISO announce Collaboration

A event: Gail Hodges (OpenID Foundation ) and Loffie Jordan (ISO - International Organization for Standardization ) are launching a joint group to work on harmonising digital credential protocols and avoiding fragmentation. A great step forward – well done! 🎉

New Thinking: Proof of Continuity changes the question: not “who holds this?” → “can this authority validly continue?”

DIDs solved identification.

VCs improved claims.

PoC solves authority.

Provenance Identity Continuity (PIC) Model Specification

(Heather Flanagan) Web Payments and Digital Identity Standards Are Converging – #TIL

AuthZEN shows enterprise readiness at Gartner IAM Summit

The main AuthZEN session drew nearly 100 attendees whose questions revealed an important shift in market maturity. Rather than asking whether standards based authorization works, practitioners wanted to understand implementation specifics for their own environments - a clear indication that AuthZEN has moved from concept to viable technology.

Best practices for developing, implementing, and managing interoperability standards

• Call for Papers Open Now Open Identity Summit Deadline: January 31st, 2026

The summit takes place May 21–22, 2026 at University of Applied Sciences Dresden (HTW Dresden) in Dresden, Germany

• Protocols for Publishers PfP✨ London on Feb 4-5, 2026 to discuss how we can preserve an open, equitable web, where no one company holds the keys.

• MOSIP Connect, Rabat Moroco, Feb 11-13. Feb 13th is an unconference day facilitated by Kaliya. Reach out to me for an invite.

• Join us at the 1EdTech Digital Credentials Summit in Philadelphia, February 18-20, 2026.

• DIF Unconference Africa (an IIW Regional Event) Feb 24-26, 2026 Cape Town

• Internet Identity Workshop #42, April 28-30, 2026, Mountain View California

• Agentic Internet Workshop #2, May 1, 2026, Mountain View California

dice: Digital Identity unConfernece Europe, June 22-24, Copenhagen, Denmark

Goodbye from Kim Duffy: From the [DIF] Executive Director

SpruceID at the SEC Roundtable: Advancing Privacy-First Digital Identity

This week, SpruceID Founder and CEO Wayne Chang participated in the U.S. Securities and Exchange Commission’s Roundtable on Financial Surveillance and Privacy, sharing perspectives on the role of digital identity in modern financial systems.

Europe

(Dyne) The Seven Sins of European Digital Identity (EUDI)

I want Europe to be excellent to all its citizens. We should develop our technological solutions following a human-centric approach grounded on principles of privacy, fairness, and inclusion. The motivation behind EUDI is that of achieving strategic autonomy for our public and social services, but its realization goes in the opposite direction, effectively putting in the hands of mobile OS manufacturers core interaction channels with the institutions governing our society. As it is today, EUDI has lost my trust, and it does not deserve yours either.

Allez! The French 🇫🇷 🫆📲 EUDI Wallet Sandbox is open for testing:

Get started here:

Documentation: https://lnkd.in/dCA_anzB

Access Form: https://lnkd.in/dPg5eu5i

New Version of EU Architecture and Reference Framework 2.7.3

The 📒”Yellow Pages” of the 🇪🇺 📲 EUDI Wallet ecosystem are live. eIDAS Dashboard

(Webinar) Advanced features of European Digital Credentials for Learning (EDC)

Statement on Canada-EU Digital Credentials and Trust Services MOU: International Alignment Benefits From Domestic Coordination

DIACC welcomes Canada and the European Union’s commitment to collaborate on digital credentials and trust services, formalized through the December 8 memorandum of understanding. International alignment matters deeply—for Canadian economic competitiveness, for secure cross-border transactions, and for ensuring our citizens can participate fully in the global digital economy.

EUDI in Practice: Inside Germany’s Digital Identity Strategy [Video and Takeaways]

In a recent webinar, we spoke with Mirko Mollik, Identity Architect at SPRIND (Germany’s Federal Agency for Breakthrough Innovation), to unpack how Germany is approaching the rollout of the EUDI ecosystem. The conversation went beyond high-level regulation and focused on the realities of implementation: how wallets will be certified, how issuers and verifiers will onboard, how privacy is enforced in practice, and which standards are truly mandatory.

Business Wallets and Organizational Identity: What the EWC Pilots Revealed

Unlike personal wallets, business wallets introduce a different set of requirements, structures, and challenges. The EWC pilots provided early insight into how these could function in real operational environments.

Digital Onboarding and Identity in Europe: The Next Frontier for Financial Services

Current LLM-based AI agents cannot establish differentiated trust when initiating cross-organizational dialogues, so this article presents a prototype using W3C DIDs and Verifiable Credentials to enable agent authentication and trust establishment, though LLM-controlled security procedures show limitations.

(European Data Protection Supervisor) [Tech Dispatch] The path towards a data protection by design and by default approach

The purpose of this TechDispatch is to introduce the concept of a DIW, understand the privacy risks that exist when using a DIW, and discuss relevant data protection by design and by default requirements and their implementation, including relevant technologies. Eventually, we assess how the European Digital Identity Wallet (EUDIW), mandated by the eIDAS 2 Regulation, fits within the framework outlined.

Germany’s eID cards issued without adequate identity verification

Gap in biometric IDV, doc verification enables fraudsters opening fake bank accounts

Thoughtful

(Bo Harald) How will AI change standardisation work?

- Semantic layers become the anchor

- Envelopes (JWT, SD-JWT, mdoc, COSE) become interchangeable wrappers

Exactly the direction you’ve been arguing for in EUDI / EBW / WeBuild:
VCDM + controlled vocabularies first, envelopes second.

Trust standards become non-negotiable

AI cannot function safely without: verifiable identity, authority, provenance, evocation.

This makes trust infrastructure standards foundational: wallets, verifiable credentials, registries, governance rulebooks.

AI forces standardisation to confront lawfulness, accountability, and responsibility head-on.

(John Philips) Apple Citizens?

“Apple don’t just want you as their customer, they want you as their citizen” - that was the conclusion that I reached (and voiced) at the IBM TechXChange workshop session yesterday in Melbourne.

(Alan Mitchell) Why the words we use matter

Two APIs Walk Into a Browser: FedCM vs. the DC API

AI and Identity

Human-in-the-Loop AI and Identity: Putting People at the Center of Machine-Driven Decisions

For identity and access management (IAM), HITL helps answer a growing question: How do we use AI to make smarter decisions without giving up control? The answer lies in balancing automation with human judgment, and identity is the anchor that makes that possible.

The Looming Authorization Crisis: Why Traditional IAM Fails Agentic AI

Where Current IAM Falls Short

Promising IAM Frameworks for Agentic AI

The stakes are high. Without a comprehensive plan for managing these agents—one that tracks who they are, what they can access, and when their permissions expire—organizations risk disaster through complexity and compromise. Identity remains the foundation of enterprise security, and its scope must expand quickly to shield the autonomous revolution.

Digital wallets & AI threats to reshape ID security

“The strategic takeaway for CISOs is clear: identity is no longer a directory entry; it is a dynamic security signal. Cyber resilience in 2026 hinges on building an ‘Identity-Runtime Mesh’ - uniting identity, zero trust, and real-time workload security to ensure accountability and control at speed.”

(Research) Evolution of AI Agent Registry Solutions: Centralized, Enterprise, and Distributed Approaches

Abstract—Autonomous AI agents now operate across cloud, enterprise, and decentralized domains, creating demand for registry infrastructures that enable trustworthy discovery, capability negotiation, and identity assurance. We analyze five prominent approaches: (1) MCP Registry (centralized publication of mcp.json descriptors), (2) A2A Agent Cards (decentralized self-describing JSON capability manifests), (3) AGNTCY Agent Directory Service (IPFS Kademlia DHT content routing extended for semantic taxonomy–based content discovery, OCI artifact storage, and Sigstore-backed integrity), (4) Microsoft Entra Agent ID (enterprise SaaS directory with policy and zero-trust integration), and (5) NANDA Index AgentFacts (cryptographically verifiable, privacy-preserving fact model with credentialed assertions). Using four evaluation dimensions—security, authentication, scalability, and maintainability—we surface architectural trade-offs between centralized control, enterprise governance, and distributed resilience. We conclude with design recommendations for an emerging Internet of AI Agents requiring verifiable identity, adaptive discovery flows, and interoperable capability semantics.

Year End Refelections + Year Ahead

The DIACC 2025 Annual Report

AI-generated fraud and misinformation threaten economic stability. DIACC’s work has never been more critical. Our new Canadian Digital Trust Adoption Dashboard provides unprecedented transparency into provincial programs. Our partnership with the SIROS Foundation positions Canada to leverage credentials for cross-border labour mobility.

2025 Reflections: Lessons from a Year of Acceleration

1. Fraud became more personal, adaptive, and believable

2. First-party fraud moved into the center of the P&L conversation

3. AI governance and data access control became operational necessities

4. KYC, AML, and financial crime teams made progress while facing higher stakes

5. Capital returned with clearer priorities and a higher bar

6: Age assurance moves from debate to implementation

Juniper Research names Indicio as a “Disruptor and Challenger” in 2025 Digital Identity Leaderboard

As digital identity threats evolve, independent market analysis shows Verifiable Credentials is the most powerful way to defend against AI deepfakes, synthetic IDs, and document fraud. Indicio’s inclusion in the report points to the strength of its market-leading decentralized identity solution, Indicio Proven®, and the pace of customer deployment.

2025 Community Awards: Recognizing Contributions from Across the LF Decentralized Trust Community

It’s that time of the year… Namirial predictions for 2026!

Research

[Research] Comparative Analysis of Traditional vs. Decentralized Identity Management: Security Implications for Enterprise Networks

This research compares centralized and decentralized identity management systems, finding that DIM frameworks using blockchain and DIDs offer superior security, privacy, and resilience against identity theft and unauthorized access, though they require careful enterprise integration.

[Research] Binding Agent ID: Unleashing the Power of AI Agents with accountability and credibility

BAID (Binding Agent ID) proposes a comprehensive identity infrastructure using biometric authentication, blockchain-based identity management, and zkVM-based code authentication to create verifiable, traceable accountability for autonomous AI agents by cryptographically linking operators to their agents’ code and execution.

[Research] AI Agents with Decentralized Identifiers and Verifiable Credentials

This article proposes equipping AI agents with self-sovereign digital identities using W3C Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) to enable autonomous, cross-domain trust establishment at the start of agent-to-agent dialogues, though evaluation reveals limitations when LLMs solely control security procedures.

News

Digital Identity New Zealand Meri Kirihimete me te Tau Hou Hari

[LFDT] Building the foundations for a decentralized world: A decade of community, code, and market development at the Linux Foundation

Ten years ago today, the Linux Foundation launched its first blockchain-related project, the Hyperledger Project, a collaborative effort to “advance popular blockchain technology.” At the time, blockchain was largely viewed in the enterprise as an experimental technology. It was promising in theory, but unproven at scale, raising questions about security, performance, governance, and regulatory fit. It was often also conflated with cryptocurrency, which many institutions associated with volatility, regulatory uncertainty, and speculative use cases.

OpenID for Verifiable Credential self-certification to launch Feb 2026

The OpenID Foundation is pleased to announce implementers will be able to start self-certifying their implementations in February 26th 2026 for OpenID for Verifiable Presentations (OpenID4VP) 1.0, OpenID for Verifiable Credential Issuance (OpenID4VCI) 1.0 and High Assurance Interoperability Profile (HAIP) 1.0 implementations through the OpenID Foundation’s conformance testing platform.

IBM Verify Identity Access Digital Credentials <- company site

Connecting Learning and Work Worldwide: 2025 CTDL Recap

The opportunities provided by digital credentials make this work more essential than ever. In the United States alone, the Counting Credentials 2025 report identifies more than 1.85 million unique credentials, with an increasing share now digital. This reflects a global shift toward new forms of learning recognition. As digital credentials expand worldwide, the need for interoperable data becomes even more critical, reinforcing the benefits of CTDL.

Why RSS matters

You may have some money left over in your budget you could contribute to the newsletter - I accept end of year lump sum contributions too. If you would like to do this send information to kaliya@identitywoman.net.

Upcoming:

• Call for Papers Open Now Open Identity Summit Deadline: January 31st, 2026

The summit takes place May 21–22, 2026 at University of Applied Sciences Dresden (HTW Dresden) in Dresden, Germany

• Join us at the 1EdTech Digital Credentials Summit in Philadelphia, February 18-20, 2026.

