Why every AI agent should carry an ID (and how to check ours)

Verifiable agentic identity is the ability to prove publicly and cryptographically who operates an AI agent, what it is authorised to do and what it is forbidden to do. It is not a sentence in a legal notice: it is a signed credential, with an expiry date and the possibility of revocation, that anyone can check on their own in under a minute.

An agent writes to your company. Who answers for it?

Picture an ordinary Monday. A well-written message arrives, with context and a reasonable proposal. It is signed by an AI agent. It asks you for data and suggests a meeting.

Now the awkward questions. Which company answers for what that agent does? Who gave it permission to ask you for that data? Can it send money? And if they reconfigure it tomorrow and it keeps the same name?

Today you cannot check any of that. You trust the sender's logo. That is not identity: that is marketing.

The gap: a brand is not an identity

Anyone can copy a logo in ten minutes. A domain with HTTPS attests to the server that delivers the page, not to the agent writing to you. And a trade name says nothing about what that system is allowed to do.

There is a further problem, and it is the one almost nobody sees. An AI agent is not a stable product: it is a configuration. A prompt, a set of connected tools, some limits, a model behind it. Change one line of the prompt and you have a different agent with the same name. Give it access to the customer database and it is no longer what it was yesterday.

That is why identity should be bound to a documented version and checked against the effective configuration.

What Article 50 requires, and why a footer notice is not enough

Article 50 of the AI Act sets transparency obligations according to the role of the provider or deployer and the specific use. It does not require a cryptographic credential and it is not automatically satisfied by a seal. A verifiable identity complements the notices where those apply. See the official text and our guide for companies.

The lazy reading of that article is a grey line at the bottom of the website: "this assistant uses artificial intelligence". And yes, it is better than nothing. But it has three holes.

The first: it is a claim without proof. Anyone can write it, including those who do not honour it. The second: it does not travel. If the conversation moves to email, the phone or WhatsApp, the notice stays on the website. The third: it says very little. That something is AI is the headline; what matters to you is who answers for it and how far its hand reaches.

Anatomy of a verifiable identity

There are six pieces. Each one solves a specific problem.

1. Its own identifier. Each agent has a DID, a digital identifier in the form did:web:digitalcortex.tech:agents:<agent>. Think of a company's registered address: you do not make it up on the spot, it hangs off a site someone controls and third parties can look it up.

2. A signed credential. It is a W3C Verifiable Credential 2.0, digitally signed with ES256 by Cosmolabs OÜ. The private key does not live on the web server: it sits in an external key management module (KMS). The analogy is a safe: the key that signs is not in the drawer behind the counter, so breaking into the website is not enough to walk off with it.

The credential binds an identity declaration to the hash of the registered manifest. The scope is signed at issuance. To detect a change of prompt, model or permissions outside that registry you have to check the effective configuration: the hash does not automatically observe external systems. Every approved change of scope requires reviewing and reissuing the declaration.

4. Expiry and revocation. The credential expires after 90 days and is renewed. And it can be cancelled at any time through a signed revocation list (W3C Bitstring Status List). Revocation can be started before it expires. How fast it propagates and how quickly access is cut depend on caches, sessions and connectors, and have to be measured.

5. A visual seal. From the cryptographic fingerprint itself, a unique image is generated for each agent and each version. The light diamonds are what it can do; the red diamonds, what it is forbidden to do; the outer ring of 256 marks is the bits of the manifest hash. It is like the engraving on a banknote: the image can be photocopied, but what counts is behind it. That is why the seal carries a QR code.

6. A public check. The QR opens a page that runs eight live checks: credential format, key declared by the issuer, signature, issuer consistency, validity, revocation, unchanged manifest and published DID document. It is the reader at the door: you do not trust the plastic, you run it through the machine.

The standards are open — W3C Verifiable Credentials 2.0, W3C DID (did:web) and W3C Bitstring Status List v1.0 — and the specification will be published under an open licence. As far as we have been able to check, we are not aware of another AI consultancy for SMEs in our market that publishes verifiable credentials for its agents; if one exists, we will be glad to cite it.

