Digital ID for AI agents
A Digital ID for AI agents is a cryptographically signed credential that identifies a software agent, states which company answers for it, what it is allowed and forbidden to do, expires, can be revoked and can be checked by anyone in seconds. At NEXTAI we issue it for our own agents with the CORTEX Seal.
Identifying, verifying and controlling are three steps
The Digital ID provides a checkable identity and scope. Controlling the action requires a further integration.
The credential does not by itself block an action. Blockchain is a line of development; it is not presented as a deployed feature or as regulatory approval.
This is not a decorative badge
( CORTEX Seal )The seal is served from Argos's credential and represents its declared data. The response may be cached. Open the verifier to check the status and its checks; this image does not authenticate whoever shares it.
- Light diamonds
- What the agent may do: its permitted scope.
- Red diamonds
- What it is forbidden to do, declared explicitly.
- Ring of 256 marks
- The bits of the manifest hash. If the manifest changes, the ring changes.
- Bottom bar
- The maximum autonomy level granted, from A0 to A4.
- Central QR code
- Opens the public verification of the credential.
The seal as served reflects the status of the credential subject to its refresh and cache. A copy can fall out of date. Revoking the identity does not by itself stop execution.
Who answers for what that agent does
( Three gaps )Once an AI agent starts writing, deciding or executing outside your company, the question stops being whether it works well and becomes who answers if it does not. A signed declaration lets you check the issuer and the scope; the controls in the tools have to demonstrate that the scope is enforced.
A logo is not an identity
A signed credential lets you check which issuer declares the agent's identity and scope. Authenticating the agent that sends a message also requires proof tied to that interaction: copying a seal or a link does not prove who sent it.
An agent is a configuration, not a stable product
The registered manifest describes one version of the agent and carries a signed fingerprint. Comparing it detects changes to that manifest; checking which configuration is actually loaded and what effective permissions its connectors hold requires additional controls.
Transparency in every interaction
Article 50 of the AI Act sets transparency obligations according to the role and the use of the system. A clear notice on first interaction, where applicable, and a verifiable credential are complementary measures. The regulation does not require this cryptographic «ID».
Seven fields, not one of them decorative
( Anatomy of the credential )The credential is a short, machine-readable document. Every field is there because somebody would have to ask about it before letting an agent act, and the analogy on the right is its long-standing paper equivalent.
| What it is | What it is for | Analogy |
|---|---|---|
| DID identifier | A stable, resolvable address for the agent: did:web:digitalcortex.tech:agents:<agent>. | The registered address |
| Name, function and maximum autonomy level | Which agent it is, what it is for and how far it can go without human intervention. | The professional licence |
| Permitted scope | The closed list of actions the agent may carry out within its process. | The list of permissions |
| Forbidden actions | What the agent may never do, declared explicitly and signed. | The list of exclusions |
| Manifest fingerprint | SHA-256 hash of the registered manifest. The signed scope and the effective permissions of the connectors must be checked separately. | The numbered seal |
| Accountable party | The company that answers for it: Cosmolabs OÜ, registry code 17106582, legal@digitalcortex.tech. No individuals. | The company behind it |
| Validity and status | Ninety renewable days and a public status: active, expired or revoked. | The bank card |
How far it goes on its own
( From A0 to A5 )The credential does not say “it is autonomous” or “it is safe”: it states a level. Each step adds one specific capability, and the ceiling is declared before the agent is switched on, not after the first incident.
Observe
Read, search, gather, measure.
Analyse
Classify, summarise, estimate risk.
Prepare
Drafts, proposals, plans.
Execute internally
Reversible internal changes.
Execute with approval
Persistent or external action only with valid human approval.
Prohibited
Not a reachable level: autonomous money movement, deleting audit trails, privilege escalation.
A0–A5 is our internal scale, not a legal standard. A4 requires approval for actions that fall within the authorised scope; an approval does not enable an action that is expressly forbidden. The connector that carries out each action has to enforce those limits.
Six steps, in this order
( Issuance and lifecycle )Order matters here: you cannot sign what has not been declared, or verify what has not been published. It is a real sequence, not a feature list.