• DIF Unconference Africa (an IIW Regional Event) Feb 24-26, 2026 Cape Town

• Internet Identity Workshop #42, April 28-30, 2026, Mountain View California

• Agentic Internet Workshop #2, May 1, 2026, Mountain View California

Hiring:

Affindi: Standards Architect

20 other positions - https://www.affinidi.com/careers

Written Testimony on Learning and Employment Records:

Hearing on Building a Talent Marketplace: How LERs Empower Workers and Expand Opportunity US House of Representatives Subcommittee on Higher Education and Workforce Development Presented by Alex Kaplan December 10, 2025

The choice before us is clear: we can build a verified credential infrastructure that enables AI to expand opportunity for millions of Americans, or we can allow AI to perpetuate the inefficiencies of our current talent ecosystem.

Switzerland: E-ID set to go live in early 2026

On December 6, 2024, the Swiss Federal Council made decisions regarding the technical implementation of the Confederation’s new electronic identity proof (e-ID) and the underlying operational infrastructure. A press release [1] describes a two-stage

(Dave Birch) Digital Identity Lesson for the Day no. 94

𝐖𝐡𝐞𝐧 “𝐝𝐢𝐠𝐢𝐭𝐚𝐥 𝐈𝐃” 𝐢𝐬 𝐣𝐮𝐬𝐭 𝐚 𝐩𝐫𝐞𝐭𝐭𝐲 𝐩𝐢𝐜𝐭𝐮𝐫𝐞, 𝐭𝐡𝐢𝐬 𝐢𝐬 𝐰𝐡𝐚𝐭 𝐡𝐚𝐩𝐩𝐞𝐧𝐬. Denver man was just charged with spoofing Colorado’s digital ID app to forge driver’s licenses and open lines of credit. Story here: https://lnkd.in/e5TecUCe

EU and Canada Map Out Interoperable Digital ID Wallets

The European Union and Canada are turning their digital partnership into concrete work on interoperable digital identity wallets, using a new Memorandum of Understanding on digital credentials and trust services to frame cross-border pilots and standards alignment. The first meeting of the Canada-EU Digital Partnership Council took place in Montreal on December 8, co-chaired by Canada’s Minister of Artificial Intelligence and Digital Innovation Evan Solomon and European Commission Executive Vice-President Henna Virkkunen.

Standards

ToIP Announces Public Review 02 of the Trust Registry Query Protocol (TRQP) Specification V2.0

The Trust Registry Query Protocol (TRQP) is a lightweight, read-only protocol for making fast, efficient queries for authoritative data from trust registries. It is often described as “DNS for trust.” Just as DNS name servers serve name domains, TRQP trust registries serve trust domains (also known as digital trust ecosystems).

A MyTerms Summary

The MyTerms standard also says that both sides will use machine agents to make agreements. These can be as simple as browser plug-ins on the individual side and server plug-ins on the corporate side. They can also be AI agents, which is why it is opportune for the standard to be published in an age when AI is still a new and rapidly evolving—for both companies and individuals.

Announcing the 2026 OpenID Foundation Community Representatives Election

- Nominations open: Monday, December 8, 2025

- Nominations close: Friday, December 26, 2025

- Election begins: Monday, December 29, 2025

[Report] G20 TechSprint 2025: Trust and integrity in scalable and open finance

Digital identity solutions for secure and trusted finance

G20 TechSprint 2025: Innovative approaches from shortlisted finalists

Meeco - By providing portable, verifiable and privacy-preserving credentials, the platform builds

trust and unlocks a wide range of identity use cases for individuals and businesses.

Walt.id - Walt.id delivers an open source decentralised identity and wallet infrastructure that extends interoperability across payment systems.

What I Wish I Knew When I Started in Identity

The most common thing I hear from people in their first six months is some variant of: “I didn’t realize how big this was.”

And because it’s big, it’s also intimidating. The learning curve feels like a hill that grows steeper as you climb it. Newcomers oscillate between excitement—because identity really is fascinating—and frustration, because every answer seems to introduce a new question.

Dock Labs Year in Review 2025: Digital ID’s Breakout Year

This yearly review reflects on how the market evolved, how our strategy aligned with these shifts, and what it reveals about where digital identity is heading next. On the way, we’ll discuss the move toward reusable digital identity, the growing demand for stronger authentication, the emergence of AI agent identity, and the rise of reusable organizational identity.

ArgonAuths x Human Colossus: Finalists at HackNation 2025 — Redefining Trust in the Digital Public Sphere

We are thrilled to share that Team “Sigmion” - joint forces of Argonauths and Human Colossus – has been selected as one of the three finalists in the Prawda w Sieci (“Truth on the Web”) challenge, held under the patronage of Centralny Ośrodek Informatyki (COI), the institution behind Poland’s digital-services and identity initiative mObywatel.

(Indicio) Game over, traditional identity authentication — game on, Verifiable Credentials

The result is the growth of “Fraud-as-a-Service (FaaS), a global market where identity forgery, credential spoofing, and document manipulation are packaged and sold on demand.”

Stop doing identity authentication the same way and shift to decentralized identity and Verifiable Credentials for identity and document authentication.

(SpruceID) How Strong UX Turns Digital ID Into Strong Security

Usability is a security requirement. And for those building the next generation of digital identity, recognizing that truth changes how we plan, deploy, and measure success. Read on to learn how treating usability as a core security principle strengthens adoption, accessibility, and trust in digital identity systems.

(EDRi) Rushed EU eID Wallet risks privacy and security: Calls for safeguards are getting ignored in hasty eIDAS implementation

From a visit to the doctor to public transport tickets , the European eID will handle our most sensitive personal data in a wide range of every-day applications. Yet, speed seems more important to the European Commission than a properly functioning eID system that is safe & secure to use.

When destinations start thinking: how the WorldModel becomes the next big category in themed entertainment

Imagine arriving at a destination that understands you. Not because it tracks you or because an app predicted your behaviour, but because the place itself behaves with awareness.

It is the reason mega-projects in the Middle East, Asia, Europe, and the United States are now explicitly asking for one thing: a venue-wide, multi-venue, multi-campus intelligence layer that makes the environment coherent.

SAP Self-Sovereign Identity Product Page

Smart ring maker Oura looks to ride recent investments into digital identity market

In 2023, Oura acquired Proxy, a U.S. identity tech startup that had previously absorbed smart ring startup Motiv, signaling an interest in authentication use cases for the Oura ring.

[Podcast] Crypto Altruists Episode 203 - Privado ID - Building Trust Between Humans and AI Agents with Blockchain-Powered Decentralized Identity

In this episode, Evin shares powerful insights from her vast experience about why decentralized identity matters deeply, how blockchain-driven privacy solutions are essential for safeguarding our digital lives, how Web3 can empower the one billion people who lack proof of identity, and why Privado’s Billions Network and Quadratic Accelerator are game changers—not just for Web3, but for the responsible evolution of AI as well.

[article] (Biometric Update) Turing Institute introduces Digital ID Safety Pack to protect against common threats

The Alan Turing Institute’s Cyber Threat Observatory hosted an information-rich webinar on Trustworthy Digital Infrastructure for Identity Systems. Over the three-hour webinar insights on face morphing, fraud, digital identity in Sri Lanka and Ethiopia, threat reporting, and much more, were delivered.

[report] Cyber Threat Observatory for National Identity Systems Quarterly Report: Generative AI and the Rise of Credential Fraud in Digital Public Infrastructure November 2025

This report provides a comprehensive and strategic analysis of the escalating threats posed by synthetic identities and deepfake-enabled credential fraud within Digital Public Infrastructure (DPI). As DPI systems, particularly digital identity platforms, become foundational to public service delivery, their risk exposure also increases.

[Research] Privacy evaluation of the European Digital Identity Wallet’s Architecture and Reference Framework

The paper conducts a comprehensive privacy analysis of the European Digital Identity Wallet (EUDIW) across three key use cases, identifying multiple privacy risks including linkability, identifiability, and excessive data disclosure that stem from inherent design choices like SD-JWT/mDOC formats and Wallet Unit Attestations. The authors demonstrate how advanced Privacy-Enhancing Technologies, particularly Zero-Knowledge Proofs, could mitigate these privacy risks while maintaining the high assurance levels required for regulated identity use cases.

[Research] How does the EU Digital Identity Wallet change the risk of over-sharing data? A Dutch perspective.

This paper analyzes the risk of over-sharing personal data through the EU Digital Identity Wallet based on expert interviews, identifying that users may share more data than strictly necessary due to factors including user capabilities, loss of context awareness, data quality issues, and the ease of sharing mechanisms. Despite the DIW’s goal of giving citizens control over personal data sharing, the research reveals that multiple aspects influence over-sharing risk and require deeper understanding to effectively protect user privacy in practice. launch of the e-ID, with the first delivery planned for 2026.

Grace has been deeply involved in building communities around decentralized technology that prioritize individual rights and human agency. She brings a rare combination of governance expertise, practical execution, and a deep understanding of how people collaborate in decentralized environments. I’m especially excited about her commitment to global outreach.

Ethereum Publishes: Decentralized Identity

Digital Credentials

(SpruceID) Highlights from NAPHSIS: Building the Next Layer of Digital Verification for Vital Records

His presentation, Identity, Privacy, and Trust: Building the Next Layer of Digital Verification, outlined why verifiable digital credentials (VDCs) are rapidly becoming essential public infrastructure, and how states can implement them in a secure, privacy-preserving, and interoperable manner.

(SpruceID) How Does Multi-Format Issuance Future-Proof Digital Credentials?

As states modernize digital identity programs, one architectural decision stands above the rest: what credential format to issue. But here’s the reality, there’s no single format that works everywhere. Airport security, online age verification, healthcare check-ins, and cross-border transactions each rely on different ecosystems. Issuing in only one format means leaving residents stranded when they step outside that ecosystem.

Testing is at the heart of EUDI Wallets Launchpad 2025

The EUDI Wallet Launchpad Testing track aims to bring together different actors involved in the development, testing, and roll-out of the European Digital Identity Wallet ecosystem. Participation is open to all Member States and associated stakeholders contributing to the EUDI framework implementation process, regardless of their current level of technical maturity.

Trust

Trust Engineering

The second- and third-order consequences of AI are still a weak signal in most security and privacy conversations. System-1 thinking remains dominant: defense, fear, compliance checklists, guardrails, and higher walls. A faster-developing System-2 signal is now emerging: the privatization of trust and the discipline of Trust Engineering.

(Sankarshan) The Political Economy of Trust Registries

Digital trust stacks are often described as a set of modular components: identifiers, verifiable credentials, wallets, protocols, assurance frameworks. In that diagram, trust registries are usually drawn as a small box somewhere in the background, labelled “directory of issuers” or “list of authorities.” The visual rhetoric is deliberate, and it is misleading: it suggests that registries are supporting utilities rather than centres of power.

(Sankarshan) The Computational Pressure on Personhood

The danger of being known without being understood lies not in the volume of data collected but in the assumptions embedded in its interpretation. Digital systems misread complexity as inconsistency, nuance as noise, and context as risk. They see too much and understand too little. This imbalance produces structural inequity because the system’s misunderstandings are expressed as rules, flags, or scores that determine real-world outcomes.

Digital Trust Is Not Engineered — It Is Negotiated: Trust Lives in the Space Between Security, Privacy, and Safety

Trust is created not by choosing privacy, safety, or security alone, but by balancing them in everyday decisions — whether it’s journalists protecting sources while relying on oversight, parents setting boundaries without invading a child’s privacy, or banks preventing fraud without collecting excessive data. Trust emerges when no single value overwhelms the others.

AI and Identity

Dick Hardt on MCP Security

This is the first installment of my conversation with Dick Hardt, covering his thoughts on agentic security and his work on Agent Auth (AAuth). We’ve edited the interview for readability and clarity.

(David Birch) Digital Public Infrastructure and Agents

We need to extend digital public infrastructure to AIs.

I have to say I agree with him wholeheartedly about this, and also see his view that agents will soon conduct “most” economic transactions as far from hyperbolic. And I’m not the only one. Craig DeWitt, from Skyfire (who are building agent-agent infrastructure) makes a similar point:

“AI has payment and identity requirements that are different from anything we’ve seen before”.

He goes on to talk about the paradigm shift here, meaning that we are looking at an entirely new approach to how agents will access and pay for services.

