Identity is becoming a harder problem precisely when digital systems are being asked to do more with it. For two decades the consumer internet treated identity as a convenience layer: a username, a social sign-in, a payment card on file, perhaps a government document uploaded during a compliance check. That model was always clumsy, but it broadly held while most online actions were human-paced and most media retained some evidential value. By 2026, both assumptions have weakened. AI agents can act at machine speed on behalf of users and firms. Synthetic voices, faces and documents can be generated cheaply and refined quickly. Platform accounts remain useful, but they are no longer sufficient anchors for trust.
The resulting anxiety is often described as a deepfake problem or a fraud problem. It is broader than that. It is a constitutional problem for the digital sphere: who is entitled to identify whom, under what rules, with what evidence, and with what ability to contest mistakes. If every meaningful transaction requires deference to a handful of platforms, sovereignty drains from the edge of the network towards corporate chokepoints. If identity is fused entirely to the state, civil liberties and market competition both narrow. If identity is left wholly unstructured, abuse flourishes and institutions retreat into suspicion. The challenge is to build systems that verify claims robustly while limiting the concentration of power that verification can create.
Why this category matters now
Sovereign identity matters because almost every other domain of digital autonomy depends on it. A person cannot realistically control data, money, reputation or delegated software agents if they cannot prove relevant facts about themselves across contexts. An employee may need to prove authorisation without exposing personal details. A patient may need to demonstrate entitlement to a service without creating a giant health data honeypot. A freelancer may need to show qualifications, tax status and payment instructions to several counterparties without repeatedly surrendering copies of sensitive documents. An AI agent may need to prove that it is acting under a human mandate, with bounded permissions, at a given time.
The old web asked whether an account belonged to a user; the new web must ask whether an action belongs to a person, an agent, or a forgery. That distinction matters because agentic systems are beginning to transact, negotiate, retrieve information and trigger real-world consequences. A bank, hospital or government department cannot rely solely on the assertion, “logged in equals authorised”, if the logged-in party may be an automated delegate, a compromised session, or a synthetic impersonation. Identity must become more granular and more expressive: not just who someone is, but what can be credibly claimed, by whom, for what purpose, and with what cryptographic or institutional assurance.
The internet does not merely need more identity. It needs better boundaries around who can ask for it, store it and reuse it.
From accounts to claims
The conceptual shift is from account-based identity to claim-based identity. An account is a relationship with a service. A claim is an assertion that can, in principle, travel across services: over 18, licensed physician, enrolled student, authorised procurement officer, resident of a jurisdiction, holder of a degree, controller of a legal entity, recipient of a benefit. Verifiable credentials and related standards attempt to make such claims cryptographically portable while allowing the issuer, the holder and the verifier to play distinct roles.
This matters because the account model creates needless centralisation. Each service collects, stores and re-verifies the same attributes. Users lose visibility and control. Institutions bear unnecessary data protection risk. Breaches become more damaging because raw identity data accumulates in many places. By contrast, a credential model can allow an issuer to attest a fact once, a holder to store it in a wallet they control, and a verifier to check that fact without permanently acquiring the underlying document or gaining broad surveillance over where else it has been used.
That is the theory. The practice is messier, not least because portability, privacy and usability rarely align neatly. The foundational task of this category is therefore not to celebrate a technical stack, but to analyse which design choices preserve human agency under realistic legal, commercial and geopolitical pressures.
The promise and limits of decentralised identifiers
Decentralised identifiers, or DIDs, emerged from the effort to create persistent identifiers that are not dependent on a single platform or registry operator. In their strongest formulation, DIDs allow individuals or organisations to control identifiers and associated cryptographic keys directly, rotating or updating them without asking a central authority for permission. Combined with verifiable credentials, this can reduce dependence on platform log-ins and improve interoperability across services.
Yet the word decentralised often obscures as much as it clarifies. Most people and institutions do not want to manage raw cryptographic complexity unaided. Recovery is difficult. Key loss is not an abstract edge case; it is a certainty at scale. Governance does not disappear because code is distributed. Someone still defines schemas, trust registries, wallet interfaces, revocation methods, dispute processes and compliance obligations. The real question is where dependency moves. A system can be technically decentralised while becoming commercially concentrated in wallet providers, cloud key custodians or dominant issuers.
The old web asked whether an account belonged to a user; the new web must ask whether an action belongs to a person, an agent, or a forgery.
A mature analysis therefore resists binaries. Decentralisation is useful when it reduces single points of control, supports interoperability and makes exit credible. It is less useful as an ideology that treats all intermediaries as illegitimate. Identity is not only a cryptographic problem. It is an institutional one, and institutions require accountable governance.
