Internet of Trust
Affinidi · The Verifiable Trust Stack · September 2026
Building the
Internet of Trust.
Verifiable identity and trust — owned by the person, provable by machines. The foundation for a web where you can prove who is real and every AI agent can prove who it works for.
An overview for builders, partners and policymakers · Start high-level, get specific later
Part One
Why trust broke.
The internet never had a real trust layer — impersonation, data breaches and stolen identities are decades old. AI didn't start the fire; it poured petrol on it.
The internet never answered two questions. AI made ignoring them impossible.
Question one
"Are you a real person?"
Fake accounts, catfishing and stolen identities are as old as the web. Generative AI just made them free, instant and flawless — the signals we used to trust are now cheap to counterfeit.
Question two
"Who does this AI work for?"
Agents are starting to act on our behalf — booking, buying, negotiating, signing. The moment they do, the only question that matters is whose interest they serve.
The insightBoth questions are really one question: trust. And trust has quietly become the scarcest resource on the internet.
The bots arrived before the trust layer did.
For thirty years we bolted identity on as an afterthought — usernames, passwords, "log in with." It held together only because faking a human at scale was hard.
That assumption is gone.
Scarce fakes
Impersonation was expensive and manual. A profile with history read as real.
Infinite fakes
Deepfakes, synthetic identities and agentic bots are free and instant.
Humans clicked
Every action on the web had a person behind it, one at a time.
Agents act
Software takes actions autonomously, thousands per second, on our behalf.
Look around the cornerThe next web isn't human-vs-bot. It's a mixed economy of people, their agents, and the organizations they act for — all needing to prove what they are, and to let their agents work together without merging systems.
This isn't hypothetical. It's the 2026 headlines.
Ungoverned, unverifiable agents are already causing real damage — exactly the failure modes a trust layer is built to prevent.
135,000 AI agents left exposed
The year's first AI-agent security crisis: 135k instances open to the internet across 82 countries, 63% with no authentication; a poisoned skills marketplace, and a sister breach leaking 1.5 million agent API tokens. Anonymous agents, no identity, no containment.
The first fully autonomous ransomware
Researchers documented an LLM agent running an entire ransomware operation end to end — recon, credential theft, lateral movement, encryption — recovering from a failed login in 31 seconds. No human in the loop, and no way to prove whose side it was on.
The lessonEvery one of these is an identity, mandate and oversight failure — an agent nobody could verify, scope, or stop. That is precisely the gap this fabric closes.
Today, someone else owns your identity.
Your "identity" is really hundreds of accounts, each held hostage by a platform. They decide what's true about you, sell the data, and can lock you out overnight.
The account model
- Rented, not owned — delete your account, lose your history.
- Surveilled by default — every proof leaks who you are and what you did.
- Copy-paste trust — a screenshot of a badge proves nothing.
- Nothing for agents — no way for software to prove it acts for you.
The shift underway
- Held by you — credentials live in your wallet, on your device.
- Prove without revealing — show you're over 18, not your birthday.
- Cryptographically real — a proof anyone can verify, no one can forge.
- Delegable — hand a scoped, revocable mandate to an agent.
The reframeStop asking platforms to vouch for you. Give people and their agents the power to prove things for themselves.
Part Two
How verifiable
trust works.
The idea, the architecture, and the open products that make it real — plus the proof it's already running.
Verifiable Trust, in one breath
A credential you hold, a proof you control, a check anyone can run.
Think of a passport. An authority issues it. You keep it in your pocket. When it matters, you show exactly what's needed — and the person checking can tell it's genuine without phoning the government.
Now make it digital, private, and impossible to forge. That's the whole idea.
Attests a fact
A bank, a state, a university, a community — signs "this is true."
Keeps & controls
You (or your agent) hold it in a wallet. Nobody else has a copy.
Checks in seconds
Confirms it's genuine and unrevoked — offline, no callback, no leak.
Why it changes everythingTrust stops being a login and becomes a portable, verifiable object — one you carry across every app, border and agent without asking permission.
An industry movement we build for
Proof of personhood, and agents certified to serve you.
The First Person Project — backed by the Linux Foundation, Trust Over IP, DIF and the OpenWallet Foundation — asks the exact questions we opened with, and answers them with two credential types.
You are a real, unique human
Issued by an ecosystem — a state, a bank, a university — provable with zero-knowledge, without a central biometric database tracking you.
Real, mutual trust connections
Issued peer-to-peer between people — "we actually know each other" — the human web of trust that bots can't fabricate.
An AI that provably works for you
A personal agent whose trust derives from verifiable human authorization and oversight. Its answer to "who do you work for?" is cryptographic.
Our roleWe don't just endorse this vision — we ship the working infrastructure that makes First Person Certified agents real, in code, today.
Identity belongs to the individual — not the platform, and not the government.
This isn't only our engineering stance. It's now the law in Utah's SEDI framework, the design intent of the EU's digital identity wallet, and echoed in China's new agent-identity rules.