Death

(Interview w/ Dean Saxe) Life, death, and online identity: What happens to your online accounts after death?

This emerging area of asset management remains in its early stages, facing a complex technological landscape, fragmented (or nonexistent) legal frameworks, and significant systemic gaps.

To address these challenges, the OpenID Foundation (OIDF) has been developing a new whitepaper and a digital estate planning guide that examine this issue on a global scale.

Kenya just sold 25 years of citizen health data for $20 per person.

Kenya signed a 25-year agreement giving the US unprecedented access to:

👉 Personal medical records

👉 Genetic information

👉 Lab samples

👉 Insurance details

👉 Digital health platforms

The price? $1.6 billion over 5 years.

EU’s data policy overhaul: what’s missing, what’s next, and four big ideas that matter

November 19 was a big day for EU data policy. It saw the release of the European Data Union Strategy (now reframed to pursue data for AI), the Digital Simplification Omnibus (proposing simplifications and reforms across multiple acts and directives), and a Digital Fitness Check call for evidence (to review how the entire body of regulation on digital “affects and supports the competitiveness objective of the EU”).

(LFDT/Indicio) [Case Study] Open source flywheel: Indicio turns leadership in the LF Decentralized Trust community into credibility, growth, and global reach

The founding team chose to focus on community leadership rather than traditional marketing. Indicio built its flagship offering, Indicio Proven, directly on technologies openly developed by LF Decentralized Trust and, in some cases, now OpenWallet Foundation communities, including Aries Framework, ACA-Py, Credo, Hyperledger AnonCreds, Hyperledger Indy, and Trust Over IP.

(DIACC) From Trust to Growth: The Business Case for Digital Client Verification in Open Banking and Lending

The Digital ID and Authentication Council of Canada (DIACC) convened an industry workshop in Montreal focused on exploring the business case for digital trust in open banking and lending. The session brought together stakeholders from government, financial services, technology providers, and legal sectors to examine how digital client identity verification (IDV) can drive measurable value while mitigating fraud and enabling growth.

(OIDF) Public Review Period for Proposed OpenID Federation 1.0 Final Specification

A Final Specification provides intellectual property protections to implementers of the specification and is not subject to further revision. This note starts the 60-day public review period for the specification draft in accordance with the OpenID Foundation IPR policies and procedures.

FIDO Alliance Launches New Digital Credentials Initiative to Accelerate and Secure an Interoperable Digital Identity Ecosystem

The FIDO Alliance announced today the launch of a new digital credentials initiative, marking an expansion of its mission to accelerate the adoption of verifiable digital credentials and identity wallets. This initiative is poised to help the world simplify and secure online and in-person interactions by establishing a trusted, and interoperable identity wallet ecosystem.

(Indicio) Verifiable Credentials strengthen AML compliance, KYC for digital assets and finance

To:U.S. Department of the Treasury.

Subject: Request for comment, Innovative Methods To Detect Illicit Activity Involving Digital Assets

Thoughtful

Robots, Humans, and the Edges of the Open Web

A week later, at the W3C TPAC meetings in Kobe, Japan, I ended up in an almost identical conversation, hosted again by Mark and David, fortunately a somewhat larger room. That discussion brought in new faces, new community norms, and a different governance culture, but in both discussions, we almost immediately fell to the question:

Digital Identity, Tokenization, and the Burning Platform

Digital Identity in the context of Asset Tokenization provides the necessary trust fabric and helps in regulatory compliance for asset tokenization to unlock dormant capital. Tokenization is the process of issuing digital representations of assets on a programmable ledger. A game changer because of the below:

Updates

VeriMe Cooperative

VeriMe is a membership cooperative dedicated to researcher identity verification. Worldwide.

We provide researchers digital identity verification services that enable verified access to research systems, facilities, and workflows without exposing personal data.

ASEAN ID Update

Brunei has softly launched BruneiID (with a cool website: https://lnkd.in/gaSYXZXQ) and Indonesia has made improvements to IKD. I’ve also added Malaysia’s MyGOV app, which includes a wallet, while myDigitalID is an authenticator.

Research

[Reserch] Towards a refined architecture for socio-technical decentralized identity services

While blockchain-based Decentralized Identity (DID) services are increasingly recognized as foundational for secure, user-controlled identity management, existing implementations remain predominantly technology-focused and overlook critical socio-technical factors such as governance, usability, and stakeholder trust. This study addresses this gap by proposing an STS-based (Socio-Technical Systems) framework that integrates social and technical components, validated through expert consultation, and introduces a Refined DID Service Architecture for enterprise deployment that balances technological robustness with social acceptance while addressing key adoption barriers like interoperability gaps and regulatory inconsistencies.

[Research] Designing and implementing the trust diamond for verifiable and privacy-preserving data sharing: engineering energy flexibility provision

This study addresses the tension between data verifiability and privacy in electricity grid operations—where grid operators need verifiable data from small-scale flexibility devices while owners seek data protection—by designing a Flexibility Provision Data Flow and digital Trust Diamond using wallet-based identity management. Through Action Design Research, the authors develop two design principles (Verifiability through Delegation and Mediated Sovereignty) and propose a Decentralized Flexibility Provision Architecture that demonstrates practical scalability in laboratory and field tests, enabling privacy-preserving yet verifiable data sharing for decentralized grid flexibility and Redispatch measures.

[Research] A Security and Usability Analysis of Local Attacks Against FIDO2

In this paper, we explore threats from local attacks on FIDO2 that have received less attention---a malicious browser extension or cross-site scripting (XSS), and attackers gaining physical access to an HSK. Our systematic analysis of current implementations of FIDO2 reveals four underlying flaws, and we demonstrate the feasibility of seven attacks that exploit those flaws

You may have some money left over in your budget you could contribute to the newsletter - I accept end of year lump sum contributions too. If you would like to do this send information to kaliya@identitywoman.net.

Upcoming

• Call for Papers Open Now Open Identity Summit Deadline: January 31st, 2026

The summit takes place May 21–22, 2026 at University of Applied Sciences Dresden (HTW Dresden) in Dresden, Germany

• European Commission is hosting the EUDI Wallet Launchpad in Brussels (Dec 10-12).

• Advanced features of European Digital Credentials for Learning (EDC)”, 11 December at 11:00 CET.

This webinar is a follow-up to the Basics of European Digital Credentials for Learning organised in January 2025 and is a great opportunity to deepen your knowledge about EDC and its use. Focus on advanced topics such as implementation scenarios (service vs. code-based), available resources on code.europa.eu, EDC claim types, REST API integration, credential preview customisation, and future developments, including new credential types, improved sealing options, and replicable use cases for University Alliances.

• NCCoE Mobile Driver’s License Project Update Webinar December 16, 2025.

The NIST National Cybersecurity Center of Excellence (NCCoE) is making progress in accelerating the secure adoption of mobile driver’s license (mDL) standards and best practices. Join us for a webinar where we’ll be sharing newly available project resources and announcing our second project use case.

• Join us at the 1EdTech Digital Credentials Summit in Philadelphia, February 18-20, 2026.

• DIF Unconference Africa (an IIW Regional Event) Feb 24-26, 2026 Cape Town

Hiring

Finacore

“We’re honored to announce that filancore has been listed as a Verifiable Credentials provider in two Gartner Hype Cycles this year!”

New Projects

AgroWeb3: Verifiable Credentials for Smallholder Farmers

Three million: Develop the ecosystem of verifiable digital credentials in four countries in Latin America and the Caribbean for their use in managing the economic and environmental asset portfolios of smallholder farmers (AgroWeb3).

Thoughtful

(Heather Flanagan) Digital Identity Wallet Standards, the DC API, and Politics

The DC API is a protocol under development at the W3C. It isn’t a standard yet, it isn’t a wallet, and it isn’t an OS-level API. It’s one layer in a larger system.

The DC API connects a request from the browser to a wallet. Everything else happens above or below it. Tim Cappalli is doing amazing work documenting this on the Digital Credentials Developers website.

(Kuppinger Cole) Apple’s Digital ID Move: Helpful Progress, but Not Yet the Breakthrough

MyData in Practice: Transforming Job Seeking By Aggregating #SkillsData

The Death of the Wallet

Chapter 1: The Skeuomorphic Trap

Chapter 2: The Rise of the “Person Agent”

Chapter 3: The “Organization Agent”

Chapter 4: The EUBW Paradox

Chapter 5: The Ephemeral Context

Chapter 6: Conclusion

[video] (Spruce) How Verifiable Digital Credentials Work

Today’s identity systems weren’t built for the digital world. Verifiable digital credentials offer a modern alternative: secure, portable, privacy-protected, and built for cross-agency use. In this video, we break down how this technology works across public services.

ACDCs Should Underpin Digital Trust; Keep W3C VCs as Derivative Artifacts

Standards

VC Bitstring Status List Interoperability Report 1.0

Test Interoperability Report for Verifiable Credentials status

30 November 2025

HAIP 1.0 & OpenID4VP 1.0 achieve 98% in OIDF interop testing

The OpenID Foundation is proud to announce successful interoperability testing of the High Assurance Interoperability Profile (HAIP) 1.0 draft 05, alongside the Final specifications for OpenID for Verifiable Presentations (OpenID4VP) 1.0 and OpenID for Verifiable Credential Issuance (OpenID4VCI) 1.0.

Bloomberg joins the OpenID Foundation as newest member and commits directed funding for AuthZEN

The OpenID Foundation is pleased to welcome Bloomberg as its newest member. Bloomberg, a global leader in business and financial information, brings a wealth of expertise and a strong commitment to advancing open identity standards that will benefit the entire community.

Education

Get More out of Open Badges: How Velocity Network complements Open Badges to ensure trust, privacy and utility

The Velocity Network, governed by the Velocity Network Foundation community, perfectly aligns to all these requirements, clearly and transparently defining all elements of the rulebook….Not only are all these requirements defined by the global community in a democratic process, but the rulebook is implemented in a fully operational, scalable, open and public infrastructure – the Velocity Network MainNet.

Children

When Children Design AI: What We Learned by Actually Listening

What if children aren’t just AI users to be protected, but experts we should be learning from? At MyData 2025, the MyData4Children workshop turned the usual conversation on its head. Instead of adults designing AI for children, seven children aged 7-10 took the lead, showing us how they understand AI, what they want from it, and—perhaps most importantly—what they absolutely don’t want it to do. The results surprised even the parents in the room.

From Pilot Programs to Global Mandate: Age Assurance’s New Reality

Age assurance has moved from a developing trend to a global mandate, and the broader world of age verification has shifted with it. More than 45 countries now require platforms to verify age through methods like device-based age verification, on-device estimation, reusable credentials, or structured checks tied to new age verification laws.

The European Parliament close to calling for a ban on social networks for under-16s

AI

Agent Name Service (ANS): A Universal Directory for Secure AI Agent Discovery and Interoperability

(Indicio) Four reasons why travel companies using AI need Indicio Proven

How to prevent a spoofed AI agent in your travel solution? AI isn’t going to work if customers can’t trust your agents — and right now legacy authentication isn’t up to the task. At Indicio, we’re making AI systems a practical, implementable reality for travel and tourism by using decentralized identity and Verifiable Credentials for secure, privacy-preserving, GDPR-compliant authentication and data sharing.

Building AI Trust at Scale: Authorising Autonomous Agents at Scale

[Video] (Dock) Know Your Agent: Solving Identity for AI Agents [Video and Takeaways]

The rise of AI agents is one of the most significant shifts unfolding across the internet today. From booking travel to managing work tasks, agents are quickly becoming powerful tools that act on behalf of users. In fact, by next year, there may be more non-human agents online than human users. The promise is clear: automate the drudge work and reclaim your time.