Verifiable credentials and selective disclosure
The most promising feature of modern credential systems is not decentralisation in itself but selective disclosure. A well-designed wallet can let a user prove only what is necessary. Instead of sharing a full driving licence to establish age, a person can present a proof that they are above a threshold. Instead of handing over an entire diploma PDF, they can present a signed credential whose authenticity is easy to verify. This principle aligns with longstanding privacy law, including data minimisation under GDPR, and with common sense: many transactions require evidence, not biography.
For institutions, selective disclosure can reduce compliance exposure. Firms regularly collect more personal data than they need because legacy processes leave them little choice. If standardised credentials make it possible to verify eligibility, authority or status without warehousing the source documents, risk can fall for both sides. This is particularly relevant in sectors such as finance, health, education and labour markets, where repeated document exchange is expensive and fragile.
Still, privacy gains are not automatic. Metadata can be revealing even when content is minimised. Wallet providers may learn patterns of use. Verifier collusion can reconstruct behaviour over time. Revocation checks can leak information if they require contacting a central service for every presentation. A durable identity system should let institutions verify claims without acquiring a permanent right to watch the claimant. That requires careful protocol design, legal limits and a market structure that does not quietly re-centralise observation.
Proof of personhood in an age of synthetic abundance
One reason sovereign identity has moved from specialist debate to strategic concern is the prospect of widespread synthetic participation in civic and economic systems. Not every online interaction requires proof that a human is on the other side. Indeed, anonymous or pseudonymous speech remains valuable. But some functions do require confidence that one person is not masquerading as many: voting in certain associations, distributing scarce benefits, rate-limiting abuse, preserving integrity in public consultation, and defending systems against automated manipulation.
Proof of personhood is the attempt to establish that a participant is a unique human without necessarily revealing who they are. This is attractive in theory because it separates uniqueness from identity. In practice it is one of the hardest problems in the field. Biometric approaches can be intrusive and politically combustible. Social graph methods can disadvantage the marginal and the newly arrived. Hardware-linked methods can privilege users of certain devices. In-person ceremonies may improve assurance while excluding those without mobility, documents or safe access.
There is no universal solution, and claims to have solved the problem should be treated cautiously. Proof of personhood is better understood as a spectrum of mechanisms matched to context, each with trade-offs in privacy, inclusion, coercion resistance and attack surface. The liberal objective is not to abolish pseudonymity. It is to ensure that where uniqueness matters, the verification method does not become a back door to comprehensive identification.
If every defence against bots requires a universal passport for the web, the cure will be worse than the disease.
Wallets will matter more than websites
As credentials become portable, the locus of control shifts towards wallets and agent interfaces. This is likely to be one of the most important architectural changes in digital identity over the next decade. Today, most people experience identity through websites and apps that ask for details, issue sessions and decide what counts as sufficient proof. In a wallet-centric model, the user arrives with attestations already in hand and can present them across many contexts. The service no longer needs to be the primary collector and custodian of identity data.
This shift could increase user sovereignty, but only if wallets remain substitutable and intelligible. If a handful of operating systems, browsers or payment networks define the practical terms of wallet use, the centre of gravity simply moves from social log-in providers to new gatekeepers. Technical interoperability through bodies such as the W3C and the OpenID Foundation is therefore not a side issue. It is what separates an open credential ecosystem from a managed identity market dressed in new language.
A durable identity system should let institutions verify claims without acquiring a permanent right to watch the claimant.
Agents need mandates, not just identities
Wallets will also mediate delegation. A human user may empower an AI agent to search for travel, negotiate procurement, prepare tax filings or manage subscriptions. In each case the key issue is not only who the human is, but what the agent is permitted to do, for how long, under what limits, and with what auditability. An identity layer fit for the age of agents must include machine-readable mandates, revocable permissions and clear provenance of actions. Otherwise organisations will either reject agents outright or accept them on dangerously thin evidence.
This is where sovereign identity intersects with governance. The holder should be able to delegate without surrendering irreversible control. The verifier should be able to distinguish between a human assertion and an agent acting under authority. And where something goes wrong, there must be logs, remedies and institutional pathways for challenge.
The state will remain central, but should not be solitary
Government-issued identity remains foundational because states control civil registries, immigration status, company registers and many of the legal facts that institutions care about. Europe’s digital identity framework reflects this reality while trying to give citizens more usable digital credentials across borders. Similar efforts are under way elsewhere, though political cultures differ sharply in what citizens will tolerate. The sensible position is neither anti-state romanticism nor blind trust. Public authority is necessary for certain attestations, but dangerous when it becomes the sole gate through which all digital life must pass.
A healthy identity ecosystem therefore needs plural issuers. Universities, professional bodies, employers, banks, municipalities, health providers and civil society institutions can all issue context-specific credentials. The user should be able to combine these in a wallet without every interaction flowing back to a central state dashboard. States have a role in setting legal equivalence, assurance levels, anti-discrimination obligations and redress. They should be wary of becoming omniscient intermediaries for everyday identity checks.