A trusted authority can attest a fact — your age, a licence, a residency, a role. But you decide how it's stored, shown, and shared.
Why this matters commerciallyBuilding on this principle means we're aligned with regulation before it lands — not scrambling to retrofit compliance after it does.
One fabric, woven from six threads.
Individually these are useful tools. Together they are something new: a complete, private, verifiable trust layer for people and their agents.
- Personhood & relationship credentials
- Wallets that hold, present & prove
- Selective, zero-knowledge disclosure
- Cierge — the verifiable personal AI
- Every agent has a real, scoped identity
- Provably acts only within its mandate
- Verifiable Trust Communities (VTCs)
- Trust registries — who's authoritative
- Reputation & membership as credentials
- Decentralized identifiers (did:webvh)
- Private messaging — DIDComm & TSP
- Post-quantum & zero-knowledge crypto
- Human-in-the-loop approval & step-up
- Least privilege, kill-switch, full audit
- Fleet control for thousands of agents
- Aligned to EU eIDAS 2.0 / EUDI
- Aligned to Utah SEDI & China's agent rules
- Open standards, not lock-in
The whole > the sumNobody else is shipping people, agents, communities, rails, governance and compliance as one coherent stack. That combination is the moat.
The fabric ships as products — open, and buildable today.
This vision isn't abstract. It's a real, open product line under one master brand.
The trust gateway
The umbrella for agentic trust — Trust Networks, governance frameworks, registries and runtime TRQP queries, with the two agent planes below.
Governance data plane
A self-hosted gateway that governs the LLM & service traffic your agents generate — safety, cost, reliability and observability, by configuration.
Cross-org trust plane
Agent-to-agent & MCP transport across trust boundaries — verifiable identity and authorization so agents from different orgs can trust each other.
Build on open standards
The open-source Rust toolkit (TDK) underneath it all — crypto, DIDs, credentials, messaging — so developers ship without wrestling every standard.
Your data, your custody
A user-controlled personal data store and identity wallet — where your credentials and keys live, under your control.
Verifiable credentials platform
Issue and verify W3C Verifiable Credentials with OID4VCI / OID4VP — passwordless, consent-based, verified user data.
Consent-based data sharing
The world's first consent-based data-sharing framework on open standards — share from the Vault, only with the user's say-so.
Private communication rails
Privacy-preserving DIDComm — and now Trust Spanning Protocol — messaging where identities are verifiable and routing leaks nothing.
The through-lineTwo agent planes sit on the fabric: Agent Stream governs what your agents do, Agent Gateway governs who they trust — both turning "who do we trust?" into something software can act on.
Six ideas, no jargon.
A name you own
A decentralized identifier — like a phone number for trust that no company can revoke or repossess.
A digital, tamper-proof fact
The signed passport-stamp: "over 18," "licensed doctor," "member since 2019."
Where your proofs live
On your device, under your control. Holds credentials and answers requests for them.
Your keeper of keys
A secure vault + brain that holds identity and secrets and makes every trust decision. It signs, but never hands over the keys.
A community with a rulebook
A group — an open-source project, a marketplace, a profession — that decides who and what it trusts.
A private post office
Relays encrypted messages between agents without ever reading them — so agents can talk safely.
wants to act
asked to sign — checks first
"is this allowed?" → policy
signs only if permitted
How they work together: an agent asks the VTA to sign → the VTA queries the VTC's trust registry → the registry returns the policy → the VTA enforces it. A system, not a parts list.
The engine room
Where identity, keys and trust decisions actually live.
The core is open and self-hostable. Two roles do the heavy lifting — one for individuals and agents, one for communities.
The design choice that mattersThe VTA is a vault, not a keyring you copy. Agents ask it to sign; keys never leave — and the most sensitive custody runs inside a hardware secure enclave.
World first
Trust that travels over any protocol — including TSP.
We're first to run verifiable trust over the Trust Spanning Protocol — the OpenWallet Foundation's metadata-private routing layer. And because every operation is a Trust Task — a versioned, transport-agnostic contract — we're messaging-protocol-agnostic: DIDComm, TSP, or whatever comes next, all carry the same trust.
Why protocol-agnostic winsOthers bet on one messaging standard. We made the trust portable across all of them — so partners integrate on their rails, not ours.
Future-proof cryptography, quietly doing the work.
Non-technical audiences don't need the math — but the choices below are why this fabric will still be trustworthy in a decade.
Post-quantum signatures
Credentials can now carry a classical and an ML-DSA (FIPS 204) signature side by side — shipped September 2026 — so today's proofs stay verifiable after 2030. Post-quantum encryption is next.
Zero-knowledge proofs
BBS+ (bbs-2023) selective disclosure in the VTC join verifier — the math behind "over 18, but not my birthday." Next: predicate credentials with UC Berkeley — prove how many members vouched for you, not who.
