Organizations | Identosphere Blogcatcher

We are thrilled to announce the official release of Overlays Capture Architecture (OCA) 2.0.0, marking a significant milestone in our journey toward a dynamic, interoperable, and verifiable data economy. This release is the culmination of extensive community feedback and testing of new paradigms in semantic flexibility.

Version 2.0.0 is not just an update; it is a fundamental leap forward. It transforms OCA into a more modular, extensible, and community-centric architecture, empowering non-technical users and entire ecosystems to define, share, and validate data structures with unprecedented ease and cryptographic integrity.

What’s New in OCA 2.0.0?

The core theme of this release is semantic flexibility, achieved through a host of new features and improvements designed for real-world application across science, compliance, supply chain, and beyond.

Introducing OCAFILE, OVERLAYFILE and Community Overlays

The centerpiece of OCA 2.0 is the introduction of Community Overlays, empowering any group—from a research consortium to a regulatory body—to create and govern their own overlay definitions without deep technical barriers. This is made possible through a two-layered DSL approach. OCAFile serves as the Domain-Specific Language (DSL) for creating individual overlays, while OVERLAYFILE is the higher-level DSL that defines the types of overlays a community can use, enabling the creation of reusable overlay definitions in .overlayfile documents. If you are familiar with programming, think of .overlayfile as a header (.h) file that declares the structure and meaning of your data. For non-technical users, it represents the exact, validated structure that a team, department, or entire community has approved for use. By separating overlay definitions from their usage, this dual-layer approach enables clear governance, cryptographic assurance of validation, and seamless reusability across projects.

OCA Bundle as single object

We are replacing the legacy `.zip` format with a new, streamlined JSON-based OCA Bundle. This simplification makes it easier to transmit, parse, and integrate OCA bundles within tooling and applications, a change that has been battle-tested in our reference implementation.

Enhanced Modularity and Validation

Overlays can now define their own schemas, enabling robust tooling validation against community-defined rules. This drastically reduces errors and increases trust in the data structures being used.

Major Specification Upgrades

The OCA Specification v2.0.0 introduces several key enhancements:

- Sensitive Overlay: Replaces the old PII flagging in the Capture Base, offering a more nuanced and powerful approach to managing privacy and risk flags directly in the schema.

- Separation of Concerns: Categories have moved from the Label overlay to the Presentation layer, strictly enforcing the distinction between a data's inner structure and its visual presentation.

- Community-Nominated Overlays: Several previously “core” overlays are now upgraded to first-class Community Overlays, fostering a repository-driven ecosystem for sharing:

- Information
- Transformation
- Presentation
- Layout
- Conditional
- Unit Mapping

- SemVer for All Objects: All OCA objects now support Semantic Versioning (SemVer), enabling better lifecycle management.

- Enhanced Language Support: Added support for ISO 639-1 and 639-3 language codes.

- Namespacing: Introduced support for namespacing in overlay names, allowing for better organization and preventing collisions.

Get Started with OCA 2.0.0

The official OCA Specification v2.0.0 is now released and ready for adoption. The reference implementation, `oca-rs`, has been updated to support all new features and is the best place to see the architecture in action.

- Read the Specification: https://oca.colossi.network/specification/

- Explore the Reference Implementation: https://github.com/THCLab/oca-sdk-rs

- Browse and Build Community Overlays: https://oca.colossi.network/ecosystem/overlay-registry.html

Join the Movement

This release is the result of the hard work and vision of the Human Colossus Foundation’s Technology Council and the broader OCA community. We invite developers, data architects, and organizations to explore OCA 2.0.0 and contribute to this open, extensible semantic ecosystem.

Let’s build a more interoperable and trustworthy data future together.

Nor can CRM. Not really. The middle name of both is Relationship, and those require respect for each other’s boundaries. We don’t have that yet online, and can’t without working standards (hello MyTerms), tech, and norms. In fact, the opposite prevails: extreme exploitation of absent personal privacy.

Helen Nissenbaum has been teaching us that for decades, and working on solutions. One is Adnauseum, which may be on your browser already.  It works (says that last link) “by automating ad clicks universally and blindly on behalf of its users. Built atop uBlock Origin, AdNauseam quietly clicks on every blocked ad, registering a visit on ad networks’ databases. As the collected data gathered shows an omnivorous click-stream, user tracking, targeting and surveillance become futile.” In another word, obfuscation.

And that’s what Helen will unpack when she speaks in our salon series here at Indiana University next Tuesday at 4 pm Eastern, and on Zoom. Her title is Why Obfuscation is (still) Needed (more than ever). Here’s the flyer, with the registration and Zoom links:

And in case you don’t click on that, here it is again.

See you there.

Edge Expands EdgeMarket with Mark43’s Public Safety Platform, Bringing Modern Campus Safety Technology to Higher Education Nationwide

NEWARK, NEW JERSEY, March 25, 2026 – Edge, the nation’s leading member-owned nonprofit technology consortium, today announced the addition of Mark43 to its EdgeMarket cooperative purchasing platform. Mark43’s cloud-native public safety operations platform —encompassing computer-aided dispatch (CAD), records management system (RMS), OnScene (mobile field application), and Insights (advanced analytics)— is trusted by more than 300 agencies across the United States and United Kingdom. Through EdgeMarket, Edge member institutions can now access Mark43’s technology through a streamlined procurement process that eliminates the complexity and cost barriers traditionally associated with public safety technology upgrades.

Founded approximately 13 years ago by three Harvard undergraduates, Mark43 was built on the premise that public safety professionals deserve the same modern, interoperable, cloud-native technology available in other sectors. Hosted on AWS GovCloud, the platform is the only FedRAMP High authorized CAD and RMS solution on the market and upholds a comprehensive portfolio of cybersecurity certifications including SOC 2 Type II, CJIS compliance, GovRAMP High Authorization, ISO 27001, and Cyber Essentials Plus, making it particularly well-suited for higher education and K-12 institutions handling sensitive data.

"Joining EdgeMarket is an important milestone for Mark43 as we continue to expand our reach to campus safety programs across the country, particularly in New Jersey and New York. Our mission is to give every campus the same modern, mission-critical technology that the largest public safety agencies rely on,and partnerships like this one make that possible. By combining Mark43’s industry leading public safety platform with Edge’s streamlined procurement model and ecosystem, we’re enabling institutions to move faster, strengthen collaboration with local agencies, and better protect their students, faculty and staff"

– Tim Merrigan
Chief Customer Officer
Mark43

Campus safety teams face many of the same challenges as municipalities, from drug activity and assault to the risk of targeted violence,often with fewer resources and outdated technology. Mark43’s platform enables campus police to move beyond paper-based workflows into a fully modern, mobile-capable environment. With precise sub-premise dispatching capabilities, responders can be directed to a specific room or floor within a building, improving response times across complex campus environments. The Mark43 OnScene mobile app provides full access to dispatch, records, and incident data from the palm of officers’ hands so they can stay out in the field, reducing time spent at headquarters behind a desk.  Because the platform is cloud-native, agencies can also collaborate more effectively with local law enforcement, sharing information in real time during critical events. Importantly, the platform can scale to meet shifting needs,  an important advantage during high-density events like graduation ceremonies and football games, enabling seamless coordination with partner agencies when it matters most.

“Modernizing public safety technology is a priority for campuses across our network. Mark43’s proven platform, delivery, and commitment to mission-driven service make them an outstanding addition to EdgeMarket, and we look forward to helping our member institutions access this technology more easily.”

– Dan Miller
Assistant Vice President, EdgeMarket and Solution Strategy
Edge

Mark43 also simplifies Clery Act compliance by enabling campus police to collect, analyze, and report crime statistics through built-in analytics tools,reducing administrative burden while improving transparency with campus communities and regulatory bodies. Mark43’s AI-powered tools including ReportAI and BriefAI help officers complete incident reports more efficiently while keeping the human or officer  in the loop on all outputs. Nearly thirty percent of Mark43’s  employees are former law enforcement, first responders and veterans, a staffing philosophy that shapes how the company supports each customer’s mission, through implementation and beyond.

The EdgeMarket cooperative purchasing model eliminates the need for individual institutions to conduct their own lengthy RFP processes, enabling campus safety directors and CIOs to move more quickly from evaluation to implementation. Edge’s high-performance fiber network — with a direct connection into AWS, built-in cybersecurity protections, and a 100% uptime record — provides the reliable infrastructure that mission-critical public safety systems require. 

About Mark43

Mark43 brings modern technology to enhance public safety, making state, local, and federal agencies faster, smarter, and their communities safer. Its integrated Records Management System, Computer-Aided Dispatch, and Data Analytics form the backbone of a unified, real-time public safety operating platform to streamline workflows, improve response times, and foster collaboration. Trusted by over 300 agencies, Mark43 increases effectiveness and efficiency amid rising demands and limited resources. By supporting first responders with innovative tools, AI technology, and a strong cybersecurity foundation, Mark43 equips public safety agencies to address the challenges of today and tomorrow. For more information, visit www.mark43.com.

 

About Edge

Edge serves as a member-owned, nonprofit provider of high-performance optical fiber networking and internetworking, Internet2, and a vast array of best-in-class technology solutions for cybersecurity, educational technologies, cloud computing, and professional managed services. Edge provides these solutions to colleges and universities, K-12 school districts, government entities, hospital networks, and nonprofit business entities as part of a membership-based consortium spanning across the nation. 

The post Edge Expands EdgeMarket with Mark43’s Public Safety Platform, Bringing Modern Campus Safety Technology to Higher Education Nationwide appeared first on Edge, the Nation's Nonprofit Technology Consortium.

Kantara Initiative to collaborate on role of Authorized Auditor 

The OpenID Foundation is pleased to announce that the Kantara Initiative – a global community focused on improving the trustworthy use of identity and personal data – has signed a Memorandum of Understanding to become an Authorized Auditor under the Foundation’s independent conformance testing program. 

This latest news builds on last week’s announcement which highlighted the first cohort to sign an MOU with the OpenID Foundation, committing to collaborate as Testing Service Providers in the forthcoming independent conformance test program – BixeLab, FIDO Alliance, Inc., Fime, Raidiam and TrustID Solutions. 

Authorized Auditors assess organisations applying to become Approved Testing Service Providers – independent entities responsible for conducting conformance testing against the OpenID Foundation’s specifications. By signing the MOU, the Kantara Initiative is signalling its commitment to scaling conformance testing in a way that aligns with its mission and vision as a non-profit, and the needs of its community.

Eve Maler, Kantara Initiative Board Member, said: “I work closely with both Kantara Initiative and the OpenID Foundation. Kantara’s deep expertise in measuring assurance in identity and authentication complements the Foundation’s deep expertise in providing effective tools to implementers for self-assessing conformance. I’m excited that these organizations will collaborate in scaling trustworthy identity systems.”

This formalises a collaboration between two peer non-profit organisations with complementary expertise in identity standards and trust frameworks. The Kantara Initiative’s members span organizations across multiple sectors and geographies, bringing the breadth of experience and deep expertise in trust frameworks, assurance programs, and identity governance that the Authorized Auditor role demands.

Independent oversight at the heart of the program

The responsibilities of an Authorized Auditor include:

Conducting the necessary due diligence to establish that a Testing Service Applicant is legitimate Conducting structured assessments using documented assessment plans and checklists aligned with the OpenID Foundation’s Requirements and Testing Service Assessment Criteria. Supporting a growing ecosystem

The OpenID Foundation and the Kantara Initiative will continue to work together to enhance delivery of the Foundation’s Conformity Assessment Tool, supporting implementers that need evidence of conformance with OpenID Foundation specifications and standards. As the program grows, the partnership provides the independent infrastructure needed to maintain its integrity and consistency.

Gail Hodges, Executive Director of the OpenID Foundation, said: “As the conformance testing program grows, independent oversight will play a vital role. The Kantara Initiative shares our commitment to trustworthy digital identity, and this collaboration strengthens the foundation on which the whole ecosystem depends.”

About the OpenID Foundation

The OpenID Foundation (OIDF) is a global open standards body committed to helping people assert their identity wherever they choose. Founded in 2007, we are a community of technical experts leading the creation of open identity standards that are secure, interoperable, and privacy preserving. The Foundation’s OpenID Connect standard is now used by billions of people across millions of applications. In the last five years, OAuth2 – the FAPI standard for interoperable, high security – has become the standard of choice for Open Banking and Open Data implementations, allowing people to access and share data across entities. Today, the OpenID Foundation’s standards are the connective tissue that enable people to assert their identity and access their data at scale, the scale of the internet, enabling “networks of networks” to interoperate globally. Individuals, companies, governments and non-profits are encouraged to join or participate. Find out more at openid.net.

To learn more about conformance testing and self-certification, please visit the OpenID Foundation’s FAQ section.

About Kantara Initiative

Kantara Initiative is a global community focused on improving the trustworthy use of identity and personal data. Its many and varied Work Groups nurture thought leadership and develop specifications that inform policy and standards across the identity ecosystem. Topics range from AI and Deepfakes to Privacy-Enhancing Mobile Credentials (PEMC), Shadow AI, Biometrics, and Trusted Transaction Assurance.

In addition to its work in the United Kingdom as an ISO 17065 Accredited Certification Body for the UK DIATF,, Kantara conducts conformity assessments and grants Trustmarks for the National Institute of Standards and Technology (NIST) SP 800-63 Digital Identity Guidelines. To learn more, view their website at https://kantarainitiative.org. 

The post OIDF sets the stage for independent oversight of conformance testing first appeared on OpenID Foundation.

Vivian, a university student in Hebei province, loves her Rokid AI glasses. When she heads out on a scooter, she puts them on for navigation. When she shops for clothes,...

How can civil society safely and ethically adopt AI?That’s the question many organizations are asking as artificial intelligence tools become more accessible and increasingly incorporated into internal workflows.

The post Using AI safely: practical strategies for CSOs and nonprofits from a Global Majority perspective appeared first on The Engine Room.

The OpenID Foundation membership has approved the following as an OpenID Final Specification:

OpenID Connect Relying Party Metadata Choices 1.0: https://openid.net/specs/openid-connect-rp-metadata-choices-1_0-final.html

A Final Specification provides intellectual property protections to implementers of the specification and is not subject to further revision. This Final Specification is the product of the OpenID Connect Working Group.

The voting results were:

Approve – 87 votes Object — 0 votes

Abstain – 17 votes

Total votes: 104 (out of 450 members = 23.1% > 20% quorum requirement)

 

Marie Jordan – OpenID Foundation Secretary

 

About The OpenID Foundation (OIDF)

The OpenID Foundation (OIDF) is a global open standards body committed to helping people assert their identity wherever they choose. Founded in 2007, we are a community of technical experts leading the creation of open identity standards that are secure, interoperable, and privacy preserving. The Foundation’s OpenID Connect standard is now used by billions of people across millions of applications. In the last five years, the Financial Grade API has become the standard of choice for Open Banking and Open Data implementations, allowing people to access and share data across entities. Today, the OpenID Foundation’s standards are the connective tissue to enable people to assert their identity and access their data at scale, the scale of the internet, enabling “networks of networks” to interoperate globally. Individuals, companies, governments and non-profits are encouraged to join or participate. Find out more at openid.net.

