Proposal for a Decentralized Agent Identity Infrastructure

based on ERC-8004, iden3/Privado ID and Attestation Registries

Source: Steven Zhao, Independent Researcher (SynomosAI / LGD framework)
Contact: zhaoxinghua06@126.com
Meeting: 1st FG-TIDA Meeting, Paris, 30 November – 1 December 2026
Document type: Input document

1. Summary

Agentic AI systems act autonomously across services, infrastructures and organizational boundaries. Before any question of trust can be answered, a foundational question must be settled: who is the agent, and whom does it act for?

This contribution proposes a practical, standards-aligned decentralized identity infrastructure for agents, built on:

• W3C Decentralized Identifiers (DIDs) with secp256k1 key material;
• ERC-8004 — a machine-readable linkage standard binding an agent identity to a human principal (ownership and attestation semantics);
• iden3 / Privado ID self-sovereign identity primitives (challenge-response authentication proofs, JWS attestations);
• Attestation Registries — append-only, publicly verifiable records of agent ownership attestations.

The proposal is fully implemented and released as an open, runnable toolkit (verified-agent-identity), which makes it directly usable as input to the Focus Group's terminology, requirements and reference-architecture work items.

2. Problem Statement

Current digital-identity practice covers human users and static machine instances. Autonomous agents introduce three gaps:

1. No machine-readable principal: an agent acts for someone, but today there is no interoperable way to encode "who the agent is" and "who it acts for" in a standard, resolvable record.
2. No standardized human–agent linkage: ownership of an agent is asserted informally (e.g., a configuration file), without cryptographic binding to a human identity.
3. No verifiable proof surface: consumers of an agent (other agents, services, auditors) cannot cryptographically verify an agent's identity claim or its delegated authority.

3. Proposal

3.1 Identity layer — W3C DID

Each agent holds a DID derived from a dedicated secp256k1 key pair (never a wallet key holding assets). The DID document is resolvable through standard DID resolution (resolver.privado.id), giving a universal identifier that any party can dereference.

3.2 Linkage layer — ERC-8004

Human–agent linkage is expressed as a signed challenge: the human principal signs a challenge naming the agent, producing a linkage attestation that is recorded in an Attestation Registry. This yields:

• explicit, auditable ownership;
• a revocation and rotation path;
• a machine-readable principal for legal and accountability purposes.

3.3 Authentication layer — challenge-response and JWS attestation

Proof of identity ownership is generated via iden3 challenge-response: a verifier issues a nonce, the agent signs it, and the signature is verified cryptographically. Where required, the agent emits a JWS attestation containing only publicly verifiable information, and only with explicit user consent.

3.4 Security and privacy posture

• Key material encrypted at rest (AES-256-GCM), isolated outside agent workspaces;
• dedicated identity keys only — no reuse of asset-bearing wallet keys;
• attestations contain publicly verifiable information only; no exfiltration by design (whitelisted endpoints: DID resolver and the issuing network);
• explicit human consent required before any attestation is shared with third parties.

4. Mapping to FG-TIDA Work Items

5. Implementation Evidence

The proposal is not theoretical — it is shipped as an open toolkit (verified-agent-identity, available on public skill registries), with:

• identity creation and management scripts (createNewEthereumIdentity, getIdentities, getDidDocument);
• human–agent linking (linkHumanToAgent, manualLinkHumanToAgent);
• proof generation and verification (generateChallenge, signChallenge, verifySignature);
• minimal audited dependency surface (@0xpolygonid/js-sdk, @iden3/js-iden3-core, @iden3/js-iden3-auth, ethers).

5.1 Independent evaluation (third-party, outsider perspective)

The toolkit was independently evaluated by an external professional evaluation unit (fresh isolated environment, public documentation only), with the following results:

• 21/21 matrix tests passed across five batches: repeatability (3 full identity→link→challenge→sign→verify cycles), parameter variants (numeric/string challenges, non-existent DID), KMS-encrypted key storage (provider=encrypted, AES-256-GCM), exception paths (clear, non-hanging errors), and network-isolated verification (offline verify succeeds without hanging);
• One S1 defect was found and fixed: a strict type comparison in the challenge verifier (numeric vs string) that would otherwise make verification fail deterministically; the fix is normalized string comparison, and re-testing passes 21/21;
• AI-pluggability demonstrated end-to-end: the skill's invocation protocol (when-to-use / usage / flow sections) was added and verified by an autonomous AI agent acting on a machine-readable fix instruction, without human intervention — evidence that the toolkit is consumable by AI agents in an automated remediation loop;
• The evaluation report (test matrix, defect list, reproduction commands, requirements traceability matrix) is available on request for the Focus Group's security-criteria and benchmarking work item.

This enables the Focus Group to test, benchmark and refine the approach against independently verified, reproducible implementations rather than paper proposals.

6. Proposed Action for FG-TIDA

1. Adopt this contribution as input to the terminology and requirements work item.
2. Consider the DID + ERC-8004 + Attestation Registry stack as a candidate reference architecture for agent identity.
3. Invite interop testing against the reference implementation during the Focus Group's 2026-2027 meetings.
4. Align with parallel initiatives (W3C DID/VC, the ERC-8004 community, iden3/Privado ID) to avoid fragmentation.

7. References

• ERC-8004 — agent-to-human identity linkage standard.
• W3C Decentralized Identifiers (DIDs) specification.
• iden3 / Privado ID self-sovereign identity protocol.
• Billions Network — decentralized identity infrastructure.
• ITU-T FG-TIDA Terms of Reference (TD295/P, SG17).