(Glama) Securing Enterprise AI Agents with Unique Identities in the Model Context Protocol (MCP)

(dock)5 Identity Gaps That Put AI Agents at Risk

Identity proofing: Verifiable digital credentials in the AI era

When AI Becomes the Attacker: Rethinking Identity for Agentic AI

Identity and Access Management for AI Agents

Agentic AI explosion driven by $50B market opportunity and related risks

Schematic Interoperability Lives in the Architecture, Not the Models

[blog and short video] (GLEIF) vLEI: Accelerate Innovation by Enabling Trusted Digital Identity using Verifiable Credentials

New Wallet / Updates

Learner Credential Wallet

Digital Diplomacy

European Union and Singapore discuss reinforcing digital cooperation through Digital Partnership Council

Artificial Intelligence

Online safety and tackling scams

Trust services

Cybersecurity

Data

Semiconductors and quantum

Nesen.ID (SlideDeck) (Video)

Decentralized Social

The State of the Open Social Web

From the “This Doesn’t Sound Good” Department

Google Starts Sharing All Your Text Messages With Your Employer

Identity verification processes broke down during Trump govt transition: report

Research

(Research) On Addressing Isolation in Blockchain-Based Self-Sovereign Identity

Unfortunately, blockchains are mostly siloed, affecting the interoperability and universality of SSI. We investigate the effect of blockchain isolation on blockchain-based SSI. We first define possible scenarios for cross-chain SSI and exemplify with real-life use cases

(Research) DID-TUF [The Update Framework]: Secure Decentralized Identifier Management using Trustless Registries

The Update Framework (TUF) to enable secure and efficient dissemination of DID documents through a trustless registry model. This method blends the strengths of registry-based and registry-less approaches to enhance the resilience and security of decentralized identity systems. Our solution is robust against a wide range of attacks while maintaining a small overhead. It is also agnostic to the DID document storage method and provides an auditable trail of updates.

(Research) Towards a Universal Digital Identity: a blockchain-based framework for borderless verification

The paper sets out the vision, necessity, operational framework, and implications of a blockchain-based UDI, arguing that such a transformation is both inevitable and essential for the future of the digital economy.

(Research) Modern IAM Standards Landscape: A Systematic Mapping of Open IAM Standards to Enterprise Identity Frameworks

The study finds that the strengths of coverage in authentication and Single Sign-On (SSO) are high, coverage in provisioning is moderate, and coverage in governance integration is high. An open-source implementation taxonomy, that is, Keycloak, Ory, Gluu/Janssen, Open Policy Agent (OPA), and MidPoint, is created to measure interoperability, maturity, and standard compliance. The resultant assessment framework incorporates process coverage, implementation maturity and governance alignment and offers a blueprint that researchers and practitioners can use to standardize IAM implementations.

(Research) A Review on Blockchain-Based Trust and Reputation Schemes in Metaverse Environments

This paper provides an extensive review of blockchain-enabled trust and reputation frameworks specifically tailored to metaverse ecosystems.Our analysis finds that score-based designs trade scalability for nuanced reputation representation, while SSI- and SBT-based approaches improve Sybil-resistance but introduce significant privacy governance challenges.

The summit takes place May 21–22, 2026 at University of Applied Sciences Dresden (HTW Dresden) in Dresden, Germany

• SIDI Hub Pre-Conference Workshop @ TRUSTECH 2025 - Paris, France | Tuesday, 2 December 2025 | 14:00 – 18:00 CET

• NCCoE Mobile Driver’s License Project Update Webinar December 16, 2025.

The NIST National Cybersecurity Center of Excellence (NCCoE) is making progress in accelerating the secure adoption of mobile driver’s license (mDL) standards and best practices. Join us for a webinar where we’ll be sharing newly available project resources and announcing our second project use case.

• Join us at the 1EdTech Digital Credentials Summit in Philadelphia, February 18-20, 2026.

• DIF Unconference Africa (an IIW Regional Event) Feb 24-26, 2026 Cape Town

(SprucID) Interoperability Is a Policy Decision, Not Just a Technical One

States should prefer that the technical standards used in a state digital identity program be open, freely available, and implementable by the public and private sector without proprietary licensing restrictions. Open standards are critical to ensuring transparency, interoperability, and long-term sustainability.

(MATTR) Rethinking “coverage” in digital credential verification

The real opportunity lies in asking the next layer of questions: How do we make sure verification remains future-ready? How do we design for interoperability from day one? That’s where digital trust moves from being a checkbox to a true enabler of transformation

[Video] EUDI: Key Takeaways From Europe’s Largest Digital ID Pilot

The European Digital Identity Wallet is entering one of the most consequential phases of its rollout, and few people are closer to the work than Esther Makaay, VP of Digital Identity at Signicat. After spending the last three years at the center of the European Identity Wallet Consortium (EWC), Esther joined us for a deep-dive presentation on what the Large-Scale Pilots have actually delivered, and how ready Europe truly is for the 2026 deadline.

EUBW Draft, Nov 19 2025: What to Expect and Why This is Important

The EUBW will sit at the centre of almost all major EU digital and industrial initiatives: DPPs, Industry 4.0, data spaces, NIS2, the Cyber Resilience Act, reporting obligations, Trusted AI, VAT in the Digital Age, customs modernization, and Europe’s digital sovereignty agenda. If the EUBW is fragmented or built on the wrong foundations, all these initiatives will inherit the same fragmentation and complexity.

🍏 Apple just turned identity into a product category.

🇪🇺 Businesses are getting their own digital wallet, and this will reshape how companies operate across borders.

Rethinking the “Wallet”: Why Words Shape Digital Identity Architecture

New Zealand Government: Dept of Internal Affairs: Trust Framework Forms and Guidance Updated Nov 2025

China’s internet ID push signals a new era of digital control

The digital ID system also complements other previously designed surveillance systems, such as Sharp Eyes, police cloud systems, facial recognition closed-circuit television systems and grid-style social management, allowing the Chinese Ministry of State Security to link online activities directly into national monitoring systems.

The digital ID system also complements broader data-localization and true-name tracking policies first enacted in 2017 under the Cybersecurity Law and fortified under the Personal Information Protection Law of 2021.

Elements of a Community-Governed Trust Framework (and how Velocity Network delivers them all TODAY)

In an article published in November 2025 titled “Credentials not anchored in law – versus anchored”, Bo Harald, a thought leader in verifiable credentials and Trust Infrastructure, explains the critical roles of a trust layer. In this article, he explores the difference between credentials anchored in law and those not anchored in law.

Identity and AI

[Report] (INATBA) Building Trust: Integrating AI, Blockchain, and Digital Identity

The convergence of Self-Sovereign Identity (SSI) and Artificial Intelligence (AI) represents a significant step toward establishing a global benchmark for digital trust, rights-based governance, and competitiveness.

Auth0 for AI Agents is Now Generally Available (GA)

Secure Your AI Agents: The Power is Already in Your Auth0 Plan

(Indicio) Win Web3 with Verifiable Credentials from Indicio

Exclusive: Bitfury, known for its Bitcoin mining, launches $1 billion initiative to invest in ethical tech and AI

“We’re big fans of [the American architect] Buckminster Fuller, who said, ‘You never change things by fighting the existing reality. To change something, build a new model that makes the existing model completely obsolete,’” Kikvadze said.

Telecoms

ATIS Releases New Framework for Telecom Organizational Digital Identity Governance

The paper outlines how verifiable credentials can integrate with existing STIR/SHAKEN and Rich Call Data (RCD) frameworks to enable end-to-end verification of organizational identity for calling and messaging. It further highlights how integrating existing trusted organizational digital identity into telecom infrastructure, the industry can significantly elevate the integrity of communications.

Labor Market Needs VCS to counter AI

The New Hiring Crisis: AI Fakes and the Need for Verifiable Credentials

Right now, candidates with real credentials spend weeks in background check limbo while fraudulent candidates breeze through with convincing stories and AI-generated answers. Verifiable credentials flip that equation. The honest candidates move faster. The fraudulent ones get filtered out before they waste anyone’s time.

Labour market institutions for the AI era: The need for verified employment records

The rise of AI fundamentally alters the balance between formal credentials and verified experience in labour markets, but without verified employment records, experience remains invisible. This column reviews employment record systems across eight advanced and emerging economies, as well as EU-level initiatives, to establish design principles and draw lessons from implementation failures. The analysis reveals that technical infrastructure alone does not guarantee success. Effective systems require aligned incentives, continuous stakeholder engagement, and careful sequencing.

Money and Identity

[Slide Deck] (Hart Montgomery) Practical Privacy for DEFI with an Open Source Software Perspective

Shaping the future of finance: key insights from M2020 USA.

- The era of agentic AI.

- Stablecoins and the future of money.

Company News

(IBM) Combat Identity Fraud with IBM Verify Digital Credentials: Secure, Interoperable, Future-Ready

Microsoft Entra Verified ID Identity Verification partners

Our Identity Verification (IDV) partner network extends Microsoft Entra Verified ID capabilities to help you build seamless end-user experiences. With Verified ID, you can integrate with IDV partners to enable scenarios like remote onboarding, secure access to resources and Account recovery with Government ID checks using identity verification and proofing services.

(Walt.ID) The SSI Kit: Discontinuation Notice!

Web3 Keeps trying to solve Proof of Personhood

Proof of Personhood: How Polkadot proves you’re real without KYC

Why cheqd is Changing from Trust Registry to Trust Graph

Instead of a simple list, a Trust Graph maps the rich, living connections between people, organisations, and AI agents, showing not just who is trusted, but how, why, and to what degree. It’s a more dynamic and connected way to represent trust in the digital age.

A Trust Graph is a living, interconnected network that shows how trust flows between people, organisations, and AI agents. It maps the relationships, hierarchies, permissions, and reputation signals between them. Think of it as a constantly evolving web of trust rather than a static spreadsheet.

Web 3

ENS looses patent fight with Unstoppable Domains

The UK is bringing in digital IDs. Here’s how to stop them becoming surveillance tools

For governments, SSI could underpin a digital ID framework that strengthens trust and efficiency without enabling mass surveillance, just like Switzerland.

[short video] (NEC) Face Recognition and Self-Sovereign Identity Reinvents Customer Experience [1:30]

Thoughtful

The Alternatives to Sorting Out Trust All Suck

Trust is so central to humanity that I’m surprised it doesn’t figure more prominently in recent visions of where we’re headed. I haven’t found a rigorous, exhaustive (MECE) framework that encompasses all the futures we might face, but the futures on offer today do seem bleak.

(Heather Flanagan) The Regulator’s Dilemma

SWIYU (Swiss Government) Trust Protocol based on VCs

This document defines the publicly consumable technical specification of the trust protocol, is based on VCs and was created as an initial concept for the swiyu Trust Infrastructure. The aim is to provide a straight-forward solution allowing a governing body (trust issuer) to confirm the identity of issuers and verifiers.

swiyu Trust Infrastructure: Interoperability profile

Implement MFA using swiyu, the Swiss E-ID with Duende IdentityServer, ASP.NET Core Identity and .NET Aspire

With OpenAge, k-ID presents itself as one big interoperable solution for age checks

Funke challenge by SPRIND - Bundesagentur für Sprunginnovationen.

Last Funke conference recording: https://lnkd.in/e4Qne9Zc

The funded teams just dropped their codebases publicly — a rare chance to peek under the hood of real EUDI Wallet implementations built with passion, specs, and caffeine. The best: all under Apache 2.0 license, so feel free to work with it. OpenCode Repo: https://lnkd.in/e9kXnYsc

New Aadhaar App: How to use UIDAI’s new Aadhaar App for face authentication, offline QR, and verifiable credentials

The app promises a safer and smarter way to use an Aadhaar card anytime, anywhere. It allows residents to access all their Aadhaar details on their smartphones and share the data in a verifiable credential format.

Biometric locking/unlocking: This feature secures biometric authentication by locking biometric data. Once enabled, biometrics remain locked until the Aadhaar holder temporarily unlocks or disables the system.

UIDAI’s Latest Aadhaar App Turns Your Phone Into a Secure Digital ID Wallet: What’s New

Kantara Achieves Historic First: Accredited to Certify Against the UK DIATF

Statement on Bill C-4: Balancing Economic Relief with Privacy Considerations (Canada)

Framework vs. Credential: Choosing the Right Model for State Identity

Explore why a flexible, standards-aligned framework offers the strongest foundation for modern, privacy-preserving digital identity.

Digital identity and the UK government’s announceability problem

Digital public services and infrastructure are complex sociotechnical systems. Getting them right is the result of thousands of small product design decisions. Policy professionals are not product specialists. To ensure the civil service is delivering what they want, ministers need to get much closer to product delivery teams — and demand that announcements they sign off on give teams the space they need to deliver at speed, not create inertia.