- 01
Manifest
The agent's manifest and its SHA-256 hash are registered. The credential also signs the declared scope and prohibitions; those pieces are reviewed alongside the effective permissions.
- 02
Signature
A W3C Verifiable Credentials 2.0 credential is issued in vc+jwt format, signed with ES256. The private key lives in Google Cloud KMS, never on the web server.
- 03
Publication
The agent's DID, the issuer's DID document at /.well-known/did.json, the public agent registry and the status list are all published.
- 04
Seal
A deterministic image is generated from the hash and the DID, with a QR code that leads to the verification page. The same credential always produces the same seal.
- 05
Public verification
Anyone can run the eight checks: format, issuer key, signature, issuer consistency, validity, revocation, unchanged manifest and DID document.
- 06
Lifecycle
Validity of up to ninety days, reissue after approved changes and revocation through a Bitstring Status List. Propagation depends on caches and on when each integration checks.
Thirty seconds, no permission needed
( Public verification )You do not have to take our word for it. Verification is open, requires no sign-up and runs against the signed credential, not against whatever this page says.
- 01
Scan or open
Scan the QR code on the seal or go straight to digitalcortex.tech/verify/argos.
- 02
Read the eight checks
You will see all eight in green or red, plus the transparency notice: this is an AI system operated by Cosmolabs OÜ, not a person.
- 03
Apply the rule
If a single one fails, do not trust it. There is no half verification: a credential that has expired, been revoked or whose manifest has been altered is a credential that does not count.
A real agent, with a real credential
( CRD-2026-0001 )Argos is our prospecting agent. It holds a public credential declaring its identity, scope and prohibitions. Verifying that declaration and controlling its tools are two separate layers.
- Agent
- Argos — “Lead NEXTAI” prospecting
- Credential
- CRD-2026-0001
- Issued
- 8 September 2026
- Maximum level
- A4 — execute with approval
- Declared risk
- Low
Authorised scope
- Scout and qualify leads
- Research companies and public contacts
- Draft outreach messages
- Produce status reports
Signed prohibitions
- Send communications (outreach.send)
- Make payments
- Sign contracts
- Delete data
- Modify other agents
Argos drafts; its credential forbids sending.
A4 is a ceiling on autonomy: it does not override the prohibitions. Any sending has to be carried out by a person or another system with its own authorisation. Reference record checked on 17 September 2026; check the current status in the verifier.
Public evidence · reviewed on 17 September 2026
Trust starts with being able to check
A Digital ID ties together an identity, an accountable party and a signed authorisation. To control what the agent executes, that authorisation also has to be enforced in the tools, with limits, logs and a procedure for withdrawing access.
Identity and signature
Check Argos's issuer, validity period and registered manifest.
Open the verifier ↗Specific permissions
The reference credential allows preparing drafts and forbids outreach.send. Check the result for that action.
Query a forbidden action ↗Public documentation
Review the format, the agent registry, revocation and the limitations of the system.
Read the documentation ↗These queries check the credential and its declared scope. They are not proof of enforcement across every connector, nor authentication of whoever holds the QR code, nor an external audit. The status can change and responses may be cached.
Download the 10 checks for assessing an agentContext · September 2026
From fear of AI to questions a company can actually answer
Incidents and investigations involving agents make it reasonable to ask for more visibility. The business answer starts with four questions: who answers for it, which actions are authorised, how they are checked and how access is withdrawn.
- OpenAI, 16 September 2026: a framework for documenting misaligned behaviour. The cases described do not on their own represent an incident rate across all AI.
- METR, 26 August 2026: an investigation into an incident involving an agent. It reinforces the need for limits and operational evidence.
- EFE / AEPD, 15 September 2026: the Spanish data protection authority. The debate on autonomy calls for separating how systems behave from attributing intent to them.
The Digital ID provides identity and traceability of the authorisation. How useful it is against incidents depends on the controls around it. It does not guarantee that a model will not fail, and it does not on its own solve the safety of a physical robot.
Read the analysis and its sources →OpenAI agents: facts, limits and lessons for your company →What this credential does not solve
( Its limits, stated )A trust mechanism that promises more than it delivers stops being a trust mechanism. These are its limits, stated before someone else finds them.