The post OpenID Connect Relying Party Metadata Choices 1.0 Final Specification Approved first appeared on OpenID Foundation.

Attacks from Iran have slowed business activity in Dubai, but the expat tech community in the city remains resilient. Over the past month, the United Arab Emirates has been the...

After days of deliberation, a jury in a Los Angeles court on Wednesday said that Meta and YouTube were negligent in a landmark trial where a 20-year-old woman said that...

Trust over IP (ToIP), a project of Linux Foundation Decentralized Trust, has reached an important milestone in advancing interoperable digital infrastructure: the formal registration of the urn:said namespace by the Internet Assigned Numbers Authority (IANA). This achievement reflects collaborative work by ToIP members and submission authors Wenjing Chu, Sam Smith, and Carly Huitema and represents a meaningful step in aligning emerging cryptographic identifier models with established global standards.

Mar 25, 2026 — The Decentralized Identity Foundation (DIF) welcomes Aven Hospitality as an Associate Member.

Aven provides the largest native hospitality transaction platform in the industry. Through their SynXis platform, Aven connects more than 35,000 hotels across 190+ countries with 600+ integrations, supporting both chains and independent properties. Providing travelers control over their data and personal preferences is foundational to delivering more personalized travel and hospitality experiences. As a member of DIF’s Hospitality & Travel Working Group, Aven will actively contribute to advancing decentralized identity in the travel and hospitality sector. Trust and interoperability are key to enabling seamless travel experiences. Aven is committed to supporting trustworthy, standards-based interactions for both people and AI agents across the travel and hospitality industry.

The appeal for decentralized identity to a hotel platform might seem counterintuitive, especially as many industries focus on “owning the customer”. However, Aven’s perspective is that customers are becoming more discerning about where they place their trust. Today, payments and discovery/recommendation platforms are increasingly commoditizing and disintermediating the guest relationship, undermining traditional patterns of earned customer loyalty, personalization, and trust. Agentic commerce threatens to worsen this dynamic, if the same platforms commoditizing hospitality become further entrenched by agentic capabilities along similar lines.

“At Aven Hospitality, we believe trusted, interoperable data exchange is key to the future of hospitality—enabling personalized, seamless, and privacy-preserving guest experiences through the secure sharing of verified information. Through DIF’s Hospitality & Travel Working Group, we are helping shape standards, schemas, and processes for secure, self-sovereign identity across the industry” said Amy Read, Vice President of Innovation at Aven Hospitality.

DIF’s Travel & Hospitality Working Group has developed schemas for a variety of use cases, and Aven’s participation represents an important sector of the hospitality industry, which is particularly concerned with privacy and respect for travelers.

“Hotels and resorts hold some of people’s most personal data about their leisure preferences, service requirements and sometimes even health concerns, said Grace Rachmany, Executive Director of DIF. “Everyone knows how complicated it is to get just the right hotel or flight or meal, and as we delegate this information to Agents, we need to carefully consider the standards we use for managing trust. Aven is a clear example of a company that puts service to their customers before everything else–their contribution to our working groups will be invaluable as we navigate these new technologies.”

Aven Hospitality’s involvement strengthens industry collaboration around decentralized identity use cases that can improve how traveler, service, and intermediary data is exchanged securely across the ecosystem.

To get involved with these user stories, DIF members can join the Hospitality & Travel Working Group for technical and semantic design and the Trusted AI Agents Working Group to develop standards and implementations for authorization and security in agentic systems. Both members and non-members can attend the Hospitality & Travel Special Interest Group for open discussions and presentations on industry trends. 

For more information about DIF and its working groups,
visit identity.foundation

Learn More

If you would like to get in touch with us or become a member of the DIF community, please visit our website.

Can't get enough of DIF?
| Follow us on Twitter
| Join us on GitHub
| Subscribe on YouTube
| Read our DIF blog
| Read the archives

The biggest obstacle to electric-vehicle charging infrastructure is turning out to be the neighbors. Communities across dozens of countries are fighting EV charging station installations, citing fire hazards, ugly design,...

What happens when a single digit in your product data is wrong?

In this episode of Next Level Supply Chain, Steve Madsen, Founder and CEO of RxERP, joins hosts Reid Jackson and Liz Sertl to explore the critical role of master data in pharmaceutical logistics. When product information like GTINs, NDCs, and trading partner data don't align, entire warehouse operations can grind to a halt.

Steve shares how his team experienced these challenges firsthand and how that led them to build a new approach to serialized inventory management and automated master data.

You'll learn how trusted data sources, automation, and GS1 standards help supply chains move faster, stay compliant with DSCSA, and reduce costly human errors.

In this episode, you'll learn:

Why small data errors can disrupt supply chains

How automation reduces human error in master data management

Why trusted data sources are essential for DSCSA compliance

Things to listen for: (00:00) Introducing Next Level Supply Chain (01:20) Steve's journey in building a pharmaceutical ERP platform (05:29) Why serialization matters (14:17) The benefits of automating master data management (16:54) Connecting master data to DSCSA compliance (30:03) Steve's favorite technology Connect with GS1 US: Our website - www.gs1us.orgGS1 US on LinkedIn Register now for this year's GS1 Connect and get an early bird discount of 10% when you register by March 31 at connect.gs1us.org.

Connect with the guest: Steve Madsen on LinkedIn Visit RxERP at https://rxerp.com/

We're excited to welcome Instituto Lamparina to our Matchbox Program this year. Based in Brazil, Lamparina is building narrative power to strengthen democracy through a gender, racial, and climate justice lens, and we're thrilled to collaborate with them over the coming months.

The post Building responsible technology and data practices with narrative change in Brazil appeared first on The Engine Room.

The AuthZEN Working Group shares highlights from Gartner IAM London, including what practitioners’ questions revealed about enterprise readiness.

Gartner IAM London in earlier this month brought together enterprise IAM practitioners, analysts, and standards bodies. For the OpenID Foundation’s AuthZEN Working Group, it was a revealing few days. Co-chairs Atul Tulshibagwale, Alex Olivier, and David Brossard attended and participated in two sessions, each of which drew strong audiences and pointed to the same conclusion…authorization is firmly on the enterprise agenda.

The first session, delivered by Atul Tulshibagwale alongside Gartner analyst Erik Wahlström, examined how identity standards help enterprises build future proof IAM architectures. The conversation reinforced a theme that echoed throughout the event. Standards are no longer a nice-to-have. They are the connective tissue that holds an identity fabric together.

The second session, delivered by Alex Olivier (read more from Alex here) and David Brossard (read more from David here) alongside Gartner analyst Homan Farahmand, put AuthZEN front and centre. The working group gave an update on the specification and a demonstration of the latest interoperability results. What struck the team most was the change in the room. A year ago, the questions were “what is this?” This time, they were “how do I implement this?” It is a meaningful change. Practitioners are no longer weighing up whether AuthZEN is worth attention. They are working out how to put it into production.

The standard’s presence at the event went beyond those two sessions. Three independent Gartner analysts, across three separate sessions, referenced AuthZEN unprompted. This is a clear sign that the analyst community sees AuthZEN as a standard worth watching.

The conversations around authorization also reflected a broader urgency. Attendees were asking questions along the lines of: “How do we do authorization for agents when we haven’t even finished doing it properly for humans?” It captures a tension that many enterprise teams will recognise. This is why externalized, standardized authorization is not just good practice.

AuthZEN Working Group Co-Chair David Brossard said: “The conversations at Gartner IAM London confirmed what we have been seeing for some time. Enterprises are ready to move on authorization, and AuthZEN gives them the standard to do it on.”

About the OpenID Foundation

The OpenID Foundation (OIDF) is a global open standards body committed to helping people assert their identity wherever they choose. Founded in 2007, we are a community of technical experts leading the creation of open identity standards that are secure, interoperable, and privacy preserving. The Foundation’s OpenID Connect standard is now used by billions of people across millions of applications. In the last five years, OAuth2 – the FAPI standard for interoperable, high security – has become the standard of choice for Open Banking and Open Data implementations, allowing people to access and share data across entities. Today, the OpenID Foundation’s standards are the connective tissue that enable people to assert their identity and access their data at scale, the scale of the internet, enabling “networks of networks” to interoperate globally. Individuals, companies, governments and non-profits are encouraged to join or participate. Find out more at openid.net.

To learn more about conformance testing and self-certification, please visit the OpenID Foundation’s FAQ section.

 

The post AuthZEN: From ‘what is this’ to ‘how do we implement it’ first appeared on OpenID Foundation.

Adoption of artificial intelligence is on the rise worldwide, but the pace is uneven. As the global economy shifts increasingly toward AI-driven production and processes, wealthier nations are reaping the...

Publication Notice: SP 800-63A-4 Service Assessment Criteria (SAC) Kantara Initiative announces the formal publication of the Kantara Initiative International Assurance Program: SP 800-63A-4 Service Assessment Criteria (SAC) & Statement of […]

The post Publication Notice: SP 800-63A-4 Service Assessment Criteria (SAC)  appeared first on Kantara Initiative.

Watching the old galaxy fade away.

In the dawning decades of our new Digital Age, the news business has shrunk from a galaxy of bright stars to a loose collection of white dwarfs glowing in otherwise dark empty spaces. The empty spaces are called  “news deserts.”

In the meantime (at least in the US), the redstream is the new mainstream, while more and more people get news (or what passes for it) from social media and each other. Countless sources are also faked up by AI.

Less metaphorically, the news business has de-institutionalized. How can we re-institutionalize it in digital ways that can also be trusted?

I suggest we start by spinning up News Commons that work with the fewest possible intermediaries between people and sources, and value exchanges that reward everyone.

Some background:::

1) The Dying Galaxy

Here’s how bright stars have turned into white dwarfs:

Stopped Presses: There are now fewer than 1,000 daily newspapers left in the U.S. Over 50 million Americans now live in news deserts. Radio Silence: CBS News Radio—the oldest and most august of all the syndcated broadcast news sources— will be gone in May 2026 after a 99-year run. Meanwhile, Public Radio (NPR et al.) faces a “shrinking pie” problem: ratings (dig around here) remain steady or are growing only because stations hold larger shares of a rapidly dwindling over-the-air audience. Cut Cables: Cord-cutting continues, as viewing moves from cable to Internet, and from live to on-demand streamed entertainment. In the midst of this shift, cable news is morphing from mainstream to redstream. Specifically, CNN is moving rightward under the Ellisons, while Fox News stays as right as they were, and MSNBC under its new MS NOW brand continues to glow dimly at the left end of the ratings. None come close in popularity to any of the top news commentary podcasts. Anyway, cable news is transitioning from a collection of leanings (center, left, and right) to highly partisan amen corners with shrinking audiences. Thinning Air: Over-the-air TV (what we still call stations, with channel numbers) is now called “linear,” whether it’s from a connected antenna or from a cable screwed into the same jack on the back of a TV. That category is also in decline, a victim of the same viewing shift to streaming services (now less often called over-the-top, or OTT, now that the bottom—linear TV—is fading away). Babes in New Woods: News is still being consumed, though it’s hardly hard  news or from the media we knew when all the stars were bright and mostly trusted. Especially for young people. Lots of stats at both those links. The bottom line is that none of that flow is from the old stars. At least not directly.

Nearly all coverage of changes in the dimming news galaxy concerns one or more of the five factors listed above. Some of that coverage (most notably from the Nieman Journalism Lab) is about innovations. To mix metaphors a bit, while some of these innovations look like greenfields, none of them look very large. (More credit where due: At least these efforts, as the Quakers say, improve on the silence.)

2) MyTerms (IEEE 7012) and the Agentic Shift

Today, the news world is mostly hidden behind permission walls. Inside those walls, absent personal privacy is exploited to extremes almost nobody will contemplate or admit to.  (Here’s a PageXray of Wired.com—one of the “good” guys.) For a fig leaf over the hard-ons walled garden barons have for personal data, visitors knocking on front doors must yield to demands in the form of misleading cookie notices and in crap like this:

Go to www.cnn.com/privacy, as the notice suggests (or just click on that image), and you will find your privacy well and truly fucked.

The ProjectVRM community has written a lot about this over many years. But now, thanks to our work with Customer Commons since 2012 and the IEEE since 2017, we have IEEE 7012 (MyTerms): a standard that flips the script on privacy-as-bullshit by giving individuals a way to proffer their own damn privacy terms as binding contracts, with agents working for both parties. Specifics:

Personal AI Agents: Under MyTerms, individuals operate through agents that can range in complexity from browser plug-ins to private AI agents. These agents have a sole responsibility to the person, proffering and signing agreements, and keeping auditable records of them. Reciprocal Agency: On the other side, news providers use their own agents tto choose from the person’s roster of privacy agreement choices (on the Creative Commons model). This machine-to-machine handshake replaces the deceptive, unfair, and un-auditable non-agreements we get with cookie notices and shit such as we see in the image above. Unlocked Possibilities: Unlike corporate AI agents designed to keep people inside a walled garden (one cause of the zero-click problem), a personal AI agent can get the requested news item after a MyTerms agreement is signed, and then participate in a whole new value exchange system that works for everyone. For example, should a further agreement be reached (such as one for a micropayment or an acceptable subscription (also built atop MyTerms) the personal AI agent can both obtain the requested news and work out forms of compensation. In this new system, personal data will be shared on an as-needed and trusted basis that continues to assure personal privacy. This can be done in ways that preserve the open Web and create settlement systems that work for all involved (and not just for sellers and the platforms that trapped them in the past). Downstream Economic Benefits: When use-value and sale-value are both exchanged on terms that work for all involved, a news ecosystem can be built that rivals the old news galaxy, but with many more bright stars and fewer dark spaces. It will also obsolesce the current all-dwarf system, which is based on customr capture, constant surveillance, and algorithmic guesswork that annoys or offends everyone involved. 3. The New News Commons

To maximize both use-value and sale-value, our goal here is an ecosystem with maximized agency on both sides, and the fewest and simplest intermediaries.

From redstreams and bluestreams to wide open mystreams: Partisan news at the personal level (look at all those podcasts and blogs) has proven that decentralized, on-demand media are highly resilient. The task now is to multiply and disintermediate both consumption and production. This is required especially at the local level, where realities on the ground (e.g., weather and potholes) tend not to be partisan. What we want here is a common space governed by shared standards (and Ostrom’s principles) rather than algorithmic guesswork by unaccountable giants and their grudging dependents. The Nonprofit Pivot: Local digital-first nonprofits now represent over 50% of the Institute for Nonprofit News (INN), providing a model for news as a public good. The New Frontier: When you zero-base service and business models on agreed-upon privacy that starts with personal agency and respect for it, anything is possible. (By the way, this is what we’ve had in the natural world since we traded stones for fish. Just because we are still as naked on the Net as we were in Eden doesn’t mean we can’t clothe ourselves and get on with business.) Feature Dying Star News System Bright Star News Commons Privacy Corporate “consent” (tracking) MyTerms (User-Proffered Contract) Agency Dependent “users” Independent readers, listeners, and viewers with loyal agents Distribution Centralized walled gardens with paywalls and coerced subscriptions Open and independent consumers and producers creating use-value and sale-value exchanges that reward both sides

I could go on, but I want to get this up before I get on another airplane. Meanwhile, contact me by email (first name at last name dot com) or in the comments with ways to improve this. Thanks!

