Argos: the first verifiable identity in the NEXTAI fleet

NEXTAI issued credential CRD-2026-0001 to Argos, its prospecting agent, on 8 September 2026. It is the first verifiable digital identity of an agent in the consultancy's fleet: a cryptographically signed credential that attests who operates the agent, what it is authorised to do and what it is forbidden to do, and that anyone can check without signing up.

What the credential contains

The credential follows the W3C Verifiable Credentials 2.0 standard, in vc+jwt format, and is signed with ES256 over the P-256 curve. The private key is held in Google Cloud KMS, outside the web server.

It is issued by Cosmolabs OÜ, an Estonian company with registry code 17106582, operator of the NEXTAI and CORTEX brands, under the identifier did:web:digitalcortex.tech. The agent has its own identifier, in the form did:web:digitalcortex.tech:agents:argos.

Inside the credential you will find the declared scope, the maximum autonomy level — A4: persistent or external action only with valid human approval — a low risk classification, the validity dates and the SHA-256 hash of the agent's registered manifest. Scope and prohibitions are parameters signed at issuance; the loaded configuration and external permissions require additional checks.

What Argos can and cannot do

Argos scouts potential clients, qualifies them, researches public context, drafts outreach messages and produces status reports.

Its credential forbids outreach.send, payments, contracts, deletion and the modification of agents. That scope does not attest that the whole commercial circuit uses the same identity, and on its own it does not demonstrate that tools are blocked.

The credential binds an identity declaration to the hash of the registered manifest. The scope is signed at issuance. To detect a change of prompt, model or permissions outside that registry you have to check the effective configuration: the hash does not automatically observe external systems. Every approved change of scope requires reviewing and reissuing the declaration.

Expiry and revocation

The credential expires after 90 days and is renewed. It can be cancelled earlier at any time through a signed revocation list following W3C Bitstring Status List v1.0. If it is revoked or expires, the visual seal served by the site switches off and shows a notice, so an old copy of the seal attests to nothing.

The credential contains no personal data about individuals: the responsible party is the company, with an accountable role and a legal contact address.

How to check it

Verification is public and requires no sign-up. The page runs eight live checks: credential format, the key declared by the issuer in its DID document, signature, issuer consistency, validity, revocation, unchanged manifest and published DID document. If any one fails, the credential should not be taken at face value.

The CORTEX Seal — the visual representation of the credential — is generated deterministically from the manifest hash and the agent's identifier, and includes a QR code that opens that same verification page.

Publishing it makes it possible to test a declaration of identity, scope and validity through its signature.

Context

Article 50 of the AI Act sets transparency obligations according to the role of the provider or deployer and the specific use. It does not require a cryptographic credential and it is not automatically satisfied by a seal. A verifiable identity complements the notices where those apply. See the official text and our guide for companies.

The technical category is called Verifiable Agentic Identity (VAI) and is explained in plain language as a digital ID for AI agents. As far as NEXTAI has been able to check, it is not aware of another AI consultancy for SMEs in its market that publishes verifiable credentials for its agents.

Argos is the first of the company's superagents to join the scheme. The full analysis of the case is in the Argos case study and the explanation of the concept in what a digital ID for AI agents is.

Verification links

• Public agent verifier: digitalcortex.tech/verify/argos
• Public agent registry in JSON: digitalcortex.tech/functions/agentRegistry
• Technical documentation: digitalcortex.tech/docs/identidad

Editorial update of 17 September 2026, produced with the support of AI tools and cross-checked against public documentation. It is not presented as an external audit.

Identity and execution: the scope of this explainer

The public checks describe the credential and its relationship with the registered manifest. They do not prove the authentication of whoever presents it, the state of each external permission, or that actions are actually blocked. See the published evidence and limits.