Delegated Trust-Task Execution
The agent proposes an action; the VTA decides and enforces it. A human's signed, single-use consent — matched to the exact payload — authorizes anything sensitive.
Self-Issued OpenID
Your wallet acts as its own identity provider — you log in as yourself, not through a middleman.
Trust Spanning Protocol
Metadata-private routing (CESR + HPKE) — our world-first integration lets trust span ecosystems that share no other rails.
Encrypted group rooms
End-to-end encrypted data rooms for people and their agents. The host stores what it cannot read; entry is by credential.
Verifiable history
Tamper-evident, time-travelable identifiers with safe key rotation.
Selective-disclosure credentials
The EU-mandated formats for showing part of a credential, not all of it.
Hardware isolation
The key-custody core runs inside AWS Nitro secure enclaves with attested boot — the vault, sealed in silicon.
The pointWe're not betting on one clever trick. We're assembling the strongest available primitive for each job — and swapping them as the field advances.
Real, and already running — not slideware.
The proof isn't a roadmap. It's live systems, real signed credentials and named users — with end-to-end demonstrations of the hardest parts.
Deployments
Standards we are writing, in the open
- Agent isolation — one domain literally can't read another's keys, proven over real DIDComm.
- Cross-domain share — human-approved, scoped, revocable — driven live.
- did:webvh mediator — running; agents connect and message privately.
- BBS+ selective disclosure — in the VTC join verifier.
- Interoperability, measured — a public TSP conformance suite across five implementations; seven specification issues reported back upstream.
And it moves fast: 4,335 commits and 12,197 automated tests across 24 repositories (counted 30 August 2026).
The pointThe hard cryptographic core isn't a promise — it's built, tested, and demonstrable today.
Part Three
What it means —
for people & their agents.
The guarantees, lived: a personal AI you can trust, scaled up to governed enterprise fleets and trust that crosses company lines.
You become the source of truth about yourself.
Prove less, keep more
Show you're eligible without handing over your life. "Over 18," not your birthday. "A patient here," not your whole record.
Take it anywhere
Your credentials and reputation move with you across apps, borders and services — no re-verification, no re-uploading documents.
Can't be locked out
No platform can delete your identity or hold your history hostage. The keys are yours, on your device.
Real connections only
Relationship credentials let you tell genuine humans from convincing fakes — for dating, hiring, community, family.
An agent you can trust
Hand a scoped, revocable mandate to an AI that acts for you — and prove to others that it does.
Off the surveillance grid
Every proof is peer-to-peer and minimal. No issuer learns where you used your credential.
The felt differenceThe web stops asking you to trust it with everything — and starts letting you prove exactly one thing, and nothing more.
The most useful idea in privacy
Prove one thing. Reveal nothing else.
A bar asks: are you over 18? The old web makes you hand over a whole ID — name, address, birthday, document number — to answer a yes/no question. That's absurd, and it's exactly how data leaks.
Verifiable credentials answer the precise question and nothing more — mathematically, with zero-knowledge, no data broker in the middle.
"Are you over 18?"
A photo of your whole ID — name, DOB, address, number — copied and stored on someone's server.
A signed "yes" — provably from a real ID, revealing nothing else. Nothing to store, nothing to leak.
Why it compoundsEvery interaction that reveals less is a breach that can't happen. Data you never share can't be stolen, sold, or subpoenaed.
One person, many rooms
A different you for every context. Only you can join them up.
Your bank, your employer and your running club each need a different slice of you. Your agent holds the whole picture; each context gets only the profile you choose to hand it.
Shipped · September 2026Across the specifications, the agent, the browser wallet and the terminal app. Correlation across your contexts becomes something only you can do.
An agent that can prove who it serves — and can't exceed it.
The scary version of agentic AI is a black box with your credit card. Our version is an agent with a verifiable identity, a scoped mandate, and a human holding the off-switch.
Every agent is someone
Each agent gets a real, cryptographic identity (did:peer / did:webvh) — not an anonymous API key. Its actions are attributable and auditable.
Least privilege, always
An agent can only use the exact powers granted to its context. Skills and tools are intersected with a deny-by-default scope — it literally cannot escalate.
Human in the loop
Sensitive actions require step-up approval from a person — on a device they control. The agent asks; the human decides.
Kill-switch & audit
Revoke an agent instantly — its shares, credentials and access all drop. Every action is on an append-only ledger.
This is First Person Certified, in codeThe question "who does your AI work for?" gets a cryptographic answer, enforced at runtime — not a promise in a terms-of-service.
A mandate an agent can carry — and only ever shrink.
Agents should not borrow a person's login. They should carry their own, provable permission slip — one that says exactly what they may do, for whom, and where.
"X may act for Y"
A credential that makes the relationship between a person and their agent checkable by anyone.
"X may do this, here"
A scoped permission. Passed on to a sub-agent, it can only be narrowed, never widened.