Beyond the Pilot Phase: Designing AI-Ready Institutions

There are people who talk about AI in higher education, and there are people who have lived inside higher education long enough to know why the talking rarely becomes ‘doing’. Robert J. Clougherty, Ph.D., is the latter. He has been a tenured full professor, a graduate program chair, a provost, a CIO, a vice president, and a co-founder — including Glasgow Caledonia New York, where he secured degree-granting authority and Middle States accreditation from scratch. He has sat in faculty senate meetings. He has been the person in the room when the skeptics show up.

That depth of experience is exactly what drew him to Edge, and what makes his new role as AI Lead such a natural fit for the moment Edge's member institutions now face.

"The through line really has always been meaning — how people make meaning, how institutions create the conditions for it, and what happens when technology either supports or disrupts that process."

– Robert J. Clougherty, Ph.D.
AI Lead
Edge

His Ph.D. focused on semiotics — the study of how meaning is made — and it is a lens he has never set down. It is also why he named his personal consulting practice Recursive Meaning AI. In his view, the arrival of large language models is not a discontinuity from the academic tradition; it is a deep extension of it. Shares Bob, "AI isn't just a subject. It's also an object of study, and it offers great opportunities to faculty and students."

Why Edge, Why Now

Edge has long served New Jersey's higher education community as a trusted infrastructure partner — networking, cloud services, cybersecurity, procurement. But Clougherty sees the AI moment as categorically different from those earlier pivots.

"It touches everything at once — academics, operations, governance, workforce, student experience. Campuses don't just need a new tool or a new vendor. They need a trusted partner who understands higher education's mission, culture, and constraints."

– Robert J. Clougherty, Ph.D.

Serving as a trusted infrastructure partner is Edge's DNA. Most institutions know they need an AI strategy but are caught between the pressure to act and the uncertainty of how to act. Edge is positioned to help them close that gap — not by telling campuses what to buy, but by helping them build the capacity to decide wisely.

The Coordination Problem — and What it Actually Costs

EdgeAI frames its mission around a pointed diagnosis: most campuses don't have an AI problem so much as a coordination problem. 

"Most campuses really don't lack for AI tools," explains Bob. "They're drowning in them. What they lack is the connective tissue — the shared decision rights, the data readiness, the institutional trust to move forward together."

In a recent piece published in TechTarget, Clougherty traces this problem to what he calls the "software age" — the 1990s and early 2000s wave of technology spending in which departments bought tools to solve local problems, while central IT was left maintaining an uncoordinated ecosystem rather than designing an enterprise. The result, he argues, is a hidden tax that campuses are still paying today: in meetings, workarounds, data silos, and processes that were never designed to talk to each other.

AI, he warns, risks repeating exactly that pattern — only faster, and with higher stakes. "If the AI age becomes the software age, but with chat, we will simply add another stack of bricks and call it transformation."

To avoid that outcome, Clougherty describes what he calls an "AI mushroom" phenomenon — a patchwork of disconnected pilots that spring up across campus with no coherent logic. In a piece for Higher Education Digest, he explored how CIOs and provosts are navigating exactly this dynamic: tools proliferating faster than governance can keep up, leaving institutions with isolated experiments but no enterprise strategy.

The antidote, in his framework, is a triangle.

 

"Technology without governance gives you the mushrooms," he explains. "Governance without culture becomes compliance theater. Culture without technology becomes talk and fatigue. You have to move all three together." Getting coordination right, in practice, means starting with mission rather than tools, establishing clear decision rights early — who approves an AI use case, who owns the data, what is the risk tier — and investing in the human side with listening sessions, role-based training, and honest conversations about what AI can and cannot do.

From Pilot Graveyard to Enterprise Impact

If the coordination problem explains why AI stalls at the campus level, the pilot graveyard problem explains why it stalls at the project level. Clougherty sees this pattern constantly: promising experiments that go nowhere because there is no defined end goal, no clear success criteria, no evaluation rhythm, and no pathway to scale.

"You end up in a situation where nobody can explain what 'working' actually means," he says. "An AI strategy that reads like a procurement plan is a recipe for disaster."

He is equally clear about a second trap: the belief that AI will fix existing problems. It won't. AI amplifies what it encounters. If an institution is data-siloed, AI will exaggerate the silos. If the data is poor quality, the outputs will reflect that — with greater confidence. If processes are misaligned, AI will institutionalize and automate the misalignment. Getting the foundation right first is not optional.

Breaking through to enterprise-level impact, Clougherty says, requires three things: a roadmap grounded in institutional mission rather than vendor demos; an evaluation framework that tells you when a pilot is ready to scale — and when it should be retired; and a governance structure that gives people the confidence to make decisions. That, he says, is precisely what EdgeAI is designed to build.

The AIR Assessment: A Blueprint, Not a Test

EdgeAI's Artificial Intelligence Readiness (AIR) assessment is the entry point for most member institutions. Clougherty is careful about how he frames it.

"The readiness assessment isn't a test you can fail. It's a structured conversation that produces a shared truth about where your institution actually stands — what's real, what's risky, what's next."

– Robert J. Clougherty, Ph.D.
AI Lead
Edge

Built around the same technology-governance-culture triangle, the process produces a prioritized path (what to start, what to stop, what to continue), a 12-month execution plan, and a longer-term capability horizon that is sequenced and realistic. Most importantly, it produces alignment: a shared language and shared framework that lets the provost, the CIO, the CFO, and the faculty senate have a productive conversation about AI instead of talking past each other.

To a president or provost who is unsure whether their institution is ready to take that step, Clougherty's answer is direct: "The question isn't whether your institution is ready. The question is whether you can afford not to find out."

Honoring Academic Culture — Not Steamrolling It

Higher education has deeply held values around academic freedom, shared governance, and equity. AI can reinforce or undermine all of them. Clougherty's thinking here is shaped as much by lived experience as by theory.

He recalls moving a campus online in the early days of digital learning, when faculty were so suspicious of the effort that a colleague once confided to him — not knowing he was part of it — that the provost was meeting in a basement to plan how to "replace faculty with computers." The anecdote still makes him laugh. But the lesson it carries is serious: institutions that succeeded in online learning were the ones that gave faculty a meaningful role in shaping the pedagogy. The same principle applies to AI.

Edge AI's governing philosophy is captured in a phrase Clougherty uses often: disrupt your process, don't disrupt your culture. Governance frameworks that are imposed from the top without meaningful faculty and staff engagement produce resistance, resentment, and compliance theater. But institutions that adopt AI primarily as an efficiency mechanism — without addressing the deeper questions of learning, meaning, and institutional identity — risk hollowing themselves out.

"They'll become more efficient at producing outputs whose meaning is increasingly unclear," shares Bob. "That's not a technology problem. That's an organizational identity problem."

Building for the Next Wave, Not Just the Current One

Clougherty is candid about the pace of change. No institution will keep up with AI release cycles where new models drop what feels like every 48 hours. Trying to do so is a losing strategy. The goal is adaptive capacity.

He points to a practical example: a student-facing AI system he built for a client using retrieval-augmented generation (RAG), structured so that when the student handbook is updated, the institution simply drops the new file into a folder — and the system updates accordingly. No vendor contract renegotiation. No IT overhaul. Just a system designed to adapt. "Survival doesn't go to the strongest or the smartest," he explains. "It goes to the most adaptive to change."

The cultural and governance infrastructure — those other two thirds of the triangle — are what determine whether an institution can absorb the next wave of AI, and the one after that. They cannot be afterthoughts bolted on behind the technology. They have to be designed deliberately, from the start, as the infrastructure that makes everything else sustainable.

There is no Middle

Three years from now, what does success look like? Clougherty has thought carefully about this, and his answer reflects just how differently he thinks about planning in the AI era. "Three AI years is not three calendar years in any meaningful planning sense," notes Bob. "The target is moving faster than any fixed plan."

The marker he points to is not a list of tools deployed or pilots completed. It is institutional capacity: member institutions that can evaluate, absorb, and critically deploy AI they haven't even seen yet. Campuses where the discourse has shifted from should we use AI to how do we best use AI to fulfill our mission. Institutions making AI decisions from a coherent identity rather than scrambling to keep up.

That vision maps directly to the thesis of his most recent long-form essay, There Is No Middle — a piece aimed squarely at presidents and provosts wrestling with whether to commit. The argument, plainly stated: you cannot invest seriously in AI while holding tight to legacy systems built for a different era. The strategic logics are incompatible. Half-measures exhaust the people asked to maintain the contradiction without advancing either goal.

For Edge member institutions, Clougherty's arrival signals something important: this is not a moment for another pilot. It is a moment for the kind of deliberate, mission-grounded institutional design that only happens when leadership decides to commit. Edge is here to help make that commitment actionable.

The post Beyond the Pilot Phase: Designing AI-Ready Institutions appeared first on Edge, the Nation's Nonprofit Technology Consortium.

Kia ora

Sir Geoffrey Palmer has spent a lifetime warning New Zealanders that democracy depends not on good intentions, but on infrastructure – the structures that quietly determine how power operates. A new layer is now taking shape: not the card in your wallet or the login screen you click through, but the underlying trust infrastructure that determines who can participate in the digital economy.

Our Executive Council recently discussed an important question: whether the United States may be granted access to New Zealanders’ biometric data. Biometrics can’t be changed like passwords or re-issued like financial credentials. Decisions about access and control carry generational consequences – and in a time of rising global security pressures, we should ask whether expanding biometric data sharing is the only path forward, or whether there is a more constructive alternative.

New Zealand has a unique opportunity to lead by investing in trust infrastructure that protects and empowers individuals, businesses, and communities: systems where sensitive data stays under the control of the person or organisation it relates to; where verification can happen without unnecessary disclosure; and where privacy, security, and interoperability are designed in from the outset.

Every centralised system eventually becomes a permanent institutional memory. Data collected for convenience today becomes a liability tomorrow: searchable, accessible, and vulnerable to breach, misuse, or geopolitical leverage. This is not a hypothetical risk. It is structural certainty.

Constitutions shape how power operates in societies. Digital identity infrastructure will shape how power operates in digital economies. The question is not whether it will exist, but who shapes it – and on what terms.

Q1 2026 has reinforced something important: digital identity is no longer a policy discussion. It is becoming infrastructure – and once embedded, infrastructure shapes the conditions under which future generations live.

You may notice Digital Identity New Zealand has a new look as part of a Tech New Zealand | Hangarau Aotearoa ecosystem-wide refresh. Our brand has evolved to better reflect the foundational role digital identity now plays as infrastructure for trust, access, and participation. We will continue to bring together Aotearoa’s digital identity, trust, and assurance community to support an open, interoperable ecosystem grounded in strong governance, legal certainty, and public trust.

New Zealand leads the way in next generation digital identity

Congratulations to New Zealand for co-designing its Digital Identity Services Trust Framework (DISTF) Reference Architecture and now finalising its Draft Exposure.

The cross-sector contribution process has produced an inclusive, privacy-preserving foundation for next-generation digital identity through Verifiable Credentials.

New Zealand has done this before. More than a decade ago it led online authentication with RealMe – the foundation upon which Australia’s MyID is built. Now it is leading again, developing next-generation Trust Infrastructure to meet emerging challenges such as Agentic AI, Business ID, and Post-Quantum security.

Some organisations define consultation as asking people to submit comments privately and trusting the government to feed that input into their process. New Zealand took a fundamentally different approach, bringing government and industry together for structured, page-by-page reviews of the Reference Architecture, where comments were posted and visible to all participants, and each one was worked through intentionally and transparently.

Hats off to the incredible leadership across New Zealand, now we know what to build with government leading the way. Read the latest government announcement here.

A call to the banking sector: an opportunity to lead the trust infrastructure

Every financial system rests on one foundation: trust – public confidence that institutions can protect people from harm.

That trust is under pressure. Fraud and scams are extracting billions from New Zealand households annually. For victims, the boundaries between banks, payment providers and platforms are invisible. They see a system that moves money quickly but struggles to prevent harm.

At the same time, digital commerce is shifting towards programmable wallets, verifiable credentials, and cryptographic trust networks, where transactions rely on machine-verifiable identity signals, not just traditional payment rails. If trust in the banking system weakens while these networks mature, significant portions of digital commerce could begin to move outside traditional rails.

The Q2 updates to AML/CFT identity verification guidance, including the evolution of the Identity Verification Code of Practice (IVCOP) and the move toward continuous supervision, signal an important regulatory direction: beyond document-based verification toward reusable, high-assurance digital credentials across multiple transactions and services.

DINZ provides the cross-sector ecosystem through which this work can be coordinated. There is an opportunity for the sector right now to work with DINZ and lead this evolution.

Strategic Priorities

Solving the “Red X Problem”: A Proposal for Credential Namespace Schema Coordination

DINZ is exploring a new coordination initiative that could unlock faster adoption of verifiable credentials across New Zealand’s digital economy.

While digital identity – verifiable credentials, digital wallets, and trust registries – is production ready, adoption remains slow. A key barrier is what the proposal calls the “Red X Problem”: when a verifier sees an unfamiliar credential, it rejects it – not because the tech fails, but because the credential’s meaning and trustworthiness aren’t clear.

The proposed response is credential namespace coordination: a shared naming and governance layer, similar to how DNS underpins websites or telephone numbering plans enable telecommunications. Without it, credential ecosystems risk becoming fragmented silos that can’t talk to each other.

DINZ is considering convening government, industry, and ecosystem stakeholders through its Trusted Credential Adoption (TCA) Working Group to develop voluntary guidance on issuer identification, credential naming conventions, and governance principles. An initial discussion paper is targeted for end of May.

2026 DINZ Trust Survey

We are looking to commission an updated nationally representative Trust Survey.

Since DINZ last ran this survey in 2023, the environment has materially shifted: the Digital Identity Services Trust Framework Act has passed, AI-mediated identity has accelerated, and fraud and scams have increased significantly. Trust is now the primary constraint on adoption, and we need current evidence to guide strategy, industry engagement, and government conversations.

We’ll keep you updated on progress.

DINZ Update

Chair & Deputy Chair Confirmed
At the February Executive Council meeting, Maria Robertson was successfully re-elected as Chair and Vica Papp as Deputy Chair. The Executive Council acknowledged the significant voluntary commitment these roles require and offered its collective support. Welcome back also to Julia Nicol (Worldline), who has volunteered to chair meetings when both the Chair and Deputy are unavailable.

New Independent Council Member – Justin Gray
Justin Gray, formerly Managing Director of Datacom, has joined the Executive Council in an independent capacity in accordance with our Charter. Justin brings deep governance experience at a pivotal moment for the organisation. We warmly welcome him.