DPI Explored

From Backend to Citizen: Design Systems as the Translation Layer for Digital Government

- Conditions and structures that help a design system emerge, be sustained, and delivered

- Understanding design systems in government beyond visual standardization—the “behind the scenes” elements that make a design system truly systemic

- The value of design systems—how they progress and are shared across government

Thoughtful

Beyond the Glass Cage: Why Self-Sovereign Identity, Not Blockchains, Will Power Agent Autonomy

The choice between blockchains and self-sovereign identity isn’t just technical — it’s philosophical and practical. It determines whether we repeat the centralizing mistakes of the past, just distributed across more servers, or finally build the genuinely decentralized future we’ve been promised.

Identity Heros Podcast: Heather Flanagan

(David Kelts) Categories of the Mechanisms of Trust Management + Trust Vectors

- Centralized trust anchor (one CA authority)

- Hierarchical PKI (common trust anchor)

- Federated (multiple trust anchors authorized by the Trust Framework). A Trust Registry may be the mechanism for dispensing trust anchors for inspection. There may be a convention for querying any participant about conformance.

- Decentralized Trust (Smart Contracts as trust anchors (?) coordinated by the Trust Framework)

- Free Market (lack of conventions or mechanisms; can create reliance on reputational trust only)

Questions of Readers of this Blog Post: Are there any other Trust Vectors overlooked?

Trust Was Never the Problem - Proof Was

One expert put it bluntly: “Lack of data ownership and protections is limiting blockchain’s impact. Institutions need privacy for regulatory compliance. Without protections, data is freely available.”

Verifiable Credentials (VCs) and Decentralised Identity The backbone of proof-based trust. These allow an issuer to digitally sign data about you (a credential), which you store and later present as needed. “Verify once, use everywhere.”

Identity and Payments

(Fime) Payment tokenization. Has a tipping point been reached and what are the implications?

Payment tokenization has strong crossovers to the emerging work on payments within identity initiatives such as the European Identity Wallet. Whilst initially appearing quite separate, the core topics of authentication, trust and assurance lie deep within both topics.

(Signet) Verifiable Credentials Management

The verifiable credentials model handles the data fields used in the VC Management API endpoints for managing enrollments, credentials, and payments. It enables secure enrollment of users, issuance of payment authorization credentials, and processing of verifiable payments.

eIDAS

(walt.id) [Report] eIDAS2 Implementers Guide

In 2016 the eIDAS (electronic Identification, Authentication and Trust Services) regulation created a framework for cross‑border electronic identification. It focused on a small set of trust services, notably electronic signatures, and left wide latitude to Member States. As a result, national implementations diverged, interoperability remained limited and citizens lacked a harmonised digital identity. During the pandemic, physical presence requirements made identity proofing difficult and fragmentation slowed adoption beyond the public sector.

(Katryna Dow: MeeCo) 🇪🇺Part 2: EUDI Large Scale Pilots Final Reports 📑

This week we feature the results published by the EU Digital Wallet Consortium (EWC) where the focus was on travel ⛴️ ✈️ and payments 💶

The great news is the “technical” progress, confirmation on infrastructure and interoperability - these are all incredible milestones. ✅

But....now the hard work - adoption - user experience - the “so what” 🤷‍♂️

Positively 29% is high when considered in the context of “tipping point”

Company News

(NEC) Indicio Secures Investment from NEC X, Accelerating A New Era of User-Controlled Digital Identity

Cardano Summit Day Two Recap: Trust and Digital Identity to Drive Blockchain Towards Enterprise Adoption

Christoph Schneider of the Global Legal Entity Identifier Foundation explored the infrastructure requirements of building trust-minimized distributed systems in enterprise environments, outlining the importance of safe, secure, scalable and reliable infrastructure, stating businesses have “a lot to gain in this decentralized system.” The panel emphasized that trust minimized doesn’t mean less trust, but rather more verification. “Now is the time for corporates, and or banks to get ready for trade and payments in four or five years,” Blockdaemon’s Stefan Schmitt urged. “That will be verifiable proof on chain, authentication and distributed ledger payments.”

Andreessen Horowitz Urges US Treasury to Adopt Decentralized Digital ID for Crypto AML

In its submission to FinCEN, the Treasury’s Financial Crimes Enforcement Network, a16z proposed a fundamental shift away from the traditional model where every financial service provider must collect and report detailed personal identifiable information. This old model, the firm argues, creates massive, centralized honeypots of data (like names, addresses, and social security numbers) that are prime targets for hackers.

The firm’s proposed solution centers on Decentralized Identifiers (DIDs) and Verifiable Digital Credentials (VDCs). This user-centric model separates the act of identity verification from the act of identity use.

Protocols using Verifiable Credentials

Eclipse Decentralized Claims Protocol v1.012 November 2025

Dataspaces require the ability to communicate participant identities and credentials to secure data access. This specification defines a set of protocols for asserting participant identities, issuing verifiable credentials, and presenting verifiable credentials using a decentralized architecture for verification and trust.

Learning the Lingo of Identity

Entity Resolution: What is it and why is it important?

• How Does Entity Resolution Work?

• Entity Resolution and Customer Data Accuracy

• Challenges in Achieving Effective Entity Resolution

• Entity Resolution Use Cases: Real-World Applications Across Industries

• Entity Resolution Techniques: How Businesses Achieve Data Matching Accuracy

AgriTrust: a Federated Semantic Governance Framework for Trusted Agricultural Data Sharing

The “AgData Paradox”—where agricultural data remains siloed despite its recognized value due to lack of trust and interoperability—is addressed by AgriTrust, a federated semantic governance framework combining multi-stakeholder governance with a blockchain-agnostic ontology for true semantic interoperability. Case studies across Brazilian coffee, soy, and beef supply chains demonstrate that AgriTrust enables verifiable provenance, automates compliance, and creates new revenue streams, transforming data sharing from a trust dilemma into a governed, automated operation.

5 things Indicio is excited about at Phocuswright 2025

• Digital Travel Credentials (DTCs)

• AI and Verifiable Credentials for travel customer service

• Age assurance technology in travel

• Government DTC-2 type deployments

• Building for the European Union Digital Identity (EUDI)

Humanity Protocol Integrates Open Finance into Human ID

Humanity Protocol, an on-chain digital identity solution provider, today announced a new integration that brings together Mastercard’s open finance connectivity with Humanity Protocol’s identity verification platform Human ID.

DIF Steering Committee Election Results

• JC Ebersbach (identinet)

• Matt McKinney (ArcBlock, AIGNE)

• Eric Scouten (Adobe)

• Sam Curren (Indicio)

• Rouven Heck (Fidenexum)

• Markus Sabadello (DanubeTech)

AI and Identity

(MeeCo) The future of commerce isn’t just digital — it’s agentic.

Call for Participants: Peer Benchmarking of MCP Governance

In particular, we are looking for enterprises that currently have (or are quickly approaching) ~100+ MCP Servers.

The new vital AI fraud signal: ‘Customer Present’ vs. ‘Customer NOT Present’

Personal AI

A theme throughout all those writings is the need for all of us to be on top of our digital lives: how we record and archive it, how we manage it, and how we use it to better inform and interact with each other and with the organizations we engage. To my knowledge, nothing yet addresses that collection needs, and is ours and not just a service by some giant. If you think I have that wrong, tell me how.

Agentic Workflows Explained - an in-depth but simple guide for Product Teams

AI Agents Are the New Workload: What That Means for Security

(Alan Karp) We should be focusing less on agent identity and more on identifying the responsible party. What do you think?

(Alan Karp) AI Agent: Identity or Identifier?

(Alan Karp) AI Agent Identity is not What You Need

The Weaponisation of Openness? Toward a New Social Contract for Data in the AI Era

Agentic State Vision Paper

Upcoming

• Redefining Age Assurance November 19 9:30 AM - 12:10 PM ET Virtual

• SIDI Hub Pre-Conference Workshop @ TRUSTECH 2025 - Paris, France | Tuesday, 2 December 2025 | 14:00 – 18:00 CET

• Join us at the 1EdTech Digital Credentials Summit in Philadelphia, February 18-20, 2026.

• DID Unconference Africa (an IIW Regional Event) Feb 24-26, 2026 Cape Town

Hiring

Research Associate (PostDoc) Position in Computer Science on the Security and Privacy of Digital Identity Wallets

The candidate will be funded through an industry partnership with Luxembourg’s Ministry for Digitalisation, as well as other industry partnerships or public research projects. Carry out research in the field of digital identity wallets,

Engaging with Governments

Submission to UK Government Harnessing the potential of new digital forms of identification

Evidence Submission to The Home Affairs Select Committee House of Commons: “Written evidence submitted by The Age Verification Providers Association (HAR3318)

So, the first question for the Committee is why would the government now wish to invest millions of pounds and take several years to re-invent the wheel and create a parallel government-issued

alternative to the existing solution already implemented by the same government?

Physical ID, private sector alternatives pitched to save UK digital identity plan

(Tony Blair Institute) [Report] Time for Digital ID: A New Consensus for a State That Works

Public-opinion research commissioned by the Tony Blair Institute for Global Change (TBI), published for the first time in this paper, shows that digital ID enjoys majority support among the British public, with 62 per cent in favour and just 19 per cent opposed.

(Nat Sakamura) [Japan] Digital Agency: First Expert Meeting on Attribute Certification Issues

I participated in the First meeting of Digital Agency’s “Experts’ Committee on Attribute Certification Issues“ remotely as a committee member

Switzerland’s E-Challenges — And What the World Can Learn

As a global leader in direct democracy, Switzerland faces a unique test: how to scale secure, private, and verifiable E-Collecting, E-Voting, national E-ID, patient health records across 26 cantons — without eroding public trust and losing digital sovereignty.

DIACC AI Consultation Submission to the [Canadian] Federal Government

Canada has the opportunity not only to develop world-class AI capabilities, but also to build an ecosystem where AI innovation and responsible deployment are enabled by a strong foundation of digital trust, identity, authentication, and interoperability. DIACC’s mission is to accelerate the adoption of digital trust by enabling privacy-respecting, secure, interoperable digital trust and identity verification services through the DIACC Pan-Canadian Trust Framework (PCTF).

(UIDAI) [Video] Verify your users through Aadhaar Verifiable Credentials – in a privacy preserving manner

Making a case for a Digital Public Infrastructure (DPI) Act for America

America’s current digital landscape is a patchwork of systems across states, agencies and private companies and misses an interoperability layer. This means fragmented identity verification, uneven instant payment networks, and siloed data exchange rules and mechanisms. This fragmentation not only frustrates citizens but also costs taxpayers billions, leads to inefficiency and fraud.

European Digital Identity Framework as part of eIdAS - Timeline

Verifiable Credentials Help Address Fraud

(OIDF) [Blog Post] Verifiable credentials: a valuable tool in the fight against rising ID fraud?

[Report] Proposed mDL Metadata Framework to support KYC & CIP Compliance for the United States

[Report] Harmonized mDL Metadata for eKYC & CIP: Comparative Analysis and Implementation Guidance

Supply Chains

RBA Launches Interoperable Data Exchange for Supply Chain Transparency

Large-scale pilot of the Responsible Business Transparency Protocol is underway. The Responsible Business Alliance (RBA) today announced the live implementation of its Responsible Business Transparency Protocol (RBTP), a data exchange protocol built on the United Nations Transparency Protocol (UNTP) and World Wide Web Consortium (W3C) verifiable credentials.

Standards

VC Bitstring Status List Interoperability Report 1.0: Test Interoperability Report for Verifiable Credentials status 02 November 2025

VCALM v0.9: A Verifiable Credential API for Lifecycle Management

WorldCoin Watch Continues

Worldcoin’s Orb Scans Your Iris—But at What Cost?

Thoughtful

(David Birch) Cybersecurity Is A Digital Identity Problem And We Must Deal With It

I am skeptical about maximal SSI, because I think that most people (e.g., me) lack the persistent competence necessary to manage identities for themselves, but I think some form of custodial SSI where the identities are managed by regulated institutions on behalf of customers make a lot of sense.

(IdentityWeek, Mike Leahy) The fiduciary commons: restoring ordered liberty in the age of data

This Article proposes a corrective: the fiduciary commons, a legal and institutional architecture that recasts the relationship between individuals, institutions, and information as one of entrustment rather than ownership. Drawing from property theory, information law, fiduciary doctrine, and constitutional liberty jurisprudence, it argues that while databases may be proprietary, the underlying facts they contain exist within an unownable commons— a domain of truth that must remain free from enclosure.