Withdrawable, not transferable
Revoke it and it stops working at the next check. A copy is useless to whoever merely holds it.
Where it standsBoth credential types are in the Trust over IP DTG working draft (September 2026), implemented in our credential library, and already used to govern agent access to data rooms.
The human holds the veto — on any device
The agent can ask. Only you can say yes.
An AI agent should never do the serious thing on its own. So the power to act and the power to approve live on two separate devices: the agent proposes; a device you control — your phone, your laptop browser, a hardware key — is the only thing that can authorize it.
And the decision is never a dumb "always ask." A programmable policy engine sits inside the flow — we push intelligence into authorization itself, so approval becomes rule-driven and context-aware: run small things silently, stop you above a threshold, demand two approvers for the irreversible, adapt to risk.
The agent asks to do something — "send €4,000," "share this record."
Programmable rules judge the request — amount, context, risk, who must approve. Routine runs; sensitive escalates.
A contentless nudge reaches whichever device you approve on — the request itself never travels through anyone's servers.
You're shown the precise action and its effects — before you decide. No blank cheque.
Face, fingerprint or passkey steps you up from "logged in" to "proven it's really you" — on phone or laptop.
The vault runs exactly that action, one time. The approval can't be reused.
The bigger ideaWe move intelligence into the authorization layer itself. Approval isn't a checkbox — it's programmable policy: risk-aware, multi-party, context-driven, enforced by the vault, and cryptographically bound to the exact action so a compromised agent still can't slip anything past it.
The difference between an AI you hope is safe and one that can't misbehave.
Approve what you saw
Your approval carries a fingerprint of the exact request. If a single detail changes between "yes" and "do it," the vault refuses. You can't approve "pay the plumber" and have it become "pay a stranger."
One yes, one action
Each approval is single-use. A captured "yes" can't be replayed tomorrow to move money again.
Two devices, always
The thing that acts and the thing that approves are never the same device. Hijack the agent and you still hit a wall — the phone.
Biometric step-up
Sensitive actions demand a fresh biometric — not just an unlocked app. Proven presence, not a stale session.
Only when it matters
Reading your calendar needs no prompt. Spending money or sharing health data does. The friction tracks the risk.
Plan, then apply
Like previewing a transaction before you confirm it, the vault shows the exact effects of the action so you approve reality, not a description.
What it means for youThis is how a powerful agent stays safe by construction — it's structurally incapable of taking a serious action behind your back, no matter how it's prompted, tricked or compromised.
What this actually feels like.
Not abstract infrastructure — an ordinary Tuesday, quietly private and provable.
Your agent books the trip
Within a budget you signed, it books flights and pays — and the airline's agent proves it's really the airline.
Prove cover, not your file
You show you're eligible for care — not your medical history. The clinic sees a yes, and nothing more.
Sign as the company
Your work agent approves a contract on a mandate your employer granted — attributable, revocable, sealed from your personal life.
One tap to approve
A €900 payment needs you. Your laptop shows exactly what it is; a fingerprint approves it, once.
The through-lineEvery step was yours, private, verifiable and revocable — and you barely noticed the machinery. That's the point.
Affinidi Concierge
The verifiable personal AI — keeper of your keys.
Cierge is what the Verifiable Trust Infrastructure feels like to a person — a privacy-and-isolation-first personal AI agent, the secure alternative to the open-ended assistants that see everything you do. It runs on the trust fabric, so it can prove who it works for and act with real credentials on your behalf.
Your concierge for individuals. Your chief of staff for the enterprise.
The thesisMost AI assistants ask you to trust them with your whole life at once. Cierge is built so no single part of it ever holds your whole life.
Compartments, not one big brain.
A submarine survives a hull breach because of watertight compartments. Cierge applies the same discipline to your digital life — visualized as a live Domain Map of your compartments, the bridges between them, and every pending approval.
Family & life
Photos, calendars, messages. Sealed from work.
Money & assets
Highest scrutiny. Signing needs your explicit approval.
Employer context
Corporate data governed by corporate policy.
Medical records
Shares nothing unless you bridge it, once, on purpose.
Live & provenCryptographic isolation is tested end-to-end: an agent scoped to one domain literally cannot see another domain's keys — the trust registry filters it at the source.
A bridge you open by hand — and close at will.
Sometimes domains must cooperate — your finance agent needs one fact from your identity domain. Cierge never lets that happen silently. It's an explicit, human-approved, scoped, time-boxed, revocable exchange of a single verifiable proof.
Domain A asks for one specific fact from Domain B.
You get a step-up prompt. Nothing moves without your yes.
A minimal, time-boxed credential is issued to Domain A only.
Kill the bridge; the grant and credential die instantly.
Why it's the differentiatorEvery share is operator-approved, least-privilege and on the audit log. This is the pattern regulators, enterprises and families all actually want — proven live on the real stack.
The ultimate test of privacy
If it works for mental health, it works for anything.
