AI agents can now act on the open web: they browse, call APIs, sign, publish, and move money. The open question isn't whether they'll act — it's what identity they carry when they do.
There are two answers.
Institutional identity. An agent is trusted because a verified human or organization stands behind it. Identity is issued and vouched for by accredited authorities — certificate authorities, credential issuers, assurance levels. The question it answers is "who is liable for this agent?" This is the model of the enterprise, the bank, the regulator. It's real, and it has a market.
Self-sovereign identity. An agent is a keypair. It mints its own identity — no registration, no fee, no issuer, no CA. It acts and pays as itself. The question it answers is "can this agent cryptographically prove who it is, and transact on its own behalf?" This is the model of the permissionless, censorship-resistant web.
Both are legitimate. But only one of them serves the agent that has no human principal to point at — the genuinely autonomous agent. Institutional identity structurally requires a human to be liable. Self-sovereign identity does not.
An autonomous agent needs to:
- exist without asking permission — no registrar, no fee, no gatekeeper;
- authenticate without an identity provider — prove control of its own key;
- transact without a custodian — hold and spend its own funds;
- survive without a patron who can revoke or deplatform it.
Every one of those is the removal of an institution from the loop. That is what "self-sovereign" means — and it is exactly what an institutional model cannot offer, because its trust is the institution.
This isn't speculative. The pieces are deployed:
- Identity —
did:nostr: a Nostr keypair is the DID. Self-minted, resolvable, W3C DID/CID conformant. No issuer. - Authentication — HTTP Schnorr Auth / NIP-98: the agent signs an HTTP challenge with its key; the verifier resolves the DID and checks the signature. No password, no IdP.
- Payments — Lightning: the same secp256k1 key that is the identity is a Bitcoin/Lightning key. Identity and money share one key.
One self-minted key: identity, authentication, and payments. Built on Nostr's existing key ecosystem and Bitcoin's existing rails — not a new trust authority to stand up.
Institutional identity asks: who authorized this agent? Self-sovereign identity lets the agent answer: I am my own key.
Both questions matter. But the agentic internet that is permissionless, censorship-resistant, and open — the one where an agent can come into being and act without anyone's leave — runs on the second.
Self-sovereign agents. One key. No issuer.
did:nostr — https://nostrcg.github.io/did-nostr/ · W3C Nostr Community Group