Think Globally, Act Locally: HCF at the Intersection of Global Digital Governance and Local Implementation

The participation of the Human Colossus Foundation in both an international and Swiss events underlines the necessity of new globally accessible protocols for digital authenticity and integrity.

(SpruceID) Translating Privacy Law into Digital Architecture

Explore how statutory privacy protections become real through code and technical standards.

(Heather Flanagan) The Infrastructure We Forgot We Built

So let’s talk about that outage. On 19 October 2025, an AWS outage (of course it was the DNS) made the Internet wobble. Payments failed. Authentication broke. Delivery systems froze. For a few hours, the digital economy looked a lot less digital and a lot more fragile.

Agentic IA Identity

Inter-Agent Trust Models: A Comparative Study of Brief, Claim, Proof, Stake, Reputation and Constraint in Agentic Web Protocol Design—A2A, AP2, ERC-8004, and Beyond

This paper comparatively analyzes six trust models (Brief, Claim, Proof, Stake, Reputation, and Constraint) in emerging inter-agent protocols like Google’s A2A and Ethereum’s ERC-8004, examining how LLM-specific vulnerabilities such as prompt injection and hallucination expose weaknesses in purely reputational or claim-based approaches. The authors argue no single mechanism suffices and recommend hybrid “trustless-by-default” architectures that anchor high-impact actions in cryptographic proof and staked collateral, augmented by identity claims and reputation overlays for flexibility.

(Heather Flanagan) Roads, Robots, and Responsibility: Why Agentic AI Needs Identity Infrastructure

Identity in the age of agentic AI? Same deal. It’s infrastructure. And just like a good road system, it needs to be engineered with care, built on solid standards, and ready for traffic we can’t even imagine yet.

Making Sense of it All

[Report] Web of Trust Map: The Global Infrastructure of Decentralized Digital Identity

Decentralized identity technologies have been on the rise for the past decade, yet until recently there had never been a systematic effort to map all initiatives claiming to use the technology or aligning with self-sovereign identity principles. To address this, Key State Capital initiated the Web of Trust Map research in 2022, documenting government-affiliated decentralized identity projects, consortia, collaborators, and technologies. This report, based on projects announced up to July 2023, provides an overview of the ecosystem’s maturity, the dominant technologies, and the actors driving development.

[Podcast] Digital identity adoption: Global trends, challenges, and the path to trust

This month, we spoke with Ivette Cano, Chief Marketing Officer and Niza González, Head of Data at Key State Capital, an early-stage venture firm and ecosystem catalyst driving innovation in decentralized identity.

[Report] (UNICEF) The Role of the Unique Identifiers in Civil Registration and Vital Statistics and National Identification Systems

Unique identifiers, often in the form of a unique identification number (UIN), are critical in the management of administrative records…Unique identifiers also pose specific risks for people in vulnerable situations and groups at risk of marginalization, including those relating to data protection and privacy, exclusion through system design or technology limitations and failures, and unintended uses of linked data…In light of these benefits and risks, due consideration should be given to developing both robust identifiers and strong supporting systems.

UpComing

• EUDI: Key Takeaways from Europe’s Largest Digital ID Pilot November 12, 9am PST Virtual

• Redefining Age Assurance November 19 9:30 AM - 12:10 PM ET Virtual

• SIDI Hub Pre-Conference Workshop @ TRUSTECH 2025 - Paris, France | Tuesday, 2 December 2025 | 14:00 – 18:00 CET

• Join us at the 1EdTech Digital Credentials Summit in Philadelphia, February 18-20, 2026.

• DIF Unconference Africa (an IIW Regional Event) Feb 24-26, 2026 Cape Town

[Magazine Interview] Issue 2 The Voice of the Quarter - The Future of Identity: Kaliya Young (aka Identity Woman) on Decentralization, Ethics, and the Web3 Frontier 4 Page Interview

Open Wallet’s Many Projects

Open Wallet Foundation Chart of Wallets

DIACC

DIACC and SIROS Foundation Partner to Advance Global Leadership in Digital Trust and Interoperable Credentials

Through this collaboration, DIACC and SIROS will:

• Address challenges and opportunities related to international interoperability, digital trust and identity assurance policy, and trust in specific use cases.

• Align efforts to enhance the secure and trusted exchange of digital credentials across sectors and jurisdictions.

• Develop and showcase real-world use cases proving the effectiveness of interoperable digital trust and identity solutions.

• Collaborate to advance policy alignment and technical interoperability through pilot projects and testing around use cases, including: Travel, Education, Payments, Organizational/Business credentials, Labour mobility, Professional upskilling, and Academic integration

DIACC Congratulates Quebec on Historic Adoption of National Digital Identity Legislation

We proudly congratulate the Government of Quebec and the Assemblée nationale on the adoption of Bill 82, the Act respecting national digital identity and amending other provisions.

Public Services

Digital Doorways to Public Benefits: Beneficiary Experiences with Digital Identity

Led by the Digital Benefits Network in partnership with Public Policy Lab, the Digital Doorways research project amplifies the lived experiences of beneficiaries to provide new insights into people’s experiences with digital identity processes and technology in public benefits. This report details the project’s findings, directly highlighting the voices of beneficiaries through videos and photos.

Implementing Benefits Eligibility + Enrollment Systems: State Responses to H.R. 1

This report summarizes insights from interviews with seven states on how they are adapting integrated eligibility and enrollment (IEE) systems in response to sweeping federal changes to SNAP and Medicaid under H.R. 1.

(SpruceID) Digital Wallet Certification: The Foundation for Interoperable State Identity Systems

SpruceID believes that additional legislation should be enacted to establish a formal certification program for wallets, issuers, and potentially verifiers participating in a state digital identity ecosystem. The legislation should specify that the designated regulating entity may conduct audits and certify providers directly, or delegate certification responsibilities to qualified external organizations, provided such delegation is formally approved by the appropriate higher authority.

Telecom

GSMA, Telefónica Tech, TMT ID and Dock Labs collaborate to reinvent call centre authentication

End-to-end encrypted communication: Built on the DIDComm protocol, ensuring all exchanges between the call centre and the customer’s app remain tamper-proof and confidential.

Verifiable Credentials: Enable cryptographically signed proofs of identity (e.g. account ownership).

(send to Rebekah & Peirce)

The Future of Digital Identity: A Self-Sovereign Identity Technical Implementation Guide for the Telecom Provider

Latest on DPI

2025 State of Digital Public Infrastructure Report OCTOBER 2025 A Look at Measurement and Prevalence as DPI Transitions from Experiment to Scale

Ten Years of Impact : Putting People at the Center of Digital Transformation - Annual Report 2024-25 (English)

(WEF) [Report] Advancing Digital Trade: Insights from the UAE TradeTech Regulatory Sandbox

To that end, the report presents concrete, forward-looking policy recommendations: broader adoption of the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Transferable Records (MLETR), formal recognition of decentralized identity and verifiable credentials and the development of regulatory pathways for tokenized trade assets, digital bank guarantees and stablecoin-based settlement tools.

Thoughtful

Credentials not anchored in law - versus anchored

(Heather Flanagan) Can Standards Survive Trade Wars and Sovereignty Battles?

Series by Parthasarathi V

• Trust Infrastructures

• Thoughts on Identity = Trust!

• The emerging Wallets Economy

Evil Web & The Consent Trap

- How SSI and DIDs Can Fix Consent—and Fix Trust

Musings of a Trust Architect: The Exodus Protocol: Five Patterns for Creating Autonomous Infrastructures

ABSTRACT: Digital infrastructure is built on sand due to its control by centralized entities, most of which are focused on profit over service. We need Exodus Protocol services that build infrastructure without centralization, ensuring its continuation into the far future. Bitcoin offers our prime example to date. Five design patterns suggest how to create similar services for coordination, collaboraiton, and identity.

(Christopher Allen) [Video] Sad State of Decentralized Identity, and What To Do About It

Enabling a Sustainable Future through Self-Sovereign Identity

The Decentralization Utopia

Virtual Identities Department

The metaverse is rewriting the rules of who can be a K-pop star

The global market for virtual idols and streamers is projected to reach $4 billion by 2029,

AI & Identity

(Indicio ) Five reasons why AI needs decentralized identity

AI Agents and Payments

Deep Dive: What a16z’s “State of Crypto 2025” Really Says About Stablecoins and AI

A16z’s report calls out new protocol standards like “x402” (a riff on HTTP 402 Payment Required) emerging as the financial backbone for autonomous AI agents. These standards would let AI agents make micro-transactions, pay for API calls, and settle payments with no intermediaries

Productive Feedback to US Gov

OIDF offers standards roadmap for GENIUS Act

Executive Director of the OpenID Foundation, Gail Hodges, said: “This submission is part of our broader engagement with policymakers in the US and abroad on digital identity and financial innovation. The US is well placed to demonstrate how smart policies can leverage standards and conformance to deliver secure, interoperable identity infrastructure for a rapidly evolving financial sector.”

The full letter and supporting documents can be found here: Letter OIDF comment on TREAS-DO-2025-0070-0001.

OIDF submits comments on CFPB Data Rights Rule

Trust

(Cardano) We just published a new eBook on securing trust in the Internet of Things.

Architecting Trust In A Distrustful World: The Digital Leader’s Role

Centralized identity repositories have become prime targets for attackers. A shift toward decentralized identity models allows users to hold and selectively share verified credentials issued by trusted parties. This reduces the risk of mass breaches while strengthening user control over personal data. It also aligns with the growing expectation that digital identity should be as portable and user-owned as a physical wallet.

The Problem we are Solving

Verifiable Credentials, as a framework for fraud prevention, solve this problem easily.

Making Sense of it All

Gaia-X Glossary - glossary_25.05 Release

Education

Why Standards and Credentials Matter in Dual Enrollment

Credivera’s Journey: Deploying Verifiable Credentials in High-Risk Industries with DGSI/TS 115

Standards

Digital identity standards just got official! : Billions helped write them.

First Public Working Drafts: Confidence Method v1.0 and Verifiable Credential Rendering Methods v1.0

Verifiable Credential Rendering Methods v1.0

New Collaborations

Global vLEI Hackathon: How Affinidi and GLEIF Are Accelerating Privacy-Preserving Identity for the AI Era

Affinidi and GLEIF by GLEIF

GBG’s Digital ID solution is enabled through partnerships with leading industry providers including Trinsic and MATTR. To learn more about GBG’s Digital ID solution visit: https://www.gbg.com/en-us/verify-identity/digital-ids/

Daon: Daon Launches Industry-Leading Mobile Driver’s License Support, Powered by MATTR’s Verifiable Credential Infrastructure

Biometrics, verifiable credentials enable mDL support in Daon, Mattr partnership

Europe

Use swiyu, the Swiss E-ID to authenticate users with Duende and .NET Aspire

Press Release – CERT connects Vocational Education with Europe: verifiable credentials, digital identity and ESCO harmonisation

[Research] Digital citizenship: Challenges and uncertainty in applying blockchain

Colombia’s digital citizenship initiative faces limited adoption due to mistrust around data security and privacy, despite offering services like digital authentication, citizen folders, and signatures. This review suggests that blockchain-based Self-Sovereign Identity systems could rebuild trust by giving citizens greater control over their data, but only if implemented through permissioned designs with proper governance, interoperability standards, and regulatory alignment.

[Research] A Study on Privacy-Preserving Scholarship Evaluation Based on Decentralized Identity and Zero-Knowledge Proofs

[Research] Identity Model for Blockchain-Based Land Registry System: A Comparison

[Research] Towards a Universal Digital Identity: A Blockchain-Based Framework for Borderless Verification

Identity and AI

Indicio joins NVIDIA Inception Program to bring Verifiable Credentials to AI systems

Indicio has officially joined the NVIDIA Inception Program, a global initiative that supports startups advancing artificial intelligence and high-performance computing. Indicio will focus on applying decentralized identity and Verifiable Credential technology — in the form of Indicio ProvenAI — to AI systems.

ProvenAI enables AI agents and their users to authenticate each other using decentralized identifiers and Verifiable Credentials. This means an AI agent can cryptographically prove who it is interacting with and that entity can do the same — all before any data is shared.