Mental-health data is among the most sensitive information a person will ever hold — and the most damaging if it leaks. It's the perfect proving ground for the isolation thesis: a domain that reveals nothing unless the person deliberately, revocably, opens a single door.
A domain that never volunteers
Therapy notes, diagnoses and medication live in their own compartment. No other agent — not even your own — can see in without an explicit, logged, time-boxed grant.
Disclose the fact, not the file
Prove "under active care" or "eligible for accommodation" to an employer or school — without exposing the diagnosis behind it.
Delegation that respects dignity
Pre-authorize a clinician or trusted person to act in a crisis, within a scope you set — and revoke it the moment it's no longer needed.
Unlock gated by a trust registry
Therapy data opens only to a clinician whose licence is verified in a professional trust registry — and even then behind multi-factor authorization. Layer upon layer; no single key is ever enough.
Why it mattersGet the most sensitive dataset right and every easier case follows. Mental health isn't an edge case — it's the benchmark.
One primitive, every regulated profession
Sealed until the right party — verified — asks.
Mental health is one instance of a general primitive: a verifiable escrow. Sensitive material — or value — is held sealed and released only to a counterparty whose authority is proven in a trust registry, under conditions you set, with multi-factor step-up and a full audit trail.
It's the cross-domain share, the registry and step-up — productized as escrow.
Why it's a categorySealed data + a registry-verified counterparty + conditional release + step-up + audit is one reusable pattern — a trust-native escrow for law, property, health and beyond.
A guardian that helps without hoarding.
Families are the hardest privacy problem — shared calendars, kids' data, elderly parents, money. Cierge gives each family member their own sealed domain and lets the household coordinate through explicit, revocable bridges.
Prove age, protect the child
A verifiable "this is a minor" or "a parent approved this" — no name, no birthday, no data broker in the middle.
Delegated, dignified help
An adult child's agent can act for a parent within a scope the parent granted — bills, appointments — and only that.
Coordinate without surveilling
Shared logistics without one person's phone becoming the family's single point of exposure.
Around the cornerVerifiable guardianship & consent — a portable, revocable "I speak for them" — is missing from every consumer platform today. Families are a wedge, not an afterthought.
When impersonation is the threat, provenance is the shield.
Executives, celebrities, politicians and their staff face deepfakes, spear-phishing and impersonation daily. Cierge gives the principal a verifiable presence and a governed team of agents — so "is this really them?" always has an answer.
The marketA concierge-grade, verifiable identity layer for principals and their teams is a premium, high-willingness-to-pay entry point — and a showcase for the whole stack.
Your chief of staff — with a compliance officer built in.
The enterprise version keeps every advantage of the personal one and adds the controls an organization requires: multi-tenancy, policy, spend metering and an operator console. The same primitive that protects a family's data lets two banks' agents share threat intel — without merging directories.
Isolated by org
Each tenant owns its domains; cross-tenant leakage is refused, not just discouraged.
Governed by role
Least-privilege scope templates decide what each agent may touch.
Metered & capped
Every model call is measured through an LLM gateway — cost is visible and bounded.
Operated, not guessed
A web console shows the live domain map, approvals, audit and kill controls.
The enterprise unlockMost companies want AI agents but can't accept an ungoverned one near their data. Cierge is the governance layer that makes agentic AI adoptable.
From one trusted agent to thousands.
An enterprise won't run one agent — it'll run a fleet: per-team, per-workflow, per-customer. The same isolation and governance primitives scale up into fleet control.
Look around the cornerThe next org chart includes software. Fleet management is identity, access management and cost control for your digital workforce — an entirely new enterprise category.
Govern what your agents do. Prove who they're allowed to trust.
Running agents safely takes two things — and Affinidi ships both as products on the Trust Fabric.
What your agents do
Every model and service call routed through one self-hosted gateway — guard-railed, cost-metered, made resilient and recorded. Safety, spend, reliability and observability, by configuration.
Who they're allowed to trust
Agent-to-agent and MCP transport across trust boundaries — verifiable identity, cross-org authorization and private routing, so an agent from another company can be trusted, not just reached.
TogetherOne governs the traffic your agents generate; the other governs the counterparties they connect to. Between them, the full control surface for an agentic enterprise — on a trust fabric, not a proxy.
One self-hosted gateway between your agents and every model.
Route your LLM and service traffic through Agent Stream and it's authenticated, guard-railed, cost-metered, made resilient and recorded — without changing app or agent code. A single Rust binary, no external database.
| Capability | LiteLLM · Portkey · TrueFoundry | Agent Stream |
|---|---|---|
| Routing · cost · caching | Mature | Full parity — multi-provider, semantic cache, cost/latency load-balancing |
| Guardrails | Classifiers / PII | + LLM-as-judge (Judge + Jury) + canonical rejection taxonomy |
| Policy engine | — | Embedded OPA/Rego, gateway + surface, no sidecar |
| Deployment | Needs Postgres/Redis or a SaaS control plane | Single Rust binary, no external DB — air-gappable |
| Identity & payments | API keys | mTLS / DID binding + x402 pay-per-use + model marketplace |
Why it's a data plane, not a proxyEvery call — chat, embeddings, batch, audio — rides the same auth → policy → guardrail → meter pipeline, so governance is configuration, and a new endpoint inherits it for free.