It is not an external audit
It is a verifiable self-declaration: we state what the agent does and sign that statement so nobody can change it unnoticed. Whoever checks it verifies the signature, not our judgement.
It does not guarantee results or quality
An agent with a valid credential can still get things wrong. The signature evidences the origin and integrity of a declaration of identity and scope; it does not prove that every limit is enforced at run time.
It does not identify people
There is no individual inside the credential. It identifies an AI system operated by a company, with its registry code and its legal contact.
The credential does not block tools or stop sessions by itself. To limit an action you have to apply permissions in each connector; to stop an agent you have to withdraw access, cancel jobs and confirm the cut-off. Revocation communicates that its credential should no longer be accepted.
What is coming, stated in the future tense
( Roadmap )The roadmap includes exploring the anchoring of issuances and revocations on Base, using EAS and ERC-8004. NEXTAI will anchor them in the coming weeks; this layer is not presented as deployed. Before presenting it as live we will publish addresses, transactions, the specification and verifiable proofs.
Anchoring can provide evidence of timing and make the history harder to alter. It does not prove that the declaration is true, that the permissions are enforced or that the agent is safe.
Further reading
AI agent identity and blockchain: what it adds and what it does notFor executives, operations and technology leads
Does your company know who authorises each agent?
If you already run agents in sales, customer service or internal processes, the next step is to inventory them and check their access. At NEXTAI we work with you on a review of identity, permissions and traceability tailored to your systems.
01 · Inventory
Agents, owners, tools and actions with real impact.
02 · Evidence
Declared permissions against effective permissions, notices and the logs available.
03 · Improvement plan
Priorities for verifiable identity, approval, revocation and connector testing.
We first agree the case, the deliverables and the budget. The review is not a security accreditation or a statement of conformity with the AI Act.
Agentic identity, in depth
( Editorial cluster )This page is the summary. The cluster develops each piece: standards, revocation, agent governance and what anchoring identity on a public chain adds — and what it does not.
What we always get asked
( Eight answers )What is a Digital ID for AI agents?
It is a cryptographically signed credential that identifies a software agent and states which company answers for it, what it is allowed to do and what it is forbidden to do. It expires, it can be revoked and anyone can check it in seconds from a public page. At NEXTAI we issue it for our own agents with the CORTEX Seal.
Does this mean you meet the AI Act?
No. The credential provides a verifiable declaration of identity and scope. Article 50 does not require this technology and is not automatically satisfied by a QR code: the role of provider or deployer, the use and the applicable notices all have to be assessed.
Can the seal be copied?
Yes: the image, the credential and its signature are all public and can be copied. What the signature allows you to detect is alteration of the signed content. A QR code that opens a valid credential does not on its own authenticate the sender or prove that they control the agent's identity.
Why does it expire after 90 days?
Expiry limits how long we accept a declaration without renewing it. The credential is public: copying it is not the same as leaking a private key. Renewal has to re-check the manifest, the scope and the authorisation in force.
What happens if you change the agent's prompt?
If the registered manifest changes, its hash can be compared against the one in the credential. Changing a prompt loaded in another system, the model or external permissions is not automatically detected by that hash. The effective configuration has to be verified and the credential reissued after approved changes.
Does it contain personal data?
No. The credential identifies a software agent and the company accountable for it, with its registry number and a legal contact address. It includes no names, job titles or data about individuals.
Does it only work for your own agents?
Today we issue for our own agents. The public documentation describes the use of DID identifiers, Verifiable Credentials 2.0 and W3C status lists. Interoperability and any software licence should be checked against the documentation and the artefacts actually published.
How is it different from a login or an API key?
A login and an API key exist so a system lets you in: they are secrets shared with one specific counterparty. The Digital ID is public and is not a secret: anyone can check it without prior permission, and it also declares scope, limits, accountable party and validity, which is exactly what a key does not say.
For journalists
Cosmin Popescu, CEO of NEXTAI. Available to explain the mechanism, its limits and why we publish it openly.
hola@nextai.pro
Cosmolabs OÜ · Tallinn, Estonia
Ready to apply this to your business?
Eva helps you choose. Our team scopes your project.