Ledger Rebrands Hardware Wallets as ‘Signers,’ Launches ‘Proof of You’ to Combat AI Fraud

Ledger has rebranded its hardware wallets as “Signers” and introduced “Proof of You” and “Proof of Authority” to counter AI impersonation and verify digital intent. The move shifts Ledger’s focus from asset storage to identity and consent verification, positioning its devices as physical anchors of trust in a deepfake-prone digital ecosystem. The new Ledger Nano Gen5 includes a Secure Element chip and touchscreen, reflecting a hardware-based response to identity manipulation in crypto and digital asset environments.

Reclaiming Control Over Secrets: Correlating Credentials to NHIs for Safe and Automated Remediation

In fast-moving, cloud-native and AI environments, the number of Non-Human Identities (NHIs), like service accounts, workload identities, ephemeral compute roles, and automation agents, has exploded. These NHIs need credentials to authenticate, but credentials are inherently fragile. They’re created rapidly, passed across system boundaries, are long-lived, and stored in a wide array of locations.

UTAH

Utah officials, privacy advocates pitch State’s incoming digital ID to public

The new, optional State-Endorsed Digital Identity (SEDI) initiative was mandated with the passage of SB 260 earlier this year.

Bramwell says the new digital ID will not track users or log interactions, and emphasized the security advantages of a decentralized data storage model. The architecture will also avoid the need for Utah to reissue all its residents’ digital IDs if State IT systems are breached.

OIDF submits comments on Utah’s state-endorsed digital identity RFI

The OpenID Foundation has submitted its comments on Utah’s Request for Information (RFI #AE26-1) regarding the State-Endorsed Digital Identity (SEDI) program. This submission reflects the OpenID Foundation’s ongoing commitment to supporting governments worldwide as they develop digital identity frameworks that prioritize security, privacy, and interoperability.

A Practical Checklist to Future-Proof Your State’s Digital Infrastructure

This actionable checklist provides clear criteria for state IT leaders, procurement officers, and policymakers to evaluate any new digital identity technology or system. Use this framework to ensure technology investments are resilient, secure, and future-proof.

Standards Organizations

OpenID Connect Core 1.0 now published as ITU standard

We’re pleased to announce that Recommendation X.1285, incorporating the OpenID Connect Core 1.0 - errata set 2 specification, has been officially published by the International Telecommunication Union.

FCT’s Client ID Verification Achieves DIACC PCTF Certification: Enhancing Digital Trust for Legal Professionals

Toronto, October 23, 2025 – We are thrilled to announce that FCT Client ID Verification has been certified against the Pan-Canadian Trust Framework ™(PCTF) Verified Person Component at LOA2. Established in 2012, DIACC is Canada’s largest multistakeholder organization, exclusively addressing digital trust and identity verification, fostering confidence and consistency in the market through its internationally recognized framework and standardized third-party conformity assessment program.

Steering Committee Election 2025: Candidate Statements

• Sam Curren (Indicio, US)

• Jan-Christoph Ebersbach (Identinet, Germany)

• Rouven Heck (Independent, US)

• Matthew McKinney (ArcBlock, US)

• Doug Rice (Hospitality Technology Network, US)

• Markus Sabadello (DanubeTech, Austria)

• Eric Scouten (Adobe, US)

[DIACC] Leading the Way: Client IDV Success in Canada’s Legal Sector

Canada’s legal sector has achieved over 700,000 client identity verification (client IDV) transactions in a single year (October 1, 2023 – September 30, 2024), proving that secure, convenient digital client IDV can operate at scale in highly regulated environments.

DIACC member organizations are leading this transformation in a $50-70M legal-sector verification market that points to an economic opportunity of $500M to $1B spanning financial services, healthcare, telecommunications, and government.

Digital Identity & Verifiable Credentials : From declarative trust to verifiable trust

The generalisation of digital identity no longer falls under the concept. It is now a well-established global trend. According to Gartner, more than 500 million people should use a digital identity wallet by 2026. In Europe, the Commission aims for effective access for 80% of citizens before 2030. The global market of digital identity, estimated at 30.8 billion dollars in 2023, will reach more than 100 billion in 2030, that is an average annual growth of nearly 18% according to Fortune Business Insights.

Company Updates

FrankieOne and MATTR unite to strengthen digital identity assurance with verifiable, government-issued credentials

The collaboration embeds MATTR’s digital trust technology into FrankieOne’s identity orchestration platform, enabling organisations to verify customers with greater assurance and privacy. Through this integration, enterprises can accept emerging credentials such as mobile Driver’s Licences (mDLs). These digital credentials, which conform to ISO 18013-5 and -7 standards, provide high-assurance, privacy-preserving verification that enhances customer experience while working seamlessly alongside existing data sources and risk signals.

Release Announcement: Inji Certify - 0.12.2 is here!

We’re pleased to announce the release of Inji Certify v0.12.2!

This update focuses on enabling issuers with greater control and flexibility in managing their credential signing infrastructure, while enhancing overall usability and operational stability. With this release, Certify introduces key APIs to streamline integration with external Certificate Authorities (CAs) — empowering issuers to securely manage the full certificate lifecycle and extend their credential issuance capacity.

(Techademics, Learner Studio) [Report] The Future Tech Stack: Reimagining Requirements for Learner-Centered Futures

At the core of the requirements are key integrated components—each designed to work together while remaining flexible, standards-based, and adaptable to local context. All of these components are powered by Agentic AI and strengthened through human connection.

The Learner Wallet is a secure, portable, and learner-owned application for managing and selectively sharing verified achievements, credentials, skills, and experiences. It acts as a dynamic record hub, enabling individuals to validate and share credentials across settings while maintaining ultimate control over their data. Built on standards such as W3C Verifiable Credentials and 1EdTech Open Badges 3.0, the wallet ensures portability and interoperability across diverse platforms

(SpruceID) The Technology Powering Digital Identity: The Future of Digital Identity in America - Post 3

Every successful infrastructure layer in technology—whether it was TCP/IP for the internet or HTTPS for secure web traffic—has been built on standards. Decentralized identity is no different. Standards ensure that issuers, holders, and verifiers can interact without building one-off integrations or relying on proprietary systems.

Comprehensive Overviews

EU Identity Wallet communities

eIDAS is an ecosystem play with network effects: The value of the network increases with every new participant. Here’s an overview of the most important communities.

Digital identity in Latin America: progress, challenges and outlook for 2025

The regulatory framework In Latin America is still under development. Some countries have made progress in digitalizing their identity documents, while others are in preliminary exploration or institutional design phases. The lack of harmonized regional regulation complicates the creation of cross-border digital ecosystems, although efforts toward convergence inspired by the European model are evident.

Citizen perception of new forms of digital identity is divided. Let us focus on countries where solutions are already available to the population.

KeyPear: Unlocking the Digital Economy in Hong Kong with iAM Smart and CorpID Integration

At its core, KeyPear is a did:webvh wallet, built on the principles of Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs). This architecture is the key to its power.

KeyPear’s strategic integrations with iAM Smart and CorpID, combined with its role as a secure gateway to the stablecoin economy, position it as a defining piece of infrastructure for Hong Kong’s next chapter.

SEDI Summit Home Page

The State of Utah invites you to attend the State-endorsed Digital Identity (SEDI) Summit—a national gathering for states to lead the way in rethinking how identity works in the digital age.

As digital transactions become foundational to modern life, trust in identity systems must be earned, not assumed. The time has come for a model where states uphold their constitutional role, and individuals regain control over their identity.

AI and Identity

What Happens When an AI Agent Goes Rogue?

That could mean extending today’s digital identity frameworks, such as device fingerprinting, behavioral biometrics or cryptographic signatures, to include AI agents. In practice, each approved agent might carry a verifiable credential issued by the customer’s bank or identity provider, ensuring that every transaction or request can be cryptographically linked back to a legitimate owner.

LF Decentralized Trust: Identity Projects

Hylerledger AnonCredds

Credebl

Hylerledger Identus

Hylerledger Indy

Trust over IP

5 Reasons We Must Shift to Human-Centric Data Design

Here are five reasons the future needs to be human-centric design and how ArcBlock’s decentralized identity can delivery it:

1. Less Data, Less Risk

2. Put People Back in Control

3. Trust Isn’t a Feature—It’s an Advantage

4. Break the Surveillance Economy

5. From Data Hoarding to Data Dialogue

TABConf 7: October 2025: Beyond Bitcoin & The Sad State of Decentralized Identity

Christopher Allen was invited to support a new decentralized identity track at TABConf 7 and made two presentations, one on “Beyond Bitcoin: Engineering Exodus Protocols for Coordination & Identity” and one on the “Sad State of Decentralized Identity (and What To Do About It)”.

Open Badges Specification: Final Release Spec Version 3.0

This specification is a new version of the 1EdTech Open Badges Specification that aligns with the conventions of the Verifiable Credentials Data Model v2.0 for the use cases of Defined Achievement Claim and a Skill Claim. The credentials that are produced are easily be bundled into Comprehensive Learner Records and Verifiable Presentations. Portability and learner data privacy are improved by expanding the usage of cryptographic proofs/signatures, because this format will be compatible with a growing array of proof schemas that are developed for the Verifiable Credentials Data Model.

(Okta:Tim Cappalli) [explainer] A technical overview of the verifiable digital credentials ecosystem

- You can think of VDCs as an evolved form of federation.

- An issuer (similar to an IdP in federation) asserts claims about you.

- You, the holder, present those claims to a verifier (similar to a service provider in federation).

- The verifier checks validity using one or more trust lists.

Intesi Group contributes to the first European trial of the EU Digital Identity Wallet in tourism

Intesi Group, a leading Italian Qualified Trust Service Provider (QTSP), proudly announces the release of PhotoID as Electronic Attestation of Attributes (EAA) according to eIDAS regulation, developed as part of the first European pilot of the EU Digital Identity Wallet in the tourism sector.

[Research] Mapping the metaverse minefield: A TIPS framework for security-conscious business adoption

This study examines metaverse adoption by organizations (particularly M/SMEs) through the Trust, Identity, Privacy, and Security (TIPS) framework, using qualitative NLP analysis of interviews with business and IT professionals to understand the interdependencies between these security dimensions. The research reveals a hierarchical dependency structure where trust is influenced by user embodiment, avatar-based identities complicate verification and privacy protection, and privacy demands transparency frameworks—ultimately recommending that organizations adopt security-by-design principles balanced with user experience considerations for successful metaverse implementation.

The Digital Identity Paradox: Reconciling Privacy and Security in the Age of Self-Sovereign Identity (SSI)

The journey to Self-Sovereign Identity is a marathon, not a sprint. The current identity model, with its endless cycle of data breaches and eroded trust, is unsustainable. SSI offers a viable path forward, one that flips the script by making the user the sovereign owner of their digital self. It resolves the Digital Identity Paradox by designing a system where robust security and individual privacy are not competing interests but mutually reinforcing goals.

[Reserch] BcFCKA:Blockchain-based Fair and continuous key agreement for DIDComm in Self-Sovereign Identity

Self-Sovereign Identity (SSI) systems face security challenges in their DIDComm communication framework, including lack of perfect forward secrecy and poor message loss resilience. The authors propose BcFCKA, a blockchain-based key agreement protocol that enables continuous, fair session key updates without centralized trust, achieving strong security properties while maintaining practical performance with millisecond-level execution times.

Brave: Building the Private User-Friendly Internet - Guest Kyle Den Hartog

In this episode, Friederike is joined by Kyle Den Hartog, security engineer at Brave, to explore the browser’s role in a user-first web. From his roots in penetration testing and verifiable credentials, Kyle arrived at web3 via self-sovereign identity, viewing it as empowering despite imperfections.

SPRN-D Highlights of the the Funke “EUDI Wallet Prototypes” conference this week at Radialsystem Berlin. :

- The presentation is now available on OpenCoDE.

- We uploaded the recordings on our website and we will provide them on OpenCoDE within the upcoming week as well.

- You can also find the pictures from the event here – please credit SPRIND and the photographer Felix Adler (© SPRIND / Felix Adler) when using them. The images may be used for internal communication and your own social media channels. For any other use, please follow the copyright information provided by the photographer.

Musings of a Trust Architect: Five Anchors to Preserve Autonomy & Sovereignty: Solutions for Swiss e-ID and Other Digital Identity Systems

ABSTRACT: How do you protect autonomy and democratic sovereignty in digital identity systems? This article suggests five foundations: protecting choice by design; building for an extended future; maintaining platform independence; requiring duties; and implementing institutional safeguards.

Gathering the MyTerms Troops

Here is some of what’s going on around MyTerms. The draft is complete and on track for publication early next year. But work can start in the meantime.

