Most identity systems were designed for one assumption: the entity in front of you is a person. That assumption is now incomplete.
This week, the Internet Identity Workshop closed in Mountain View with a question that did not exist five years ago: what does it mean to verify an agent? When an AI assistant books your flight, files your tax return through a tax authority’s portal, or transfers funds on your behalf, the institution on the other side has no cryptographic way to know whether the agent is actually authorized to act for you — or whether anyone gave it permission at all.
That gap is now the most consequential missing layer in digital identity infrastructure. And it is solvable with the same primitives that already work for citizens: a wallet, a verifiable credential, and a verifier that does not need the issuer in the room.
What a “Know Your Agent” wallet actually does
The same architecture that issues a citizen a verifiable credential — issuer signs, holder stores, verifier checks the signature locally — extends naturally to non-human subjects. The W3C Verifiable Credentials and Decentralized Identifier specifications were designed without assuming the holder is a person.
A Know Your Agent credential answers four questions cryptographically:
Who is the principal? The human (or institution) who delegated authority. Their DID is the root of trust.
Who is the agent? The AI, identified by its own DID — versioned, model-fingerprinted, runtime-attested where possible.
What scope was granted? A specific, narrow authorization: book flights under $2,000, read calendar but not write, file forms with the Ministerio de Salud only.
For how long? A time-bound expiry. Revocable instantly by the principal.
The agent presents the credential like a digital driver’s license. The verifier checks the signature locally — no API calls, no phone-home, no blind trust. The cryptography travels with the credential.
A concrete walkthrough
A citizen — let’s call her María — wants an AI assistant to handle her tax filing. The flow:
Issuance. María opens her SovraWallet and authorizes an agent credential for her tax assistant. She specifies scope: file form 720 with X Entiyu, read fiscal documents only, no fund transfers, expires in 30 days. The credential is signed by María’s key (she is the issuer of her own delegation), stored on the agent’s runtime, and her wallet keeps the revocation handle.
Action. The AI assistant connects to the Entity. Entity’s verifier — running the same SovraID verification logic as any other institutional verifier — receives the credential. It checks: signature valid against María’s public DID; scope matches the requested action; not expired; not revoked. The check happens locally. The decision is sub-second.
Audit. Every action the agent takes is logged with a cryptographic reference back to María’s signed authorization. If anything goes wrong, the audit trail is not reconstructed from server logs — it is derived from the credential itself, immutable and signed.
Revocation. María opens SovraWallet, taps revoke. The next verification fails everywhere immediately. No call to a central authority. No coordination across vendors. The credential is simply no longer valid, and the cryptography enforces it. The same selective disclosure primitives that let a citizen reveal only their age at a bar let María’s agent reveal only the scope it needs.
Why put it in the wallet?
Because the agent’s authority is an extension of the human’s identity, not a separate system. Delegation lives in the same place as the root identity. This gives clean selective disclosure, instant revocation, and zero new infrastructure for institutions that already use the verifier.
This is the architectural payoff of having built citizen identity as infrastructure rather than as a product: when a new subject category appears — agents, organizations, devices — the rails do not need to be replaced. Our positioning on privacy — that self-custody is a design constraint, not a feature — is what makes this extension possible.
If you are building or buying systems where AI agents act on behalf of humans — and you have not yet figured out how to verify those agents cryptographically — we would like to hear what you are running into. We are publishing a longer technical brief on agent credentials next month and your real-world constraints will shape it.
The Identity Brief is written by the team at Sovra. We build verifiable digital identity infrastructure for governments and institutions. Our wallet, issuer, and verifier are open-source and W3C-standard.