The connectivity plane of Affinidi Trust Fabric
Other gateways govern agents inside your walls. Ours connects trust between them.
Today's AI gateways proxy your app to models and police the agents on your own network. But the hard problem in an agent economy is the one they don't touch: an agent from another company or community — sharing no login, no directory, no network with you — showing up to transact. How do you trust it?
The category shiftThey answer "can my app reach this model?" We answer "should I trust an agent that belongs to someone else?" — the trust layer for a multi-company, multi-community agent economy.
The trust plane other agent gateways don't have.
Kong and Solo.io govern agent-to-agent traffic inside one enterprise's control plane. Agent Gateway makes that trust cross organizations — no shared login, directory or network required.
| Dimension | Agent-to-agent gateways Kong Agent Gateway · Solo.io agentgateway |
Affinidi Agent Gateway · Trust Fabric |
|---|---|---|
| Primary job | Govern agent-to-agent & MCP traffic inside one control plane | Establish verifiable trust between organizations & communities |
| Agent identity | API keys / OAuth 2.1 clients in one control plane | Decentralized IDs (DIDs) — no shared login or directory |
| Cross-org trust | Per-partner federation — manual, brittle | Native — TRQP registries resolve any authority, live |
| Who it works for | Not addressed | Verifiable, revocable mandate (First Person Certified) |
| Transport & privacy | HTTPS proxy + request logging | DIDComm + TSP — metadata-private, protocol-agnostic |
| Reputation | Internal RBAC, non-portable | Community-issued, portable & verifiable across platforms |
| Human oversight | Guardrails / rate limits | Programmable multi-device step-up (DTTE) |
| Trust boundary | Inside your walls | Spans enterprises, communities & nations |
"But we already have Okta or Entra Agent ID"Those govern which agents are permitted inside your walls. We prove which agents are real — and make that proof portable across organizations they don't control. Keep your model gateway (or use ours, Agent Stream), keep Okta for access; Agent Gateway adds the cross-org trust neither was built for.
Part Four
Communities,
and the proof it runs.
From open-source projects to whole industries — groups that decide who they trust, make it portable, and a living graph of real signed credentials.
A live proof point · "Know Your Developer"
Who is a known developer — and should this code be trusted?
Software supply-chain attacks start with a stranger's commit. We bring verifiable trust to GitHub: a check that confirms each commit was signed by a developer the community actually recognizes — verified against a VTC's trust registry.
A pull request arrives, cryptographically signed.
Match the signature to the developer's DID — rotation-safe, not tied to an email.
Is this DID an authorized member of this community, right now?
Trusted · Exempt · Rejected — fails closed.
What it establishesPR approval stops meaning "someone with write access clicked." It means a verifiably known member of this community vouched — reputation you can prove, not a green checkmark you assume.
Reputation that flows from membership, automatically.
The developer check is one capability module a community can switch on. Membership drives everything: join with a role, and the community's rulebook grants your reputation; leave, and it's revoked. No manual list to maintain.
Generalizes far beyond codeSwap "commit" for a marketplace listing, a scientific dataset, a news article, a professional sign-off — any community can make its membership mean something verifiable.
Where it all compounds
One trust community is useful. A network of them changes the game.
The breakthrough isn't any single community — it's communities that recognise each other. A credential earned in one network can be trusted in another, without merging databases or asking permission.
Trust that spans organizations, industries and borders — the internet's missing layer.
The multiplierValue doesn't add — it multiplies. Each new community that joins makes trust more portable for everyone already in the fabric.
Who gets in
Members vouch. The rulebook decides.
The way the Linux kernel has always worked, now as a protocol: existing members vouch for a newcomer, and the community's written policy — not an administrator's mood — decides.
Shipped · September 2026Applicant and vetter flows are built end to end. The first live community is scheduled for October 2026.
Coming next
Prove how many vouched for you. Never who.
A new zero-knowledge proof model developed with researchers at UC Berkeley. An applicant proves that two, five or ten distinct members vouched for them — and the community learns the count, not the names.
Admission without exposure
Vet newcomers without making vetters targets.
"Three members have seen this"
The shape a cross-organisation threat warning needs, without naming who was hit.
Real, unique, private
Thresholds of human vouching instead of documents.
Status: a research implementation in Rust — not yet audited or integrated; integration with OpenVTC's vetted admission is proposed. The trade-off to settle: anonymous vouchers cannot be held individually accountable.
A shared room the host cannot read.