Reimagining Canada Post: From Delivering Mail to Delivering Trust

Consider what Canada Post actually represents: a trusted institution with physical presence in virtually every Canadian community, deep expertise in verification and logistics, existing relationships spanning individuals and businesses, public accountability, and a mandate to serve all Canadians regardless of commercial viability.

These aren’t assets to be wound down. They are the foundations for building Canada’s digital trust infrastructure.

DIACC Unviels Digital Trust Adoption Dashboard: Transparency for a Connected Canada

This public resource maps the evolution of digital trust programs across Canada’s provinces and territories. By combining data from government sources with an interactive, map-based interface, the dashboard reveals the current state of digital verification and authentication services, trust program adoption, interoperability, and maturity across the country.

A Milestone in Enhancing Digital Trust for Lawyers: Digitally Verifying Client ID

The PCTF Legal Professionals Profile establishes Conformance Criteria for how lawyers and their agents expect services to conduct client identity verification (IDV) in a manner that is auditable and consistent.

OIDF applauds new FIDO and Shared Signals whitepaper

The OpenID Foundation welcomes the publication of a new whitepaper from the FIDO Alliance that examines how FIDO authentication and the Shared Signals Framework (SSF) work together to address enterprise security challenges.

[Video] (Grant.io) EUDI Wallet & OpenID4VP | Digital Credential Query Language Scenario #1: Basic Credential Query

Explore how EUDI Wallets use OpenID4VP and the Digital Credential Query Language (DCQL) to enable secure, trusted credential sharing in the EU Digital Identity ecosystem. In this first scenario — Basic Credential Query with Trusted Authority — you’ll see how a relying party requests a verified credential (e.g., a university degree) from a wallet holder, ensuring it is issued by a recognised and trusted EU authority (present in the Trust List).

Upcoming

• Registration Open for OpenID Foundation Hybrid Workshop at Cisco on Mon 20th October 2025

• Internet Identity Workshop #41 October 21-23 Mountain View California

• How Do We Build Trust in Agentic Commerce? Demo Day October 22

• W3C CCG APAC Friendly Time 22nd of October: A microcredential ecosystem

• Agentic Internet Workshop* October 24th Mountain View California (*Inspired IIW by and hosted by the IIW Foundation

Deloitte Dept:

[Wall St Journal sponsored by Deloitte] Rethinking Identity Security: The Rise of Wallet-Based Credentials

A self-sovereign approach to identity security can transform business risk and customer trust, helping organizations shed related liabilities and strengthen cyber protections

When Deloitte Validates Your Vision: Billions’ Tech Stack Named in $4 Trillion Market Report

Billions’ tech stack and Privado ID is now part of the institutional playbook for tokenized finance.

And according to Deloitte’s latest report on semi-liquid funds - a $4 trillion market opportunity- they’re choosing our tech stack: Privado ID.

Worldcoin’s less ‘dystopian,’ more cypherpunk rival: Billions Network

We make it easy for you to prove who you are things like the fact youre a person, a unique human, not a bot, over a certain age, things like your KYC status, from the comfort of your own device, McCullen says. The system uses the updated Decentralized Identifiers (DIDs) open standard from the World Wide Web Consortium “the good people who brought us the internet.

AI and Identity

(Video Instagram) Michael Casey has introduced a new organization dedicated to advancing decentralized AI

The initiative aims to build AI systems that are open, secure, and human-aligned—bridging Web3 innovation with enterprise adoption to enable privacy-preserving data ownership and collaboration across industries. The mission: to help shape the foundation of a more decentralized, AI-driven global economy.

New whitepaper tackles AI agent identity challenges

The rapid rise of AI agents presents urgent challenges in authentication, authorization, and identity management. Current agent-centric protocols (like MCP) highlight the demand for clarified best practices in authentication and authorization. Looking ahead, ambitions for highly autonomous agents raise complex long-term questions regarding scalable access control, agent-centric identities, AI workload differentiation, and delegated authority. This whitepaper is for stakeholders at the intersection of AI agents and access management. It outlines the resources already available for securing today’s agents and presents a strategic agenda to address the foundational authentication, authorization, and identity problems pivotal for tomorrow’s widespread autonomous systems.

Auth0 Token Vault: Secure Token Exchange for AI Agents

Building Trust in Agentic Commerce

If agentic AI is going to matter in e-commerce, we need guardrails that make it safe, compliant, and worth the operational risk. That is where authentication, authorization, and verification come in. Think identity, boundaries, and proof. Until teams can check those boxes with confidence, adoption will stall.

🔐 Why Policy Design Matter for Autonomous Agents

That’s why recent papers like : “Policy Design in Zero-Trust Distributed Networks: Challenges and Solutions” https://lnkd.in/g9N-f-Di are important, as it describes the impact of policy design for AI Agents. Policy languages like CEDAR, OpenFGA, and OPA are important considerations we need to be thinking about.

Cartography of Generative AI <-amazing map

Agents building agents.

The 𝐌𝐂𝐏 𝐀𝐮𝐭𝐡𝐨𝐫𝐢𝐳𝐚𝐭𝐢𝐨𝐧 𝐬𝐩𝐞𝐜 𝐢𝐬 𝐚 𝐧𝐨𝐧-𝐬𝐭𝐚𝐫𝐭𝐞𝐫 for enterprises.

🔹 Challenges from the current MCP Authorization spec

🔹 Alternative enhancements from folks like Aaron Parecki and Dick Hardt

🔹 Our recommendations for securing MCP in the enterprise

Blockchain

Bhutan adopts Ethereum blockchain for the national identity.

Bhutan becomes first nation to anchor digital ID on Ethereum

Bhutan has migrated its national digital identity system to the Ethereum blockchain, marking a historic step toward decentralized public infrastructure.

IOTA to Secure Digital Identity Framework Connecting 36 Countries and 4.78 Billion Citizens

- IOTA could become the backbone for digital identity verification for over half the world’s population, while Europe’s serves around 450 million people.

- IOTA has spent years building a feeless, energy-efficient distributed ledger purpose-built for machine-to-machine and identity use cases.

Theory meets practice: How can blockchain technology help to scale customer-centric financial services today?

Gravity provides verifiable digital identity wallets that allow users to issue and share Verifiable Credentials securely. Gravity currently operates in Kenya.

Is it customer centric? The service can be used either with or without a smartphone. With a smartphone, beneficiaries create their digital wallet through the Gravity app. Later, when the NGO or financial institution needs to authenticate the beneficiary’s information, the beneficiary can remotely authenticate themselves by responding to a notification through the same app. Without a smartphone, the NGO, or any other trusted organisation wishing to onboard their users using a digital ID, creates the digital wallet on the beneficiary’s behalf. The beneficiary is then issued a QR code, which a service provider can scan at a later date when the identity needs to be authenticated.

National Opportunities

[Video] (Kenya) Stakeholders Workshop for Verifiable Credentials

The Government of Kenya is establishing effective mechanisms of replacing issuance of paper degrees with a Digital Verifiable Credential, which can be securely authenticated using a digital system.

OpenID Foundation Applauds Western Balkans Digital ID Plan

A key accomplishment of the event was the 6 Western Balkan countries agreeing to the Joint Statement on Achieving Western Balkans Six Interoperable Digital ID Wallets and Trust Services. “By agreeing to implement regionally interoperable digital identity wallets, harmonise trust services, and strengthen regulatory and technical capacities, the Western Balkans Six committed to advancing secure and seamless digital access for citizens and businesses, in line with EU eIDAS 2.0 standards.”

Digital Product Passports Towards More Sustainable Futures

In our presentation, we also introduced the Promoting Accelerated Circular Economy through Digital Product Passports (PACE-DPP) project as an applied case study to explore the potential for DPPs.

A Digital Product Passport is a product-specific dataset accessible via a digital carrier. It enables businesses, regulators, and consumers to access key information—such as material composition, environmental impact, production history, and recyclability.

What We Learned Showing Digital IDs for Local Government

Richard Esplin (Head of Product) put together a live demo.

Instead of complex architectures or long timelines, he showed how a city could issue a digital residency credential and use it instantly across departments. From getting a library card to scheduling trash pickup.

Why Digital Identity Frameworks Should Be Public Infrastructure

Digital identity is essential infrastructure, and it deserves the same level of public investment, oversight, and trust as other core systems like roads or utilities.

Interesting

(Indicio) Your authentication dilemma: DIY or off-the-shelf decentralized identity?

There’s a reason Indicio was the first (and still the only) company to launch a complete, off-the-shelf solution for implementing Verifiable Credentials in both the Amazon and Google Cloud Marketplaces: We built a team composed of pioneers and leaders in decentralized identity, engineers and developers deeply engaged with the open source codebases and communities that have shaped this technology. They live and breathe this stuff every day. And even so, it still took years to build an interoperable, multi-credential, multi-protocol, system that can scale to country-level deployments.

(Dock) Why Derived Credentials Are the Future of Digital ID

In our recent live podcast, Richard Esplin (Dock Labs) spoke with Andrew Hughes (VP of Global Standards, FaceTec) and Ryan Williams (Program Manager of Digital Credentialing, AAMVA) about the rollout of mobile driver’s licenses (mDLs) and what comes next.

One idea stood out: derived credentials.

Thoughtful

(Nicky Hickman via Cheqd) Verifiable AI with Self-Sovereign Identity: a Socio-Technical Exploration

As part of the research, two practical outputs were created.

1. Entangled Relationship Guide: considers AI in relation to wider systems including the environment, ecology and non-human stakeholders, drawing on perspectives from indigenous knowledge and socio-environmental research.

2. Human-Centric Relationship Guide: focused on designing AI systems that interact directly with people, addressing themes such as authenticity, authorisation and trust.

(Heather Flanagan) The End of the Global Internet

- Technical fragmentation: differences in protocols, infrastructure, censorship, filtering; sometimes entire national “gateways” or shutdowns.

- Regulatory / governmental fragmentation: national laws around data flows, privacy, platform regulation, online safety, and content moderation diverge sharply.

- Commercial fragmentation: companies facing divergent rules in different markets (privacy, liability, content) so they adapt differently; global products become “local versions.”

A primer from the United Nations Institute for Disarmament Research (UNIDIR) published in 2023 lays this out in detail.

Demystifying JOSE, the JWT Family: JWS, JWE, JWA, and JWK Explained

If you’ve worked with modern authentication or secure data exchange, you’ve undoubtedly encountered JSON Web Tokens, or JWTs. However, if you dig deeper, you may encounter a series of confusing acronyms: JWS, JWE, JWK, JWA, and the umbrella term, JOSE. What do they all mean? How do they relate to each other?

Foundations of Decentralized Identity

Decentralized identity operationalizes these ideas for the digital era. By distributing trust, it reduces dependency on monopolistic platforms. By lowering the cost of verification, it unlocks new forms of commerce. By centering autonomy, it ensures liberty is preserved even as interactions move online.

Wallets and Identity and Money

From Wallets To Passports To Monetization: Your Identity Reimagined

The building blocks are falling into place: regulatory clarity in Europe, purpose-built blockchains like Moca Chain, and applications such as Vyvo that show how identity can be applied across industries. The challenge ahead is making these systems interoperable, user-friendly, and economically compelling.

If wallets truly become passports, and if identity verifications can become income-generating events, then digital identity could shift from being a bureaucratic necessity to a financial opportunity. For users, that means more control, more privacy, and perhaps even more upside from something as simple as proving who they are.

The EU Is Building a Digital Wallet That Ignores Crypto

The omission of stablecoins is disappointing given the parallel rollout of MiCA (Markets in Crypto-Assets), the EU’s landmark stablecoin legislation. MiCA introduces strong reserve requirements, audit obligations, and licensing for issuers of tokens. It is one of the most comprehensive regulatory frameworks for crypto assets on the planet, and it creates a clear legal pathway for compliant stablecoins. Yet, the EU has chosen not to prioritize them in its plans here.

Company News

SSI startup TransCrypts raises $15M to expand digital identity, credential verification platform

With the new funding, TransCrypts plans to scale its team significantly, focusing on its newly established co-headquarters in downtown Toronto alongside its San Francisco base. The company aims to further develop its credential ecosystem and meet growing demand for trusted, user-controlled identity solutions in an increasingly digitized world.

Research

Self sovereign identity in e-governance: blockchain solutions for fintech compliance and citizen-centric financial services