New Member – Catalyst IT
We’re pleased to welcome Catalyst IT as a new member, who showed particularly strong engagement at the AcademyEX panel in February. The appetite for deeper ecosystem coordination is clearly growing.

Membership Growth
DINZ currently has 81 members across all tiers, and overall membership remains healthy and stable, with strong engagement and continued momentum through the year. Major corporate membership is tracking well, and we’re pleased to see ongoing interest from organisations across the ecosystem. 

The full membership list now includes Air New Zealand, AWS, ANZ, ASB, BNZ, Deloitte, GBG, Google NZ, Lumin, Mattr, Meta, Microsoft, Spark, Unify, Westpac, Worldline, Xero, Adobe, KPMG, and The Co-operative Bank.

March Engagements

This has been a high-activity month for DINZ in the field. Andy has represented the organisation across three major events in the past fortnight alone:

Fintech Hui Taumata (11–12 March, Tākina Wellington)Moderating the panel ‘From KYC to Continuous Trust: Rethinking Identity in Real-Time Finance, Agentic Commerce and Open Payments.’ The conversation around identity as a live, continuous layer, not a one-time gate, is gaining serious traction across the financial sector. Cybersecurity Summit (17–18 March, Tākina Wellington)Representing DINZ at the national cybersecurity conversation as the identity and trust lens grows in importance across security frameworks. Retail NZ: Trust at the Point of Sale (18 March)Presenting to the Retail NZ Industry Group on why digital identity is becoming core retail infrastructure. The session covered unified QR protocols for payments and identity, portable loyalty, consent-based personalisation, and the emerging agentic commerce landscape. Retail is beginning to understand: identity infrastructure is what separates a transaction from a relationship.
View the presentation here → Q1 Highlights

Biometrics Institute Conference — Wellington, 19 February

A strong signal that biometrics, identity assurance and AI-mediated systems are converging quickly. Identity is moving from edge-case use to core infrastructure across sectors. 

AcademyEX Panel Discussion

Thirty attendees took part in a lively discussion, one of our most engaged member events of the year so far. Particularly strong participation from Catalyst IT. The format worked well and we’ll be building on it. Thank you to AcademyEX for hosting such a memorable event.

Identification Management Standards — Interim Review

DINZ has engaged in consultation on the Identification Management Standards interim review and will meet with the DIA team following our March Executive Council meeting. Alignment between standards, architecture and real-world deployment is critical. Our approach will be to bring concrete use cases and requirements rather than broad statements, ensuring DINZ’s voice is practical and actionable.

Government Digital Infrastructure — Key Update
A significant restructure is underway. The Government Chief Digital Officer function is transitioning into the Public Service Commission, bringing the Digital Identity Services Trust Framework (DISTF) team with it to support the new digital government operating model. 

On the infrastructure side, momentum is building. The MATTR wallet with test credentials has been demonstrated, with the environment moving to sandbox imminently, opening up broader ecosystem experimentation for members. At least five organisations have signed up to the marketplace, and five are actively progressing DISTF accreditation, including DIA itself.

A government credential issuance roadmap is emerging, with potential credentials including a Delegated Passport credential, NZBN, Company Director, IRD, and Driver’s Licence. Securing strong demand-side credentials has been identified as a key accelerant for ecosystem adoption.

DINZ has raised the namespace coordination proposal directly with the DISTF team as a mechanism to support interoperability as both mDoc and W3C Verifiable Credential standards begin to scale, helping government and market credentials work together across wallets, issuers, and relying parties without fragmentation.

Members interested in practical credential use cases should watch for an upcoming opt-in session with the Trusted Credential Adoption Working Group.

Trusted Credential Adoption (TCA) Working Group

The TCA Working Group has good momentum. The group is focused on priority use cases, aligning with the Reference Architecture, and maintaining the pace of progress. This group is central to the namespace governance work described earlier in this newsletter.

International Engagement – April

India Study Trip (12–16 April)

By invitation from Dr Samir Saran, President of the Observer Research Foundation. Andy’s itinerary includes governance, policy architects, and infrastructure leaders shaping global digital identity, payments and governance.

Utah State-Endorsed Digital Identity (SEDI) Summit (20–23 April)

By invitation from Michael Proper and SEDI protocol leadership. An initiative to advance a privacy-focused framework where digital identity is separated from government-issued privileges, allowing for individual control and agency.

Digital Trust Hui Taumata 2026

Tuesday 11 August 2026 | Te Papa, Wellington

This year’s theme is ‘Trust is the New Infrastructure: Global Architecture, Indigenous Authority, and Aotearoa’s Moment’.

This isn’t a typical vendor conference or policy seminar. It’s a forum focused on shaping the direction of trust infrastructure in Aotearoa, and we are proud of the programme taking shape.

Two keynote voices anchor the conversation:

Drummond Reed: Pioneer of decentralised identity and co-author of foundational global standards, exploring trust infrastructure as the next layer of the Internet, shaping digital economies, AI systems, and the future of human agency. Dr Karaitiana Taiuru: Leading authority on Māori data sovereignty and tikanga-based digital governance, examining why trust cannot be engineered through technology alone, but must be grounded in legitimacy, cultural authority, and enduring governance principles.

Together, they will explore why Aotearoa New Zealand occupies a uniquely powerful position to help shape trust infrastructure that is globally interoperable, yet grounded in human dignity, indigenous authority, and long-term societal trust.

Technology alone does not create trust. Governance does.

Tickets will be on sale soon – keep an eye out for comms with the registration link.

Confirmed partners: Lumin and Middleware. Sponsorship opportunities remain available, contact bettina.sinclair@technewzealand.org.nz if you’d like to be involved.

Strong Foundations, Positive Momentum

For those who like to know the organisation is on solid ground: DINZ is tracking to plan and the community is in a strong, sustainable position. We’re seeing continued membership growth and good momentum across our work programme. The Digital Trust Hui was successfully delivered and performed well overall – a strong result for a complex event.

See you in the field.

Ngā mihi nui,

Andy Higgs

Executive Director,
Digital Identity New Zealand

Read full newsletter here: The rubber is hitting the road on identity infrastructure | March Newsletter

The post The rubber is hitting the road on identity infrastructure | March Newsletter appeared first on Digital Identity New Zealand.

1. What is the mission and vision of DeepIDV?

Mission: To be the definitive AI-native platform for full verification — identity, authenticity, and trust — protecting people, businesses, and systems against deepfakes, fraud, and emerging digital threats in real time.

Vision: To establish deepidv as the global standard for verification across every layer — who someone is, whether what you’re seeing is real, and whether you can trust the interaction. From document and biometric verification to deepfake detection, fraud prevention, and continuous monitoring, deepidv covers the entire trust lifecycle. The long-term play is UAIIP as the universal protocol underpinning verification for both humans and AI agents worldwide.

2. Why is trustworthy digital identity critical for existing and emerging markets?

Digital trust and identity verification are critical because the speed of digital interaction has outpaced the infrastructure built to support it.

In existing markets like financial services, real estate, insurance, and healthcare, organizations are bleeding money on fraud, drowning in compliance costs, and relying on legacy verification tools that only solve one piece of the problem. KYC/AML is still largely manual. Fraud losses run into the tens of billions. The tools they have are fragmented and reactive.

In emerging markets like Web3, AI agent commerce, the gig economy, and age verification, the problem is worse: there’s often no trust infrastructure at all. You can’t scale cross-border fintech without verifying users who don’t have traditional credit histories. You can’t let AI agents transact without a verification layer for non-human actors. You can’t enforce age restrictions with any real teeth.

On top of all of this, the deepfake and synthetic media crisis is accelerating across every sector. Forged documents, synthetic faces beating liveness checks, AI-generated voice and video used for fraud and social engineering. “Seeing is believing” is dead, and no incumbent player is addressing it comprehensively.

The bottom line: digital trust isn’t a feature, it’s infrastructure. The same way commerce can’t function without payments rails, the next decade of digital interaction can’t function without verification rails that cover identity, authenticity, fraud, and continuous monitoring in one layer.

3. How will digital identity transform the Canadian and global economy? How does your organization address challenges associated with this transformation?

Digital trust and identity verification will transform economies by unlocking the full potential of digital commerce, financial inclusion, and cross-border interaction. When trust is embedded into infrastructure, markets move faster, fraud costs drop, regulatory compliance becomes scalable, and entirely new sectors like AI agent commerce and decentralized finance can mature. Globally, the verification market is projected to grow into the tens of billions precisely because every industry is realizing that digital scale without digital trust is a liability.

In Canada specifically, this transformation supports the growth of fintech, proptech, and the digital services economy while addressing rising fraud, identity theft, and regulatory demands around AML and privacy compliance. It also positions Canadian companies to export trust infrastructure globally, particularly into emerging markets that lack legacy systems and are building digital-first.

deepidv addresses the challenges of this transformation by providing a single AI-native platform that covers the full verification lifecycle, not just identity. We handle document and biometric verification, deepfake and synthetic media detection, real-time fraud and behavioral risk scoring, background intelligence, and continuous monitoring. Where incumbents offer fragmented point solutions, deepidv delivers one integrated layer that works across industries and geographies. Our hardware line, deepcam, extends that same trust layer into the physical world for access control and surveillance. And our long-term protocol vision, UAIIP, is designed to establish a universal verification standard for both humans and AI agents, ensuring the infrastructure scales with the economy rather than falling behind it.

4. What role does Canada have to play as a leader in this space?

Canada is uniquely positioned to lead in digital trust and identity verification due to its strong AI research ecosystem, progressive privacy regulation, and established reputation as a trusted jurisdiction for financial services and technology exports. The country’s investment in AI through hubs like the Vector Institute and MILA, combined with frameworks like PIPEDA and emerging provincial digital ID initiatives, creates a foundation that few countries can match. Canada has the opportunity to set global standards for how verification infrastructure is built and exported, particularly into emerging markets that need trusted, privacy-respecting solutions from day one. deepidv is building exactly that from Toronto, with the ambition to make Canadian trust infrastructure a global export.

5. Why did your organization join the DIACC?

We joined the DIACC because digital trust isn’t something any single company builds alone. DIACC is at the center of Canada’s digital identity ecosystem, shaping the frameworks, standards, and policy conversations that will define how verification infrastructure scales nationally and globally. Being part of that community allows deepidv to contribute our perspective as a full verification platform while staying aligned with the direction the broader ecosystem is moving. It also positions us alongside the institutions, governments, and technology partners who share the goal of making Canada a global leader in digital trust.

6. What else should we know about your organization?

deepidv isn’t just another identity verification company. We’re building the infrastructure layer for trust in a world where you can no longer believe what you see, hear, or read online. Our platform covers the full spectrum of verification, from identity and document checks to deepfake detection, fraud prevention, behavioral risk scoring, and continuous monitoring, all in one AI-native system.

We’re a small, focused team operating across Toronto, San Francisco, and Dallas, moving at a pace that incumbents in this space simply can’t match. We’ve closed a $1M seed round, built hardware and software product lines simultaneously, and are actively deploying across verticals like proptech, fintech, and emerging markets. Our long-term vision is UAIIP, a universal protocol for verifying both humans and AI agents, because the next wave of digital interaction won’t just be person to person. It will be agent to agent, and nobody has built the trust layer for that yet.

What sets us apart is that we see verification as a lifecycle, not a checkpoint. The industry has been stuck on one-time identity checks while fraud, deepfakes, and synthetic media have evolved far beyond what those tools can catch. deepidv exists to close that gap entirely.

1. What is the mission and vision of ProofofID?

ProofOfID’s mission is to empower individuals and organizations with secure, user-controlled digital identity solutions that enable trusted, frictionless interactions across physical and digital environments.
We envision a world where identity is no longer a liability but an asset, where individuals own, control, and consent to how their data is shared, and organizations can instantly verify trust without compromising privacy. ProofOfID aims to become a foundational layer in the global digital trust ecosystem, enabling interoperable, privacy-preserving identity verification at scale.

2. Why is trustworthy digital identity critical for existing and emerging markets?

Digital trust is the backbone of today’s economy. As services move online, from banking and healthcare to government and commerce, verifying identity securely and accurately becomes crucial. In existing markets, the challenge is to reduce fraud, streamline compliance, and improve the user experience. Identity fraud, synthetic identities, and data breaches continue to cost billions annually.
In emerging markets, the opportunity is even more transformative. Trusted digital identity unlocks financial inclusion, access to government services, and participation in the digital economy for millions who are currently underserved.
Without a trusted identity:
– Transactions cannot be secured
– Services cannot scale safely
– Inclusion remains limited

3. How will digital identity transform the Canadian and global economy? How does your organization address challenges associated with this transformation?

Digital trust will fundamentally reshape how economies operate by:
– Reducing fraud and compliance costs ands accelerating onboarding and service delivery.
– Enabling cross-border digital commerce and empowering individuals with control over their data.
However, this transformation introduces key challenges such as privacy concerns and data misuse, fragmented identity systems, lack of interoperability, and growing sophistication of fraud.

ProofOfID addresses these challenges by:
– Enabling user-consented identity sharing (trust to authorize), putting individuals in control.
– Providing real-time validation and fraud detection signals.
– Designing for interoperability with existing ecosystems and standards.
– Minimizing data exposure through secure, decentralized, and tokenized identity verification
Our approach shifts identity from being stored and vulnerable to being dynamically verified and controlled.

4. What role does Canada have to play as a leader in this space?

Canada is uniquely positioned to lead globally in digital trust due to its strong regulatory frameworks, innovation ecosystem, and commitment to privacy. Through organizations like DIACC, Canada has already established itself as a pioneer in:
– Pan-Canadian trust frameworks
– Public-private collaboration
– Standards-based interoperability
Canada’s role should lead by showcasing trusted solutions like ProofOfID, setting global benchmarks for privacy-respecting digital identity, fostering innovation, maintaining trust and security, and enabling cross-border interoperability with like-minded nations.

5. Why did your organization join the DIACC?

ProofOfID joined DIACC to collaborate with industry leaders and contribute to the development of a trusted, interoperable digital identity ecosystem in Canada.
We believe that solving identity challenges requires collective effort, not isolated innovation. DIACC provides a platform to:
– Align with national standards and frameworks
– Contribute our expertise in user-controlled identity and fraud prevention
– Partner with organizations shaping the future of digital trust
Our participation reflects our commitment to building solutions that are not only innovative but also aligned with Canada’s broader digital trust vision.

6. What else should we know about your organization?

ProofOfID is a patent-backed digital identity platform designed to redefine how identity is shared and verified.
Key differentiators include:
– User-centric identity control; individuals approve and monitor how their identity is used
– Fraud prevention by design; real-time alerts and verification signals help detect suspicious activity
– Scalable and interoperable architecture; built to integrate across industries and jurisdictions
– Enterprise and government-read; supporting high-volume, high-assurance identity use cases
– It’s not just another one-time KYC/IDV solution; it enables the reuse of verified PII data.
As we enter the market, our focus is on enabling secure digital ecosystems across financial services, telecommunications, government, and beyond while ensuring trust remains at the core of every interaction.