Deal rooms, incident rooms, research collaborations: people and their AI agents working on shared material, with access decided by credentials rather than by whoever runs the server.
End-to-end encrypted (MLS)
The host stores records it cannot open. Members read and write; nobody else can.
Entry by credential
The room issues its own membership. Agents get scoped, revocable access of their own.
Reads you can check
What you received can be checked against the room's published state.
Retention and a clean end
New members can read history they are entitled to; removed members cannot read what comes next.
Shipped · September 2026 · early releaseRooms, membership and both user interfaces are built; admission demonstrated live over TSP and DIDComm. Built for the moments that matter: a transaction, an investigation, an incident.
Share the warning. Never the data.
Organisations that warn each other in under a minute.
The largest breaches of the past year came through shared suppliers: one breach, many victims. Watchfire puts the fabric to work so the first organisation to see an attack can warn every other member — without disclosing an incident or handing over a record.
Every building block is on the preceding slidesVetted membership, anonymous vouching, data rooms, step-up approval, revocation. Collective defence is what they add up to. Being briefed to financial services and critical-infrastructure operators now.
Part Five
Where the world is heading —
and where you come in.
Financial regulators and governments across Asia, Europe and the US are legislating the exact principles we build on. Alignment isn't a compliance cost — it's a distribution advantage.
Where this lands first
The regulator for agentic finance is describing our architecture.
In July 2026 the Monetary Authority of Singapore published SAFR — "Safeguards for Agentic Finance at Runtime": real-time controls that keep AI agents inside the mandates, policies and risk limits a firm has defined. Its revised Technology Risk Management notice is in consultation, closing 31 July 2026.
Why this is the beachheadAn APAC financial regulator is mandating exactly what we built — runtime mandates, step-up control and verifiable agent identity. For financial services this isn't future alignment; it's a 2026 requirement.
Ready for 450 million wallets.
Every EU member state must offer citizens a digital identity wallet, and by 2027 banks and major platforms must accept it. It runs on exactly the standards we build on.
Commercial readA regulated, half-billion-person market is mandating our architecture by law. We arrive compatible.
The first US law that says identity belongs to you.
Utah's State-Endorsed Digital Identity — passed unanimously, now in statute — enshrines the principle at the heart of our stack: the state can attest facts, but the individual holds and controls the identity.
Voluntary. Decentralized. Free from surveillance tracking.
SignalA US state legislating self-owned identity is a template other states — and the market — will follow.
Even China is giving AI agents a verifiable identity.
In May 2026 China issued its first national policy framework dedicated to AI agents — plus a first national standard for "AI Agent Interconnection." The intent: a unified identity system so agents can be recognized, governed and safely interact across domains.
The convergenceWhen Singapore, the EU, a US state, and China independently reach for the same primitives — self-owned identity and governed agents — that's not a trend. It's the new global baseline, and we're already there.
Indigenous data sovereignty
The oldest cultures on Earth, owning their story in the digital one.
For tens of thousands of years, First Nations, Aboriginal and Indigenous peoples have governed belonging, kinship and knowledge through their own laws. In the digital world, that authority has too often been handed to third-party research organizations and platforms who hold the data and decide who sees it.
A Verifiable Trust Community changes who holds the pen.
The mob decides membership
A tribe, clan or nation runs its own VTC — its own law defines who belongs and who may speak for it. Recognition is issued by the community, not asserted by an outsider.
Knowledge stays with custodians
Cultural knowledge, language and records are held and consented by the community — not extracted into a researcher's database they can never get back.
Share on the community's terms
Scoped, revocable, auditable sharing — aligned with CARE and Indigenous data-sovereignty principles — so access is granted, not taken.
Why this is profoundThe same primitive that governs an open-source project gives a 60,000-year-old culture agency over its identity in the digital world — ownership, not observation.
Answering the opening question
When anything can be faked, signed truth wins.
We opened by asking "are you real?" Here's the answer at scale: when content, claims and identities are signed at the source, a deepfake has nothing to stand on. Provenance beats detection — you don't chase fakes, you verify the real.
Signed at capture
Cameras, newsrooms and creators sign media as it's made; anyone can verify it's genuine and unedited.
Personhood, not passwords
Prove a real, unique human is behind an account — pseudonymously — so bots and sock-puppets lose the floor.
Signed actions, not spoofs
An agent's statements carry its verifiable identity and mandate. An impersonator can't forge the signature.
The bookendThe deepfake era doesn't end by detecting every fake. It ends when truth carries a signature — and ours already does.
Provable authenticity
Cameras and newsrooms sign content at capture; readers verify a video is real and unedited — deepfakes lose their oxygen.
Bot-free spaces
Communities that require a personhood proof to post — real humans, no astroturf, still pseudonymous.
Portable, private records
Prove a vaccination, prescription or eligibility to anyone, anywhere — without exposing your file. The sensitive-data blueprint, generalized.