Inclusion is not a footnote
Identity systems often fail at the edges first and then generalise those failures inward. People with inconsistent documentation, migrants, refugees, informal workers, those escaping abuse, gender-diverse individuals, and residents of weak administrative environments are often told to fit rigid schemas designed elsewhere. A sovereign identity framework that works only for the already legible is not sovereign in any meaningful sense. It merely digitises existing hierarchy.
Inclusion requires more than mobile access. It requires flexible evidence models, accessible recovery methods, support for guardianship and representation, and procedural fairness when records conflict. It also requires recognition that legal identity and social identity are not identical. In some settings a person must be able to prove continuity and entitlement even when names, addresses or markers change. Systems that cannot accommodate legitimate change will push people back towards paper workarounds and discretionary gatekeepers.
Markets will shape power as much as standards
Identity standards are often discussed as technical plumbing, but market structure will determine much of their effect. Issuers may prefer closed loops that preserve customer lock-in. Verifiers may demand excessive data because it seems operationally simpler. Wallet providers may bundle identity with payments, messaging or cloud storage and use convenience to accumulate leverage. Large platforms may support interoperability only at the edge, while preserving proprietary advantages in reputation and graph data.
This is why competition policy belongs in the identity conversation. Interoperability mandates, data portability, anti-tying scrutiny and procurement design can all influence whether sovereign identity becomes a genuinely open layer or a new theatre for incumbent control. The aim is not to eliminate business models. It is to ensure that proving a claim does not require fealty to a single commercial gatekeeper.
Trust needs law, not just code
The real contest is not centralised versus decentralised in the abstract, but where power sits when errors, exclusions and fraud inevitably occur.
There is a recurring temptation in digital identity to believe that cryptography can displace law. It cannot. Signatures can prove integrity. Protocols can reduce data exposure. Standards can improve interoperability. None of these answer basic questions of liability, discrimination, due process and institutional duty. What happens if an issuer revokes a credential wrongly. Who bears loss if a verifier relies on a credential outside its intended scope. How does a person appeal a refusal generated by automated risk systems. Can a wallet provider suspend access without notice. These are legal and political questions before they are technical ones.
The most credible frameworks therefore combine open technical standards with clear governance. NIST’s identity guidance, the OECD’s AI principles, European data protection law and sector-specific rules each illuminate part of the terrain. None is sufficient alone. The strategic task for the coming years is to align identity architecture with principles of necessity, proportionality, user agency, accountability and contestability.
- Necessity: ask only for attributes required by the transaction.
- Proportionality: match assurance to risk rather than defaulting to maximum identification.
- User agency: let holders choose among credentials and wallets where feasible.
- Accountability: define issuer, verifier and wallet responsibilities clearly.
- Contestability: provide remedies when credentials are denied, revoked or misused.
What sovereignty should mean in practice
Sovereignty in identity does not mean every individual running their own infrastructure in splendid isolation. It means having meaningful power over the credentials and identifiers through which one participates in digital life. That includes the ability to obtain attestations from multiple issuers, store and present them through interoperable tools, disclose only what is necessary, delegate bounded authority to software agents, recover from loss, and seek redress when institutions err. It also means not being permanently tethered to a single platform account as the de facto passport to the internet.
For small firms and one-person enterprises, this is not a philosophical luxury. It is increasingly operational. As more commerce, compliance and access control are mediated by software agents, smaller actors will need identity instruments that travel with them rather than locking them into dominant intermediaries. A business should be able to prove incorporation, beneficial authority, insurance status or professional accreditation across counterparties without rebuilding trust from scratch each time. That is how open markets remain workable in an age of automated verification.
The settlement ahead
The future of digital identity will not be decided by a single protocol or public scheme. It will emerge from the interaction of standards bodies, governments, courts, regulators, device makers, financial institutions, employers and users. The immediate risk is that the disorder created by deepfakes and automated fraud will be used to justify excessive centralisation. That would be an understandable response, but not a wise one. Systems built for total legibility often become brittle, exclusionary and politically tempting to misuse.
The better path is harder. It demands technical interoperability without naive faith in technology; public authority without monopoly; private innovation without enclosure; strong verification without routine over-collection; and support for agents without erasing the human principal behind them. In short, it requires treating identity as critical civic infrastructure rather than as a by-product of customer acquisition.
Sovereign identity is therefore not a niche concern for cryptographers or compliance teams. It is the foundation for preserving autonomy in a networked world where appearances can be manufactured, actions can be delegated and trust can no longer rest on the page or the profile alone. The societies that navigate this transition well will be those that learn to verify more while seeing less, and to empower individuals without abandoning institutional trust.