Case Study Authors:
Shauna Pettit-Brown, Robert Hughes, Jean-Christophe Laurent, Kenn Chong, and Philip J Corriveau

About RSA Security

RSA provides the identity intelligence, authentication, access, governance, and lifecycle capabilities needed to prevent threats, secure access, and enable compliance. More than 9,000 security-first organizations trust RSA to manage more than 60 million identities across on-premises, hybrid, and multi-cloud environments. For additional information, visit RSA.com.

The Challenge

When an organization sells authentication solutions, there’s no hiding from the hard question: Does it actually use what it builds?

In 2024, RSA leadership set a goal: 100% passwordless for its workforce. RSA is a global security company with employees distributed across offices worldwide—a deployment footprint that mirrors what many enterprise customers face. The motivation to go passwordless was twofold: to reduce credential risk and strengthen RSA’s security posture, and to stop speaking about passwordless deployment from a distance. RSA put itself in its customers’ shoes—to experience every integration challenge, every policy decision, every change management hurdle that enterprises face deploying passwordless and FIDO at scale.

This is what RSA learned when theory met reality.

RSA’s Starting Position

For RSA, that gap had a specific shape. RSA® ID Plus is an identity and access management (IAM) security platform that supports passwordless multi-factor authentication, access, SSO, and other capabilities across cloud, hybrid, and on-premises environments.  

The ID Plus platform team was actively building the capabilities enterprises need for passwordless deployment—enrollment flows, recovery paths, and access policies—while RSA’s own workforce was still using passwords. RSA’s security and R&D teams had run early experiments with FIDO hardware security keys, and those experiments confirmed the technology’s security properties. What those reviews also surfaced were the operational realities of deploying FIDO passwordless: cross-platform friction, global distribution complexity, the gap between a working proof of concept and an enterprise-wide rollout. The decision to deploy RSA ID Plus and support passwordless across RSA’s own organization wasn’t a marketing exercise. It was the only honest way to validate its solution’s efficacy in supporting passwordless for all users, in all environments, and for every use case. 

What Internal Deployment Exposed

In deploying its own platform, RSA learned something critical: ID Plus worked as expected. The complexity was in how it interacted with the broader RSA identity ecosystem.

In implementing enterprise-wide passwordless, RSA discovered assumptions and dependencies that defaulted to password-based authentication. In the process to implement 100% passwordless, RSA resolved those dependencies and cleared the way for true passwordless. The following details the use cases where RSA uncovered passwordless-based authentication, and how RSA removed them to support passwordless for every user, in every environment, throughout the identity lifecycle.

The Architecture Catch-22

One of the first use cases RSA discovered was how new users register for their first authenticator.

The RSA self-service portal required an authenticator for passwordless authentication—but new employees needed a password to access the portal to register their first authenticator. This wasn’t a product limitation; it was a previous architectural dependency that assumed users would need passwords.

What RSA fixed (Late 2024):

New user enrollment → Dedicated entry point requiring no password Account recovery → Separate flow bypassing password reset Daily authentication → Policies making passwordless the default

What RSA learned: Having implemented these changes itself, RSA now asks customers different questions during planning—not “what authenticators do you want” but “where are passwords still required?”

Securing Help Desk Interactions

As RSA deployed passwordless authentication and resolved new user onboarding, RSA addressed an adjacent security concern: help desk verification. Traditional knowledge-based verification (employee ID, manager name) can be researched by attackers, who then socially engineer support staff into resetting credentials, or social engineer employees into handing over credentials.

The RSA approach: RSA implemented bi-directional live verification for help desk interactions. When an employee contacts support, the agent initiates a verification session. The employee authenticates using any registered method (passkey, QR code, biometric), and the system generates a single-use code that the employee provides to the agent. This can verify both parties, confirming the user is legitimate, and the agent is an authorized representative.

What RSA learned: Passwordless infrastructure made this solution feasible. RSA could leverage the same methods employees already used for daily authentication, eliminating shared secrets at the help desk touchpoint where social engineering attacks often succeed.

Policy and Group Management Complexity

The ID Plus platform had robust policy capabilities. What internal deployment exposed was the organizational complexity of deciding those policies and implementing them in a coordinated way. RSA had to address the following questions in rolling out passwordless:

Who are the first groups to get the new policies? How should it phase policies across departments with different risk profiles? What’s the fallback for the unforeseen edge cases?

What RSA learned: This isn’t a technology problem customers can solve with software. It’s organizational decision-making that requires time, stakeholder alignment, and iteration. RSA couldn’t shortcut it for itself, and RSA can’t shortcut it for customers either—but RSA can share what worked and what didn’t. 

The Mobile Passkey Breakthrough

With platform architecture in place, RSA tackled the hardware distribution challenge its R&D teams encountered.

In early 2025, RSA integrated FIDO-based device-bound passkeys support into its mobile authenticator app, which is now a FIDO2 certified authenticator. This ensured RSA could distribute passkeys in a way that fit how its workforce already worked.

The adoption advantage:

RSA employees were already using the mobile app for authentication. Adding passkey support to it required no new app, no separate enrollment, and no user-initiated setup. 

Outcome: Passkey adoption wasn’t an uphill climb—it was a natural extension of existing behavior. RSA eliminated the hardware distribution challenges faced in R&D while maintaining FIDO phishing resistance.

Why this matters for enterprises: Organizations evaluating “software-based synced passkeys vs. hardware-based (device-bound passkeys)” often miss this third option: software-based device-bound passkeys in an existing enterprise mobile authenticator app. It gives organizations the control and security of device-bound passkeys with better UX and no hardware distribution overhead.

The Deployment Journey: Where Technology Met Human Behavior

With the platform ready and mobile passkeys easing distribution and onboarding, RSA began workforce rollout. This is where the company learned that technical readiness ≠ organizational readiness.

The technology was deployed in weeks. Changing employee habits took longer, up to a year for some.

The journey moved through three meaningful shifts: making passwordless available (Enable), making it the expected path (Default), and removing the fallback entirely (Require). The steps below map to that arc.

ENABLE — Steps 1–4: Make Passwordless Available

Before organizations can ask people to change, they have to make change feel safe to try. The ‘Enable’ stage is about removing the psychological cost of experimenting with something new—not by pushing adoption, but by ensuring the familiar fallback still exists while employees build confidence. Change management research consistently shows that people need low-stakes exposure to a new behavior before they’ll voluntarily substitute it for an established one. The goal here isn’t momentum; it’s readiness.

Step 1: Fortify Alternatives Before Removing Passwords (Early 2025)

Passwordless options were available. Passwords still worked. Goal: familiarization, not adoption.

What RSA learned: People need to try new methods in low-stakes situations before organizations remove the familiar option.

Step 2: Remove Passwords from Lower-Stakes Systems First (Spring 2025)

VPN and SSO went passwordless before desktop login. This normalized “passwords aren’t always available” before the highest-visibility change.

What RSA learned: Sequencing matters. Build comfort on less visible systems before tackling what employees use more frequently.

Step 3: Pilot Desktop Agent Broadly (July 2025)

50 employees across the company—not just IT—tested desktop passkey authentication with passwords as fallback.

Key decision: Diverse roles, not just technical users, build credibility.

What RSA learned: Cross-functional pilots surface different pain points than IT-only pilots. RSA found UX issues and communication gaps that would have been missed otherwise.

Step 4: Deploy to All, Don’t Mandate Yet (Sept-Nov 2025)

Workstation passkey authentication available to everyone. Passwords still worked.

Result: Adoption was very modest. Despite availability and encouragement, most employees continued using passwords.

What RSA learned: Availability and encouragement don’t lead to adoption. Experiencing this first-hand gave RSA deeper empathy for what its customers face. People stick with familiar behaviors unless they are given a compelling reason to change. People may fear being unable to access their systems and get their job done when their authentication methods change.

DEFAULT — Step 5: Make Passwordless the Expected Path

Availability is not the same as adoption. When people have a choice between a familiar path and a new one, they take the familiar path—almost every time. Behavioral research on default effects makes this plain: the option that requires the least effort wins, regardless of which option is objectively better. The default stage is where an organization stops relying on voluntary switching and starts designing the system so that passwordless is simply what happens. A deadline makes that design decision visible and real.

Step 5: Campaign + Clear Deadline (November 2025)

Intensive 3-week push combining:

Gamification (scavenger hunts, prizes, leaderboards) Social proof (executive participation, peer champions) Clear deadline: “Passwordless becomes mandatory December 1”

Result: Usage increased 3x in three weeks.

What RSA learned: Deadlines transform “I should try this eventually” into “I need to do this now.” Voluntary adoption plateaus, but campaigns with deadlines drive real behavior change—a pattern RSA expects customers will encounter as well. 

One further lesson: if organizations want employees to adopt a particular authentication method, make it the default from day one. Asking users to actively switch on their own is an uphill battle—most will stay on whichever path requires the least effort. Design the default toward the preferred authenticator; don’t rely on voluntary switching to deliver results.

REQUIRE — Steps 6–7: Remove the Fallback

Behavior change sticks when the old behavior is no longer an option. Removing the password fallback is what transformed this campaign into a permanent shift—it’s the difference between a temporary experiment and a new organizational norm. 

This is also where the distinction between “passwordless” and “passkeys” becomes operationally important: employees could comply via passkey, QR code, or biometric. From the outset, RSA had been working to fulfill the mandate for passwordless authentication, not the method. Prioritizing that mandate reduced friction and avoided the perception of a forced technology choice.

Step 6: Mandatory Desktop Passwordless (December 2025)

Passwords disabled for workstation authentication. Because most employees had already switched in November, the mandate minimized disruption.

What RSA learned: With an expanded testing group, the implementation team had already identified and resolved problems. Help desk volume increased but was manageable. 

One important distinction worth making explicit: the mandate was for passwordless authentication, not specifically passkeys. Employees who authenticated via QR code, biometric, or other FIDO-based methods were fully compliant.  RSA’s desire was to use FIDO wherever possible, however at this point in the journey something is better than nothing and phishing risk was reduced in these specific use cases relative to password-based authentication. “Passwordless” is the outcome; passkeys are one path to get there. This distinction matters for customer conversations—enterprises often conflate the two, and setting expectations correctly up front reduces confusion during rollout. The added advantage here was RSA had all these options in the same application, so the right method could be offered at the right moment with virtually the same user experience, hence not causing added friction to the authentication process. 

Step 7: Finding the Edge Cases (Dec 2025-Present)

RSA is continuing to find and resolve edge cases that still require some degree of password-based authentication. Examples include third-party integrations that need reconfiguration; legacy systems where the FIDO authentication flow is not yet supported; and systems where FIDO authentication cannot be used because of compliance requirements. RSA is also identifying other identity silos that may need dedicated attention.

What RSA learned: Even with careful planning, organizations discover exceptions in production. RSA is addressing these through workarounds, action plans, and documented exceptions. This is normal—other organizations working toward similar passwordless mandates face it too.

What RSA Now Knows—From Experience, Not Theory

The results have been directionally clear across every dimension RSA tracked. Password-related help desk tickets dropped significantly once the mandate took effect—the volume spike during transition was temporary and manageable. RSA reached near complete passwordless adoption across managed endpoints within twelve months of starting workforce rollout, a timeline that included the slow voluntary phase and the campaign requiring passwordless that broke the plateau. Phishing and credential-based attack surface on managed systems has measurably narrowed. And the deployment itself—from platform readiness through full mandate—was achievable within a single fiscal year, even accounting for the organizational change work that technology timelines rarely budget for.

What Worked: RSA’s Recommendations for Enterprise Passwordless

RSA recommends the following best practices for implementing enterprise-wide passwordless:

Technology Best Practices

Platform architecture comes first. Remove password dependencies from enrollment, recovery, and policies before deploying authenticators. Otherwise, FIDO becomes an add-on, not a replacement, leaving weak links in an organization’s identity chain.

Passwordless enables adjacent security improvements. Help desk verification was a longstanding vulnerability. Passwordless infrastructure made bi-directional live verification feasible, eliminating shared secrets at a critical touchpoint.

Device-bound passkeys in mobile apps offer a third option. Beyond “synced passkeys vs. security keys,” this approach enhances enterprise control, improves UX, and eliminates hardware distribution overhead.

Deployment Best Practices

Leverage existing user behavior. RSA progressed faster because employees already had the mobile app. Organizations should find and prioritize their existing authentication foothold.

Sequence deliberately: alternatives → lower-stakes → high-stakes. Don’t start with the most visible system. Build comfort first.

Deploy broadly, mandate later. Give employees time to adopt on their timeline. Learn what confuses people. Build a network of interested testers across the business and champions.

Campaigns and deadlines outperform either alone. Voluntary adoption will plateau regardless of how good the UX is — plan for it. Social proof matters, but so does urgency. RSA saw a 3x usage increase when it combined them with a clear deadline.

Redundancy Best Practices

Plan for when a method fails or a device goes missing — because it will happen. Passwordless authentication requires deliberate redundancy, both in methods and devices. The FIDO Alliance recommends each user register at least two passkeys when possible for this reason. In the RSA deployment, certain user groups received both a software-based device-bound passkey via the RSA mobile app and a hardware-based device-bound passkey, so that losing access to either one never meant losing access entirely.

RSA’s Organizational Change Best Practices

Budget enough time to drive behavior change. Technology deployment takes weeks. Organizational habit change takes months.

Set ambitious goals, then be transparent about scope. The RSA leadership team mandated 100% passwordless—and that bold target drove the organization much further than a softer goal like “improve authentication” would have. RSA eliminated passwords from all managed endpoints and primary authentication flows. Legacy systems and edge cases exist; RSA documents them and is developing plans to resolve them rather than claiming perfection. Every enterprise will face this reality.

“What’s a passkey?” is a real question. Outside engineering, employees needed education. RSA developed clear analogies and updated documentation to connect the technology to familiar mental models.

Consolidate authenticator methods in a single application. When employees can authenticate via passkey, QR code, or biometric from the same app they already use, compliance doesn’t require behavior change — it just requires a different tap. RSA’s ability to offer the right method at the right moment, without switching apps or adding friction, materially reduced resistance during the mandate rollout.

What This Proved to RSA (and Customers)

Going passwordless internally gave RSA something it couldn’t get from customer pilots or lab testing: live experience with the full complexity of implementing passwordless for everyone.

RSA experienced:

Executive buy-in was critical to getting started Platform integration with existing infrastructure Cross-platform complexity, offline scenarios, heterogeneous devices Ongoing policy refinement as deployment realities emerged Change management that takes months, not weeks Help desk volume during transition The gap between voluntary adoption and mandate Edge cases organizations can’t predict in planning

When customers ask, “how long will this really take?” or “what about employees who resist?” or “what do we do about legacy systems?”—RSA answers from experience, not theory.