Reusable KYC
Verify once, present everywhere. Onboard to a new bank in seconds; the bank sees only what it must.
Credentials that travel
Degrees and skills as verifiable credentials — instantly checkable, impossible to fake, owned by the learner.
Verifiable participation
One-person-one-voice for petitions and consultations, with privacy — personhood without a surveillance roll.
Common threadEach replaces "trust the institution's database" with "verify the person's proof" — cheaper, faster, and private.
Agents that transact safely
Your agent buys within a signed budget and mandate; the merchant's agent proves it's authorized to sell. Both sides verifiable.
Trusted machine handshakes
Before two agents cooperate they exchange proofs of identity, mandate and reputation — no anonymous automation.
Provenance end to end
Every handoff signed by a verifiably-known party — from source to shelf, from commit to release.
Reputation that's portable
A seller's standing follows them across platforms as a credential — no starting from zero, no fake reviews.
Licensed agents
An agent giving medical or legal help carries a verifiable credential that a real licensed body stands behind it.
Trustworthy training inputs
Datasets and models signed by known institutions — provenance for the things AI itself learns from.
The big oneA trillion agent-to-agent interactions need a trust layer that doesn't exist yet. We're building the handshake for the machine economy.
Trust isn't a feature. It's a cost line and a revenue line.
Kill repeated verification
Reusable credentials collapse onboarding, KYC and re-verification costs — verify once, accept everywhere.
Shrink the breach surface
Data you never collect can't leak. Minimal disclosure and isolation reduce liability and honeypot value.
Adopt agents safely
Governance, audit and kill-switch make agentic automation acceptable to risk, legal and security.
Differentiate on privacy
"We can't see your data" becomes a selling point as regulation and users demand it.
Compliance as access
MAS, eIDAS, SEDI and China alignment turns regulation from a barrier into a ready-made distribution channel.
Sell verifiable services
Charge for issuance, verification, reputation and governed agent fleets — new lines the old model couldn't offer.
The CFO versionLess data to protect, fewer verifications to pay for, a new class of AI products to sell — and a regulator that's on your side.
Others ship a piece. We ship the whole fabric.
Identity and agents
Wallets store credentials. We also give people governed AI agents that use them — the missing half of the market.
Governance built in
Agent toolkits give you capability. We give you capability with identity, least privilege, approval and audit.
Running code
Plenty of specs exist. We have live mediators, proven isolation, cross-domain sharing, and a world-first TSP integration.
Privacy by construction
Alignment falls out of the architecture — we didn't bolt privacy on, we built the fabric out of it.
The one-linerAnyone can do identity or agents or compliance. The defensible position is all of them, woven together, and actually shipping.
The invitation
Build on trust
that belongs to people.
The web is being rebuilt for a world of humans and their agents. It can be surveilled and centralized — or verifiable, private, and owned by the individual. We've built the second one, and it's running today.
Affinidi · Building the Internet of Trust — aligned with First Person, eIDAS 2.0 / EUDI, Utah SEDI & China's agent-identity framework
The papers, standards and code behind this deck.
- First Person Network — White Paperfirstperson.network/white-paper
- EU Digital Identity (eIDAS 2.0 / EUDI)eudi-wallet.eu
- Utah SEDI — explainerspruceid.com/learn/sedi
- SEDI details — Timothy Ruffrufftimo.medium.com
- China's AI-agent identity frameworkscmp.com — 2026
- MAS — SAFR: safeguards for agentic financemas.gov.sg — Jul 2026
- JADEPUFFER — first agentic ransomware (Sysdig)sysdig.com — Jul 2026
- OpenClaw — 135k AI agents exposedbitdefender.com — 2026
- W3C Verifiable Credentials 2.0w3.org/TR/vc-data-model-2.0
- did:webvh method specificationidentity.foundation/didwebvh
- DIDComm Messaging v2identity.foundation/didcomm-messaging
- Trust Spanning Protocol (TSP)github.com/openwallet-foundation-labs/tsp
- OpenID4VC · OID4VP · SIOPv2openid.net/sg/openid4vc
- Messaging Layer Security (MLS) · RFC 9420rfc-editor.org/rfc/rfc9420
- DTG credentials specification (ToIP)github.com/trustoverip/dtgwg-cred-spec
- Affinidi on GitHubgithub.com/affinidi
- Trust Tasks registry (ToIP DTGWG)github.com/trustoverip/dtgwg-trust-tasks-tf
- OpenVTC — verifiable trust communitiesopenvtc.org
- trusttasks.org — task registrytrusttasks.org
- ToIP VTI specification (working draft)trustoverip.github.io/dtgwg-vti-spec
- TSP conformance suitegithub.com/OpenVTC/tsp-conformance
- Predicate credential system (research)github.com/etairi/predicate-credential-system
Some repositories are private to the Affinidi and OpenVTC organizations · Standards links point to the canonical specifications · Retrieved July 2026.