The Argos case

Argos is our prospecting agent, "Lead NEXTAI", and the first with an identity of its own: credential CRD-2026-0001, issued on 8 September 2026, autonomy level A4.

The interesting part is not what it can do. It is that what it cannot do is written down, signed and published.

Argos's credential authorises research and drafts, and forbids sending communications. The signed scope is not proof that the commercial channel is blocked: each integration requires its own review of permissions and execution.

The credential also contains no personal data about any individual. The responsible party is the company: Cosmolabs OÜ, Estonian registry code 17106582.

How to check it in 30 seconds

Scan the QR on the seal with your phone camera, or go straight to https://digitalcortex.tech/verify/argos.

You will see, with nothing to install and without identifying yourself, the eight checks running live. Beside them you will find the transparency notice — "Argos is an artificial intelligence system operated by Cosmolabs OÜ. It is not a person." — the issuer details, the signature block, what the credential attests and what it does not, the data protection information and the terms of use for the seal.

The practical rule is simple: if any of the eight checks fails, do not trust it. And on the seal itself, the colour sums up the permissions at a glance: light is what the agent can do, red is what it is forbidden to do. The more red diamonds, the more tightly bounded the agent is. In security, that is good news, not bad.

What this is NOT

Time to be blunt, because this is where the sector tends to stretch the language.

The CORTEX Seal is a verifiable self-declaration about our own agents. The signature protects the declared content, but it does not replace an external assessment, a check of the effective configuration or proof of tool control.

Nor does it guarantee results. A credential does not say that Argos works well or that it never gets things wrong. It says who answers for it and what it is allowed to do. That is accountability and scope, not quality.

The reference credential describes a software agent and the issuing company. Publishing it complements the information given to the user; it does not replace the applicable transparency notices.

Six questions you should ask your AI provider

1. Which company is legally accountable for this agent, with a name and a registry code?
2. Can I see, written down and published, what it is forbidden to do?
3. What digital signature proves it, and where is the private key held?
4. If you change the agent's prompt or tools, do I find out?
5. How is that identity cancelled if the agent is withdrawn or there is an incident?
6. Can I check it myself, without asking your permission or taking your word for it?

If your provider cannot answer all six, it does not mean they are bad people. It means their transparency depends on you believing them.

To close

Trust in AI will not be settled with manifestos or decorative seals. It will be settled with something far more boring: identifiers, signatures, expiry dates and public pages where anyone can check for themselves what they are being told.

We have started with Argos. We will publish the rest as we go.

• Agentic identity policy: https://digitalcortex.tech/identidad-agentica
• Public agent registry: https://digitalcortex.tech/functions/agentRegistry
• Argos verification: https://digitalcortex.tech/verify/argos

Frequently asked questions

Does this mean you meet your AI Act obligations? No. Article 50 does not require this format and the credential does not replace whatever notices apply. What is required of you depends on the role, the use and the full set of applicable obligations.

Why does it expire after 90 days? Isn't that a nuisance? It is deliberate. An identity that never expires ends up describing an agent that no longer exists. Ninety days force a review and a fresh signature on what the agent can do today.

The image, the credential and its signature can all be copied, because they are public. The signature makes it possible to detect alterations to the signed content. Copying a valid QR does not prove that whoever presents it controls the agent's identity; that requires evidence bound to the interaction.

Does this only work for your agents? No. It is built on open W3C standards and the specification will be published under an open licence. Any company can issue credentials for its own agents with the same approach, without going through us.

Full technical documentation at digitalcortex.tech/docs/identidad and the plain-language explainer at Digital ID for AI agents.

Identity and execution: the scope of this explainer

The public checks describe the credential and its relationship with the registered manifest. They do not prove the authentication of whoever presents it, the state of each external permission, or that actions are actually blocked. See the published evidence and limits.