RSA moved from passkeys as an R&D experiment to passwordless as its default for managed environments. The organization has validated its platform in production under real enterprise conditions—including the year-long organizational journey most case studies compress into a single paragraph.

That authenticity is what no demo environment can provide.

This process has shaped how RSA contributes to the FIDO Alliance community. RSA will continue working with other members to develop deployment playbooks, implementation guides, and share learnings that help enterprises navigate the same journey. Because the more organizations succeed with passkeys, the more secure all organizations become.

The technical standards are established. Now it’s about helping enterprises deploy them successfully—together.

Read the Case Study

Wars have always targeted the infrastructure of their age. Medieval armies burned granaries. Modern ones target communications and energy installations. The Iranian regime has been true to historical form. Under...

The two-week voting period will be between Sunday, March 29, and Sunday, April 12, 2026, once the 45 day review of the specification has been completed.

The iGov working group page https://openid.net/wg/igov/. 

If you’re not already a member, or if your membership has expired, please consider joining to participate in the approval vote. Information on joining the OpenID Foundation can be found at https://openid.net/foundation/benefits-members/.

The vote will be conducted at https://openid.net/foundation/members/polls/403.

Marie Jordan – OpenID Foundation Secretary

About The OpenID Foundation (OIDF)

The OpenID Foundation (OIDF) is a global open standards body committed to helping people assert their identity wherever they choose. Founded in 2007, we are a community of technical experts leading the creation of open identity standards that are secure, interoperable, and privacy preserving. The Foundation’s OpenID Connect standard is now used by billions of people across millions of applications. In the last five years, the Financial Grade API has become the standard of choice for Open Banking and Open Data implementations, allowing people to access and share data across entities. Today, the OpenID Foundation’s standards are the connective tissue to enable people to assert their identity and access their data at scale, the scale of the internet, enabling “networks of networks” to interoperate globally. Individuals, companies, governments and non-profits are encouraged to join or participate. Find out more at openid.net.

The post Notice of Vote to Approve Proposed Implementer’s Draft of International Government Assurance (iGov) Profile for OAuth 2.0 first appeared on OpenID Foundation.

There Is No Middle: Why Presidents Must Choose a Future-Ready AI Strategy

 

In 1984, Microsoft released Multi-Tool Word. “Total Eclipse of the Heart” was on the radio. Dallas dominated TV. The iPhone didn’t exist, and “software” was barely a word. Forty years later, most university business still plays out in documents, spreadsheets, and slide decks. The files are digital. The metaphors are not.

We still sit at virtual “desktops,” file items in “folders,” and ask IT to “fix” things. If Don Draper wandered into a university boardroom today, he’d be confused by the monitors—but not the metaphors. The real problem? So are we.

We think we’ve modernized. But in truth, higher education is still working off the same conceptual architecture that defined office work in the late twentieth century. The language of “documents” and “files” didn’t come from the academy—it came from business, filtered through Xerox PARC’s vision of the workplace. That vocabulary still shapes what we believe our tools—and by extension, our institutions—are for.

And now higher education is standing in what complexity theorists call a phase shift: a moment where incremental change tips into transformation. AI isn’t coming. It’s already shaping how we teach, learn, govern, and communicate. But the culture of most campuses hasn’t caught up. Leadership still hedges: half-investments, pilot projects, small bets on big change—safe experiments conducted in the corner while the building quietly rewires itself.

There is no middle.

You cannot invest in AI while holding tight to legacy systems designed for stability, siloing, and replication. The strategic logic of these two worlds is incompatible. One optimizes for repetition. The other for emergence. Choosing both is a guaranteed way to fail at both—and exhaust the people asked to maintain the contradiction.

Let’s name the practical constraint: resources. You do not have the staff, time, or money to run two full strategies indefinitely. Legacy environments demand constant maintenance, vendor management, security patching, workarounds, and institutional “muscle memory.” AI-ready environments demand data stewardship, governance, training, experimentation, privacy design, and cross-functional collaboration. Doing both at scale is not “balanced.” It’s an unfunded mandate.

This is not an IT problem. It’s a leadership problem. And like it or not, the technologies you adopt—or avoid—are semiotic acts. They signal who you are, what you value, and whether you're designing the future or defending the past. Boards notice. So do your students. So do your faculty candidates. So do the regional accreditors who increasingly expect evidence of institutional effectiveness—and now, increasingly, evidence of responsible AI use.

To move forward, we must change how we understand computing. Traditional systems ask: “What do you want to automate?” AI asks: “What pattern are you not seeing yet?” It is a telescope, not a typewriter. It doesn’t just speed up the old workflow—it reveals what your workflow has been hiding.

Most institutions are still stuck in a loop: digitalization as paper mimicry, spreadsheets as strategy, IT as janitor. Meanwhile, emerging AI systems thrive on unstructured data—the kind higher ed has in abundance but rarely uses: syllabi, learning outcomes, narrative assessment reports, open-ended survey comments, advising notes, policy archives, web content, exit interviews. This is the goldmine presidents are standing on.

Think about it. You’ve got departments rewriting the same accreditation report every five years from scratch, not realizing they’ve accumulated a decade of language that can be analyzed, improved, and reused with AI support. You’ve got campuses redesigning websites every three years with outside consultants, without first asking an AI to assess tone, clarity, accessibility, and student confusion—at scale—based on real user journeys and feedback. You’ve got leaders sending campus-wide messages without ever seeing how their tone lands across audiences with different histories, identities, and trust levels.

But mining this gold takes more than IT. It takes mindset. It takes governance. It takes cultural accountability from every office that owns data, people, or processes. AI is not a tool you plug in. It’s a campus-wide shift in posture.

This is the uncomfortable part: functional areas must stop outsourcing basic computing and cyber responsibility to IT. If an office can approve a hire, sign a contract, or adopt a cloud service, that office can also own the basics of data stewardship, access control, and secure practices. The age of “I’m not a techie” is over. Not because everyone must become technical—but because everyone is now implicated in the institution’s digital reality. Culture is not soft. Culture is operational.

So what can presidents and provosts do now—without turning this into a 40-page plan that no one reads? Start with clarity, then build capacity.

Stop investing in two futures. Choosing both is choosing neither. Align AI adoption with mission, not convenience. Use AI to augment what you most value: student success, equity, research, public service, learning. Shift IT from break/fix to strategy and enablement. IT must be at the table, not under it. Require data literacy in cabinet-level planning. You don’t need to code—but you must understand how models work, where your data lives, and what “good” looks like. Establish governance that is real, not ceremonial: clear policies for privacy, bias, accountability, and appropriate use—especially when vendors promise “AI” but deliver only a new interface. Craft your narrative. What story is your tech stack telling your board, your students, your accreditors? Are you signaling courage—or caution dressed up as prudence?

Presidents and provosts don’t need to write Python. But they do need to lead. AI is not a product. It is a process of rethinking what your institution is for—and how it will remain relevant. And relevance is not static. It is cultivated.

The coming years will define whether your institution is a participant in the next era of learning—or merely an observer with an expensive set of legacy systems and a dwindling talent pipeline.

There is no middle.

There is only momentum—or drift.

Robert J. Clougherty, Ph.D, AI Lead at Edge, is also the founder of Recursive Meaning AI and a long-time scholar-practitioner exploring the intersections of artificial intelligence, organizational change, and meaning-making in higher education. To connect with Bob, you're invited to email him via robert.clougherty@njedge.net

The post There Is No Middle appeared first on Edge, the Nation's Nonprofit Technology Consortium.

In the early hours of March 1, my screaming phone jolted me out of a Netflix binge in my Abu Dhabi apartment. The sound bypassed silent mode, overrode every setting,...

Crucial Insights Into Identity Threats, Technologies and Trends

The sixth annual 2026 State of Passwordless Identity Assurance report, commissioned by HYPR and produced by 451 Research from S&P Global Energy Horizons, examines the evolving identity threat landscape based on a survey of over 950 security and IT leaders across various industries.

Half of UK IT leaders polled say their organisation is now using passkeys.

Passkeys are emerging into the mainstream as a practical and more secure alternative to passwords, promising a better user experience when signing in to apps and services.

Passkeys replace passwords with hardware bound cryptographic credentials that are tied to the user’s device.

Developed and promoted by the FIDO (Fast IDentity Online) Alliance, passkeys use public-key cryptography to authenticate the user. The user’s device generates a key-pair retains the private key and sends the public key to the app or service, which then verifies the presence of the corresponding private key via a handshake mechanism.

Agentic commerce breaks a core assumption of online payments, that a human is directly clicking “buy” on a trusted surface. Once software can browse, decide, and transact, merchants and networks lose the simplest security primitive: “the customer was here.”

Digital identity is rapidly becoming a cornerstone of modern public services. Across Europe, governments are exploring the implementation of the European Digital Identity wallet (EUDI-wallet) to simplify how citizens interact […]

Surveillance technology in Africa is increasingly being shaped by China. Eleven African countries have collectively spent over $2 billion on artificial intelligence-powered surveillance systems, according to a new study by...

Following DID:UNCONF AFRICA, join Eric Scouten and Gideon Lombard for a conversation unpacking key insights from the event — from emerging use cases and regional challenges to the role of decentralized identity in enabling inclusive, interoperable systems.

DID:UNCONF AFRICA brought together innovators, technologists, and ecosystem leaders in an open, participant-driven format designed to surface real-world perspectives. With discussions shaped by the community itself, the event highlighted the importance of collaboration, local context, and cross-border exchange in advancing digital identity.

In this DIF Hot Takes session, Eric and Gideon will reflect on the themes that stood out and explore how these insights connect to ongoing work across DIF, including decentralized identity standards, trust infrastructure, and digital public goods.

🎥 Join live here

Our Year In Brief

During the leadership transition and throughout FY26, Edge continued to demonstrate operational reliability, technical excellence, and expanding national engagement across the consortium community.

 

Edge maintained 100 percent uptime across its statewide optical and packet network, reinforcing the reliability and resilience that member institutions depend upon for teaching, research, healthcare, and government operations. Backbone modernization initiatives, including continued advancement of high capacity transport upgrades and expanded colocation infrastructure, strengthened the network’s ability to support growing demand for high performance computing, research collaboration, and cloud connectivity.

Cybersecurity remained a central focus as institutions navigate an increasingly complex threat environment. EdgeSecure expanded vCISO engagements, readiness assessments, and institutional planning support. During the reporting period, the network successfully mitigated numerous distributed denial of service attacks targeting member institutions while maintaining uninterrupted service delivery.

Edge also continued expanding its portfolio of services that support institutional digital transformation. Through EdgePro engagements, institutions received guidance on governance, operational modernization, and responsible integration of emerging technologies. The launch of EdgeAI introduced a structured readiness framework that helps institutional leaders evaluate artificial intelligence adoption within a thoughtful governance and policy context.

EdgeScholar continued to expand its impact in digital accessibility and instructional design. Through accessibility audits, course remediation initiatives, and national professional development programming, EdgeScholar strengthened its role as a trusted partner helping institutions meet the growing expectations for accessible and inclusive digital learning environments.

EdgeDiscovery advanced research enablement through collaboration with national partners, federal initiatives, and institutional research programs. These efforts support secure research data environments, cyberinfrastructure development, and collaborative discovery across the research community.

EdgeMarket also experienced significant expansion, extending cooperative procurement services across a growing national footprint that now includes participation from institutions in 28 states. This continued expansion reinforces the consortium’s ability to deliver economic value, simplify procurement pathways, and connect institutions with trusted technology solutions.

During this period, EdgeNet also continued expanding its geographic presence with new institutional connections and service engagements across neighboring states, including Pennsylvania and New York. These expansions reflect the growing recognition of Edge as a trusted research and education network partner beyond its original regional footprint.

Collectively, these developments demonstrate the continued strength and relevance of the consortium model. Through reliable infrastructure, trusted partnerships, and mission driven collaboration, Edge continues to help institutions navigate an increasingly complex technology environment while advancing shared goals of innovation, access, and institutional resiliency.

From Vision to Value

Edge’s mission has always centered on helping institutions translate technological innovation into meaningful institutional value. As education, healthcare, and government organizations confront accelerating digital transformation, the importance of trusted technology partnerships continues to grow.

The landscape facing institutional leaders is evolving rapidly. Artificial intelligence, cybersecurity risk, cloud computing, research data growth, and digital learning transformation are reshaping expectations for technology infrastructure and governance. Institutions must navigate these changes while preserving accessibility, affordability, and long term operational sustainability.

Edge was established to help institutions navigate precisely this type of technological inflection point. By combining high performance networking, shared services, strategic advisory support, and collaborative community engagement, the consortium enables institutions to leverage technology not simply as infrastructure but as a strategic capability.

Over the past two decades, Edge has evolved from a regional networking initiative into a nationally recognized research and education network organization. The consortium model allows member institutions to benefit from shared infrastructure, collective expertise, and cooperative procurement advantages while preserving the autonomy and mission focus of each organization.

During the past fiscal cycle, Edge continued strengthening its internal operational foundation while expanding services that directly support institutional transformation. Through disciplined financial stewardship and strategic service growth, the organization is continuing its long history of financial stability while investing in infrastructure modernization, cybersecurity protection, digital accessibility leadership, and research enablement.

Today, Edge continues to expand its impact across several critical domains including research cyberinfrastructure, digital accessibility, cooperative procurement, cybersecurity resilience, and strategic guidance surrounding emerging technologies such as artificial intelligence. These efforts reflect the consortium’s ongoing commitment to supporting institutions as they adapt to the demands of an increasingly digital and interconnected world.

Looking ahead, Edge remains committed to building on its legacy of collaboration and innovation. By strengthening infrastructure, expanding national partnerships, and continuing to align services with the evolving needs of member institutions, the consortium is well positioned to support the next generation of technological advancement across education, government, and healthcare.

Through this work, Edge continues to fulfill its mission of connecting institutions, strengthening communities, and enabling the technology driven progress that defines the digital era.

The post Our Year In Brief appeared first on Edge, the Nation's Nonprofit Technology Consortium.

Earlier this month, nearly a thousand people lined up outside Tencent’s headquarters in Shenzhen to get a piece of software installed on their devices. The crowd — which included students,...

Mastercard has unveiled Verifiable Intent, a new open, standards-based trust framework co-developed with Google, designed specifically for “agentic commerce” — a world where artificial intelligence (AI) systems don’t just assist shoppers, but actively plan, decide, and complete purchases autonomously.

Every time an AI agent makes a purchase, three questions hang over the transaction. Did the consumer actually authorize this? Did the agent follow instructions exactly? And if something goes wrong, can anyone prove it? The payments, AI and merchant sectors are all looking for universal answers to those questions. Mastercard is pitching a new standard as the solution.

As a largely mobile-first region, there is widespread innovation, especially in payments. At the same time, bad actors are exploiting technologies and processes, putting this progress at risk.

That is why we are excited to announce the launch of the FIDO Americas Adoption Forum (FAAF). This is a new initiative designed to advance open standards and accelerate market adoption across the region. It aims to uncover new opportunities to provide simpler and safer authentication with FIDO technologies in the Americas. Initially, the Forum will be focused in Latin America, given its potential.

Chinese cities are offering free apartments and converting idle data centers into incubators as they compete to attract “one-person companies,” or OPCs — startups run by a single founder with...

In December 2025, the OpenID Foundation announced the forthcoming launch of self-certification for OpenID for Verifiable Credentials. Since then, the OpenID Foundation has been working to confirm the organisations who will help shape the next phase – a globally recognised independent conformance test program. 

Today, we are pleased to introduce the organisations that will play a key role in ensuring digital identity implementations meet the highest standards of quality and interoperability worldwide. They are BixeLab, FIDO Alliance, Inc., Fime, Raidiam and TrustID Solutions. Additional testing service providers are currently going through the onboarding process and will be announced as the program progresses.

Ted Dunstone, CEO and Founder of BixeLab, said: “These organisations have signed a Memorandum of Understanding with the OpenID Foundation, committing to collaborate as testing service providers in the forthcoming independent conformance test program. At BixeLab, we see firsthand how independent testing underpins trust in digital identity systems. The OpenID Foundation’s initiative is a significant step in scaling consistent, high-quality conformance testing globally, supporting more reliable and interoperable deployments.”

Andrew Shikiar, Executive Director and CEO of FIDO Alliance, Inc., said: “OpenID Foundation’s work has been instrumental in advancing interoperable identity standards, and we’re pleased to support the next phase of its conformance program by serving as an Approved Testing Service Provider. Expanding access to independent testing helps implementers efficiently demonstrate conformance with OpenID specifications while strengthening interoperability across the identity ecosystem. FIDO’s experience operating global certification programs will help ensure this testing is delivered with the rigor and scale needed to support growing market adoption.”

Ralph Bragg, CTO and Co-Founder of Raidiam, said: “The OpenID Foundation’s new independent conformance test program is a big step forward for the digital identity community. At Raidiam, this is work we know inside out – we’ve been running production‑grade conformance services for years, across some of the largest open banking and open finance ecosystems worldwide. Building on the Foundation’s own methodologies, we’ve extended those frameworks to deliver hundreds of thousands of functional test cases – including nearly half a billion test executions for Open Finance Brazil in 2025. We’ve proven what true scale and assurance look like in live production settings – and we’re excited to bring that experience to help set a new global standard for digital identity.”

Tomas Horvath, Managing Partner of TrustID Solutions, said: “In our vision of the future, digital identity ecosystems will evolve rapidly over the coming years, reshaping trust infrastructure globally. As these ecosystems expand, sustaining trust and true interoperability will depend on wallet solutions and relying party verifiers remaining secure, stable, and continuously aligned with open standards. Scalable and trustworthy conformance testing is therefore going to be foundational infrastructure for digital trust.At TrustID Solutions, we have spent the past year developing a robust validation framework to address this need, and we are proud and excited to join forces with the OpenID Foundation to elevate compliance testing to an international level.”

A framework built for scale

The participation of these organisations comes at a crucial time. Digital wallets, verifiable credentials, and open data are reshaping how governments, businesses, and individuals interact online. Across 38 jurisdictions, including the EU, UK, US, and the Balkans, digital identity and open data ecosystems are converging on the same core OpenID Foundation specifications: OpenID for Verifiable Presentation, OpenID for Verifiable Credential Issuance and the High Assurance Interoperability Profile.

The scale of this convergence is significant. With 60 countries already pursuing digital identity initiatives and 90 pursuing open data programs, it is clear that these specifications have become the framework of choice for governments and organisations that require interoperability, security, and operational scale across complex public–private environments.

A proven foundation 

The OpenID Foundation’s existing self-certification service has already facilitated more than 4,500 successful implementations across Brazil, the UK, Australia, the UAE, Saudi Arabia, and the United States. Proving interoperability in practice is central to the OpenID Foundation’s work. In 2025, the OpenID Foundation hosted 15 interoperability events spanning four specification families – OID4VC, OpenID Federation, Shared Signals, and AuthZEN. They demonstrated these specifications work reliably across diverse implementations and real world conditions. 

As adoption scales, so too must the conformance infrastructure that supports it. The OpenID Foundation is launching an internationally recognized independent conformance test program in Q2 2026 to set a global standard for quality and interoperability. Complementing the existing self-certification service, it will give ecosystems a conformance pathway that fits their local regulatory and sovereignty requirements.

About the OpenID Foundation

The OpenID Foundation (OIDF) is a global open standards body committed to helping people assert their identity wherever they choose. Founded in 2007, we are a community of technical experts leading the creation of open identity standards that are secure, interoperable, and privacy preserving. The Foundation’s OpenID Connect standard is now used by billions of people across millions of applications. In the last five years, OAuth2 – the FAPI standard for interoperable, high security – has become the standard of choice for Open Banking and Open Data implementations, allowing people to access and share data across entities. Today, the OpenID Foundation’s standards are the connective tissue that enable people to assert their identity and access their data at scale, the scale of the internet, enabling “networks of networks” to interoperate globally. Individuals, companies, governments and non-profits are encouraged to join or participate. Find out more at openid.net.

To learn more about conformance testing and self-certification, please visit the OpenID Foundation’s FAQ section.

 

The post Leading organisations join OIDF independent conformance test program first appeared on OpenID Foundation.

In 2016, I chose the term “self-sovereign identity” to describe what identity systems should protect. But the community I helped to build has been getting captured, as evidenced by EU wallet regulations and ISO standards that are consolidating around the same platform gatekeepers we set out to displace. I’ve been looking for the right word to describe the issues with what’s happening to digital identity for a long time.

“Privacy” doesn’t name the problem any more because it means something different to every regulator in the room. “Decentralization” became a buzzword, but it no longer prevents coercion due to compromises. “Interoperability” has been similarly corrupted by EUDI wallets that claim the term while depending on Apple and Google attestation infrastructures.

Martina Kolpondinos, who spent 15 months inside the Swiss federal eID team and is a co-editor on the WebVH spec, has just published a piece1 that may offer an answer by naming the pattern we keep running into: Technology Paternalism.

The term goes back to Spiekermann & Pallas2, who argued that ubiquitous computing raises concerns beyond privacy: specifically, whether people can maintain control when systems decide for them. They proposed “the right for the last word”: the ability to overrule autonomous system behavior. Unfortunately, twenty years later, things are worse, not better: 84% of organizations doubt they can even audit their AI agents3.

In my upcoming Architecture of Autonomy work, I’ve mapped how legal protections designed as shields against coercion get inverted in digital systems: property becomes privilege, contracts become coercion, due process becomes algorithmic absolutism, and exit becomes erasure. Kolpondinos shows how these same inversions manifest as paternalistic “features.” She does so by building a four-part taxonomy for Technology Paternalism:

• Design Paternalism. The “quick setup” for systems is prominent, and “advanced” settings are buried. You aren’t forced, but you are guided to a preferred usage pattern.

• Algorithmic Paternalism. Systems pre-select what you see. The defaults require no action, but choosing diversity requires effort.

• Infrastructural Paternalism. Your credentials, reputation, and relationships accumulate in a single ecosystem. Though you can leave, you leave empty-handed. This is what happens when the “interoperable” standard requires a specific device stack.

• Protective Paternalism. Restrictions are framed as safety. If you question them, you sound irresponsible. This is what silences objections in standards bodies. As discussed in the replies to Martina’s post, we ultimately want to annotate information, not censor it. This doesn’t suppress contradicting claims, but instead holds them as attributable, visible, and resolvable. That’s the kind of trust infrastructure we should be building: systems that make reasoning inspectable, not systems that decide for you.

Fundamentally, this paternalism is all coercion: it’s taking away your choices and replacing them with the designer’s choices. This is an increasing problem in technological spaces, and fighting coercion (through anti-coercion or coercion resistance) is definitely something that could replace our old buzzwords such as “privacy”, “decentralization”, and “interoperability”.

Vitalik Buterin recently discussed the issues when he published the Ethereum Foundation mandate4, three days before Martina’s article. There, he frames Ethereum as “sanctuary technology”, designed to “support technological self-sovereignty and allow cooperation without centralized coercion.” His CROPS priority stack (Censorship resistance, Open source, Privacy, Security) tracks the same concerns from the protocol layer.

We’ve also been developing coercion-prevention lenses5 in the Revisiting Self-Sovereign Identity initiative (revisitingssi.com). Kolpondinos’s article is the first published output from a workshop participant, and it translates the identity community’s coercion analysis into language the broader design community can use.

Ultimately, I think “technology paternalism” and “coercion resistance” work as a pair. Paternalism offers the diagnosis: it names an anti-pattern. Coercion-resistance then provides the treatment. Both do more work than “privacy” because they name the mechanism, not just the domain.

However, Technology Paternalism is harder to fight than outright ideology because it embeds moral choices in technical decisions and then presents them as neutral engineering. You could argue with someone if they were making an unvarnished moral claim, but you can’t easily argue when they say “that’s just how the protocol works.”

But Kolpondinos’ four countermeasures are a great response. She suggests tests that I wish every identity project would apply: Can you override the system’s decision? Contest it? Inspect the reasoning? Leave without losing everything?

Apply that to any wallet architecture currently in standardization.

Read Martina’s article, “Technology Paternalism Expands — A Case for Self-Sovereign Identity”: https://www.kosmaconnect.net/interactionblog/technologypaternalism

Citations

#DigitalIdentity #SelfSovereignIdentity #CoercionResistance #TechnologyPaternalism

Technology Paternalism: AI, Algorithms, Digital Identity, and the Role of Self-Sovereign Identity (2026). [web article]. Kolpondinos, Martina. KosmaConnect, March 16, 2026. Retrieved 2026-03-17 from: https://www.kosmaconnect.net/interactionblog/technologypaternalism

“Four forms of technology paternalism and four countermeasures to restore user agency”

↩

Technology Paternalism — Wider Implications of Ubiquitous Computing (2006). [journal article]. Spiekermann, Sarah; Pallas, Frank. Poiesis & Praxis, 4, 6-18. DOI: 10.1007/s10202-005-0010-3. Available from: https://link.springer.com/article/10.1007/s10202-005-0010-3. Also available from SSRN: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=761111

“The originating paper on technology paternalism and the right to the last word in ubiquitous computing”

↩

Securing Autonomous AI Agents Survey Report (2026). [web article]. Cloud Security Alliance; Strata Identity. February 2026. Retrieved 2026-03-18 from: https://cloudsecurityalliance.org/press-releases/2026/02/05/cloud-security-alliance-strata-survey-finds-that-enterprises-are-in-time-to-trust-phase-as-they-build-ai-autonomy-foundations

“84% of organizations doubt they can audit their AI agents — empirical evidence of the governance gap”

↩

Ethereum Foundation Mandate (2026). [policy document]. Ethereum Foundation. March 2026. Retrieved 2026-03-18 from: https://ethereum.foundation/ef-mandate.pdf

“Ethereum as sanctuary technology — support technological self-sovereignty and allow cooperation without centralized coercion”

↩

Coercion-Resistance Lenses (2025–2026). [web resource]. Revisiting Self-Sovereign Identity Initiative. Retrieved 2026-03-18 from: https://revisitingssi.com/lenses/briefs/coercion-resistance/

“Coercion-prevention lenses and revised principles for the Self-Sovereign Identity 10th anniversary”

↩

This year, we welcome a new chair, vice chair, and four new members to the LF Decentralized Trust Technical Advisory Council (TAC). The 11 members of the TAC, elected under the charter of LF Decentralized Trust, provide the technical governance across the LF Decentralized Trust (LFDT) ecosystem. The members are each leaders in one or more of the projects hosted by LFDT. They contribute their time as TAC members to steward the technical vision for LFDT and ensure transparency, consistency, and collaboration across projects.

The OpenID Foundation is pleased to welcome JumpCloud as a new Sustaining Corporate Member. 

JumpCloud is the AI-powered unified IT management platform designed to secure the modern workforce. By consolidating identity, device, and access management, JumpCloud provides intelligent, secure IT that scales from human users to autonomous AI agents.. JumpCloud helps organizations around the globe eliminate complexity and turn AI risk into an optimized advantage, ensuring the right people and agents have secure access to the right resources at all times.

Their membership reflects growing recognition across the industry that open identity standards are central to addressing the evolving security challenges created by AI agents and the modern, decentralised enterprise. Their participation brings valuable perspective on a rapidly emerging identity challenge: how to securely manage autonomous AI agents operating across platforms on behalf of users and organisations.

“Our membership in the OpenID Foundation isn’t just about supporting existing standards; it’s about helping to make sure the industry has a unified way forward as those standards are adopted for AI and other use cases,” said Joel Rennich, senior vice president of product management, JumpCloud. “We very strongly believe that the answers to tomorrow’s identity challenges lie in the industry working together to ensure vendors, service providers, and users have a standards-based approach to identity management.”

This is an area the OpenID Foundation has been actively working to address. The Foundation recently published a whitepaper on AI agent identity management, exploring how existing and emerging OpenID standards can provide the technical foundation for securing agentic AI systems, ensuring agents can be authenticated, authorised, and held accountable as they perform complex tasks on behalf of users and organisations.

JumpCloud’s commitment to promoting a standards based approach to identity management across vendors, service providers, and users aligns closely with this work. As a Sustaining Corporate Member, JumpCloud joins other global thought leaders on the Foundation’s Board of Directors from the identity, digital platform and ecosystem communities, who jointly ensure the Foundation delivers on its mission as an open standards body. 

The OpenID Foundation has long maintained that robust, interoperable identity standards depend on broad industry collaboration, and JumpCloud’s membership strengthens that collective effort.

Gail Hodges, Executive Director of the OpenID Foundation, said: “We are very pleased to welcome JumpCloud to the OpenID Foundation. Their focus on extending identity management beyond human users to autonomous AI agents speaks directly to the work our community is doing to ensure open standards keep pace with the realities of the modern enterprise. 

“We look forward to their active involvement in shaping the next generation of identity standards as AI driven use cases continue to place new demands on the protocols that underpin digital trust.”

About the OpenID Foundation

The OpenID Foundation (OIDF) is a global open standards body committed to helping people assert their identity wherever they choose. Founded in 2007, we are a community of technical experts leading the creation of open identity standards that are secure, interoperable, and privacy-preserving. The Foundation’s OpenID Connect standard is now used by billions of people across millions of applications. In the last five years, OAuth2 – the FAPI standard for interoperable, high security – has become the standard of choice for Open Banking and Open Data implementations, allowing people to access and share data across entities. Today, the OpenID Foundation’s standards are the connective tissue to enable people to assert their identity and access their data at scale, the scale of the internet, enabling “networks of networks” to interoperate globally. Individuals, companies, governments and non-profits are encouraged to join or participate. Find out more at openid.net.

To learn more about conformance testing and self-certification, please visit the OpenID Foundation’s FAQ section.

The post JumpCloud joins the OIDF as a Sustaining Corporate Member first appeared on OpenID Foundation.

March 2026

DIF Website | DIF Mailing Lists | Meeting Recording Archive

Table of contents Decentralized Identity Foundation News Working Group Updates Upcoming Events Get involved! Join DIF 🚀 Decentralized Identity Foundation News

The big highlight for the last month is the contribution of MCP-I from Vouched ID. Check out all of our highlights:

Identities for AI Agents is an enormous challenge and DIF is honored to accept the contribution of MCP-I from Vouched-ID. The framework will be discussed and tweaked through the Trusted AI Agents Working Group. We strongly encourage anyone interested in Agentic AI identity to join this very practical implementation working group to give input and prototype the specifications as we lead the way towards an open source solution for Agentic AI accountability and safety. Membership in DIF is free for organizations smaller than 500 people. Updates from the new Executive Director: Grace Rachmany gives updates on her thoughts for the direction of DIF in 2026. DIF’s Hospitality and Travel Working Group has released the first published schema for the Hospitality and Travel Profile (HATPro). MCP-I Contribution from Vouched

We are incredibly excited to announce that Vouched is formally donating the Model Context Protocol–Identity (MCP-I) specification (temporary name) to the Decentralized Identity Foundation. This contribution will serve as the foundation for our community to develop an open, interoperable standard for identity and delegation in the age of AI Agents.

As AI agents increasingly handle online interactions on behalf of humans—booking travel, managing accounts, and placing orders—the fundamental question of trust has become critical: Which agent is this, who authorized it, and what is it permitted to do? The current internet infrastructure simply isn't built to answer these new identity challenges.

The Trusted AI Agents Working Group will be driving work on the specification to promote its use and implementation.

Read more here

Update from the Executive Director

After three months in the role as Executive Director, I wanted to say a few words about the direction for DIF in 2026. The caveat is that these are preliminary directions: we need to have some deeper discussions on the Steering Committee before these become official policy, but I can say a few things about the direction that DIF has been taking.

The biggest shift for DIF is moving towards identity solutions in areas affected by AI. Three of our working groups (TAAWG, H&T, and CAWG) are researching and developing work that addresses different aspects of AI. 

The most obvious is our Trusted AI Agents Working Group (TAAWG), which was still in early phases when I joined. In the course of the last few months, the group has taken on a number of workstreams and are forming a strategy around one of DIF’s historical weaknesses: bringing a specification into production use within DIF. While many DIF specifications are widely used, typically the implementations have been done by other organizations outside of DIF. Around the recent contribution of MCP-I (working name) from Vouched, a coalition of startups has formed to develop one or two use cases and put them into prototyping. 

The most encouraging trend in DIF is the collaboration among the groups. The Hospitality and Travel Group (H&T) has been hard at work with their use cases and is starting to work with members of TAAWG because many of their use cases relate to how Agents are used in the travel industry. Similarly, in the last week, the Creator Assertions Working Group (CAAWG) is looking at how Trusted Agents will play a role in acting on behalf of the content creators. CAAWG, at its core, is all about how to identify content produced by humans, from news content to artist creations. Needless to say, AI is playing a huge role in how CAAWG is developing its standards. 

Agentic AI has an even stronger use case for decentralized AI than human identification. Agents can be spun up and spun down rapidly, having much more ephemeral existence than most humans. From that perspective, it’s easy to see how centralized databases identifying agents make no sense at all. If the Agent only exists for a few months, there’s no need for long-term centralized storage of identity information. Right now, DIF is actively interested in getting wide representation in the Agent-centric working groups to develop standards that hold up for a variety of use cases, and to show prototypes that can work in multiple industries. As one of the fastest-moving bodies for creating identity specifications, DIF is well-positioned to provide specifications and proto-standards fast enough to keep up with AI developments. And although DIDcomm was developed with person-to-person communication in mind, it’s singularly well-architected for transient communications among agents and devices as well. 

However, this is a significant shift for DIF. Much of our work to date was focused on human identity, and most of our working groups are still around human identity and human communication. Our mission and vision was focused around human agency, privacy, and autonomy. Clearly, Agentic AI impacts all of these areas, and it is critical for us to address this technology. We would love to hear your feedback about how you see this trajectory, and how you see DIF’s role. 

One of the most elegant attributes of DIF is its ability to shift focus along with the shifting focus of its members. At the same time, I want to say this out loud. The amount of energy on Agentic and non-human transactions may surpass the amount of energy being put into human identities if DIF continues on this trajectory. As Executive Director, it is not my role to make major strategic changes such as this one: that is up to the Steering Committee. Therefore, we will be taking the time to discuss what it means for the organization to be shifting in this direction, and how we will balance the different interests of long-term as well as new members.

🛠️ Working Group Updates

Browse our working groups here

Creator Assertions Working Group

CAWG spent a significant amount of time this month exploring the use of Trust Registries, including several presentations and the creation of two work streams around different governance models for (issuer, credential, and even verifier) registries and how these relationships can be modeled in credentials and verified. CAWG reached consensus regarding the shared responsibility of CAWG and Industry ecosystems to create governance frameworks and mechanisms supporting interoperable trust registries similar to those demonstrated by the IPTC; discussions are proceeding in parallel across various subgroups and liaison associations about possible backwards-compatible architectures. The group also started exploratory work on how to potentially embed and/or link to consent and rights assertions, which are more variable and nuanced (and changeable over time) than the simpler data model for Training and Data Mining Assertions already specified.

👉 Learn more and get involved

Trusted AI Agents Working Group

In the last four meetings, the Trusted AI Agents Working Group has continued refining the Agentic Authority Use Cases report, with discussions centered on how authority, delegation, and accountability can be expressed when agents act on behalf of people or organizations. The goal is a coarse "checklist" of desired capabilities and usecases, with which to execute a high-level assessment of "fitness for purpose" among various family trees of prior art.

Recent conversations focused on concrete scenarios — exploring how agents might authenticate, present credentials, merge credentials and permissions (or not), hold secrets (or not), and operate within clearly scoped boundaries. The group also discussed where existing DID and VC building blocks are sufficient, and where new patterns may be needed to support agent-to-agent interactions without eroding human control.

👉 Learn more and get involved

Hospitality and Travel Working Group

DIF’s Hospitality and Travel Working Group has released the first published schema for the Hospitality and Travel Profile (HATPro). HATPro enables a traveler or other consumer to easily send highly detailed preferences to travel suppliers and intermediaries, in order that they can create and deliver more personalized experiences. The standard already encompasses more than 1200 items, with early efforts focused on self-attested identity and communications preferences, dining preferences, and substance exposure risks. Accessibility requirements and lifestyle preferences will be added soon.
 
The core architecture for HATPro preferences allows a traveler to identify requirements and prohibitions as well as likes and dislikes. It uses a sliding scale to support the ranking of preferences (as in, I like most red wine, but I like Bordeaux better than Burgundy, and Burgundy better than Cotes du Rhone). It is being expanded to include detailed preferences for a hundred or more distinct travel, hospitality, and leisure sectors, including big ones like airlines and hotels, and niche activities like cooking classes, scuba diving, and bungee jumping. The working group is starting to actively engage with experts who can advise on the information operators need to effectively personalize experiences.
 
While the profile will ultimately contain thousands of nodes, there is no expectations that individuals would complete them all, or even a significant portion. Rather, fill out just what matters to them the most, or their AI agent can observe their behavior over time and propose updates that the traveler can accept, modify, or reject. Once information is in their HATPro profile, they can share it (in full, selectively, or progressively) with any operator or intermediary simply by pressing a button on their phone.  The data exchanges are designed to be fully compliant with regulatory requirements such as GDPR. While designed for decentralized SSI, the schema is in fact agnostic to the communications protocol and fully consumable by legacy systems.
 
The schema is currently being staged into the DIF GitHub repository, but an early version is already available on a SharePoint site. The latest links can be found at https://htwg.identity.foundation/hatpro/

👉 Learn more and get involved

DID Methods Working Group

The DID Methods Working Group is making progress towards establishing selection criteria and accepting proposals for DID methods. They are evaluating mechanisms for measuring decentralization of methods, and recently evaluated the potential of self-certifying identifier methods. After an extended methodological (no pun intended) discussion, the "review period" has been paused for did:webs and did:webplus to remediate last-minute objections.

👉 Learn more and get involved

Identifiers and Discovery Working Group

The Identifiers and Discovery Working Group, along with its subgroups focusing on DID Traits and did:webvh, continues to make substantial progress towards specification readiness. Christian Saucier, new co-chair of DID Methods WG, came to the I&D call to workshop some universal-resolver ergonomics issues. The did:webvh group has been focusing on some upstream negotiations with the DID WG at W3C over DID URL pathing.

👉 Learn more and get involved

Applied Crypto Working Group

The Crypto BBS+ Work Item group discussed the progress of a new method called did:webplus, which is being finalized to align with cryptographic standards like Blake3 and SHA-3. The internet draft for the CFPG WG at IETF has been read and reviewed by the WG chairs.

👉 Learn more and get involved

If you are interested in participating in any of the Working Groups highlighted above, or any of DIF's other Working Groups, please click join DIF.

📢 Upcoming Events

Will you be attending any upcoming Identity events? Let us know so other DIF members can find you!

4th International Workshop on Trends in Digital Identity (TDI)

📅 April 20-21, 2026
📍 Verona, Italy
Learn more

KERICONF

📅 April 21-23, 2026
📍 Lehi, Utah USA
Learn more

Internet Identity Workshop IIWXLII #42

📅 April 28–30, 2026
📍 Mountain View, CA
Registration and details

Agentic Internet Workshop #2

📅 May 1, 2026
📍 Mountain View, CA
Learn more

Identiverse 2026

📅 June 15–18, 2026
📍 Las Vegas, NV
Conference details

Identity Week Europe 2026

📅 June 9–10, 2026
📍 Amsterdam
Event information

Call for Co-organizers: GDC 2026

The 2026 Global Digital Collaboration Conference has been announced for September 1-2, 2026, in Geneva. DIF is on the co-organizing committee

👉Are you a DIF member with news to share? Email us at communication@identity.foundation with details.

🆔 Join DIF!

If you would like to get in touch with us or become a member of the DIF community, please visit our website or follow our channels:

Follow us on Twitter/X

Join us on GitHub

Subscribe on YouTube

🔍

Read the DIF blog

New Member Orientations

If you are new to DIF join us for our upcoming new member orientations. Find more information on DIF’s slack or contact us at community@identity.foundation if you need more information.

From medieval monks who banned tools to weavers burning looms in the 17th century, people have long resisted technologies that they thought would take their jobs or otherwise hurt them....

our current roadmap

Although we're closing on May 1st, WAO has just got time to squeeze one more project. It's with INASP, an international development organization with over 30 years’ experience of working with a global network of partners in Africa, Latin America and Asia.

One of the initiatives INASP coordinates is Rising Scholars, a free online programme offering mentoring and collaboration, online courses and resources to early career researchers. Over 14,000 community members from 175 countries come together in a collaborative space for researchers, practitioners and professionals to connect around research projects, ideas and funding opportunities.

We're helping INASP reimagine the Rising Scholars web presence, as part of some wider digital strategy work we started with them last December.

Over the next couple of months, we'll interrogate at the user experience (UX) of Rising Scholars and figure out the features needed to help this community thrive. We want to make it easier for learners and partners to understand the overall offer of Rising Scholars, as it's currently difficult to see the vibrant community from public‑facing sites. We also want to set a strong foundation for future INASP initiatives.

To do so, we need to talk to people and discover their needs and behaviours.

cc-by-nd Bryan Mathers for WAO

We’re kicking off the project with user research to help us understand what Rising Scholars need and want from a new platform. We'll be searching for a big, bold vision for the future of the digital presence for the Rising Scholars community.

Although some user needs have already been uncovered, the integration between Rising Scholars and other INASP learning offerings and processes is an opportunity to make decisions that help Rising Scholars make better connections.

Given INASP’s context, we will need to think about choosing tools and strategies that work reliably in low‑bandwidth contexts where partners and users often operate.

As ever, we’re excited to work on this project in the open and are pleased to be working with an organisation that is supporting researchers, learners and partners in the Global South.

Blockchain Commons has been selected to join the Advocacy Co-Organizers Group for the Global Digital Collaboration Conference 2026 in Geneva, Switzerland. It joins a diverse group of four other digital advocacy organizations in this role: Blockchain Governance Initiative Network (BGIN); Centre for Digital Public Infrastructure; PolicyLab Africa; and the International Federation for Economic Development.

The Global Digital Collaboration Conference debuted in 2025 as a meeting place to promote interoperable infrastructure for digital identity. It uniquely includes not just open-source and standards organizations, but also many governments that are even now deploying government-sponsored digital identity systems.

Blockchain Commons came into the GDC conference via our work with Switzerland on Swiss e-ID, where we made an invited presentation at the Participation Meeting following Swiss adoption of “electronic proof of identity.” We are pleased to keep working with the Swiss Confederation as the hosts of GDC and with the other co-organizers of the conference.

GDC is scheduled for September 1-3, 2026 in Geneva, Switzerland. The conference draws approximately 2,000 participants by invitation only. As part of the Advocacy Co-Organizers Group, our coalition of five organizations shares an allocation of 40 invitations—though additional spots may become available if other co-organizer groups don’t use their full allocations. Let us know if you’d like to attend or if you have specific topics you’d like to see addressed, and we’ll do our best to propose sessions and issue invites as needed!

The OpenID eKYC & IDA WorkingGroup recommends the following OpenID Implementer’s Draft:

OpenID Connect Advanced Syntax for Claims (ASC) 1.0: https://openid.net/specs/openid-connect-advanced-syntax-for-claims-1_0-01.html

This would be the first Implementer’s Draft of this specification.

An Implementer’s Draft is a stable version of a specification providing intellectual property protections to implementers of the specification. This note starts the 45-day public review period for the specification draft in accordance with the OpenID Foundation IPR policies and procedures. Unless issues are identified during the review that the working group believes must be addressed by revising the draft, this review period will be followed by a seven-day voting period during which OpenID Foundation members will vote on whether to approve this draft as an OpenID Implementer’s Draft. For the convenience of members who have completed their reviews by then, voting will actually begin a week before the start of the official voting period.

The relevant dates are:

Implementer’s Draft public review period: Monday March 16, 2026 to Thursday, April 30, 2026 (45 days) Implementer’s Draft vote announcement: Friday, April 24, 2026 Implementer’s Draft official voting period: Friday, May 1, 2026 to Friday, May 15, 2025

The eKYC & IDA working group page: https://openid.net/wg/ekyc-ida/.

Information on joining the OpenID Foundation can be found at https://openid.net/foundation/members/registration. If you’re not a current OpenID Foundation member, please consider joining to participate in the approval vote.

You can send feedback on the specifications in a way that enables the working group to act upon it by (1) signing the contribution agreement at https://openid.net/intellectual-property/ to join the working group, (2) joining the working group mailing list at openid-specs-ekyc-ida@lists.openid.net, and (3) sending your feedback to the list. 

 

Marie Jordan – OpenID Foundation Board Secretary

 

About The OpenID Foundation (OIDF)

The OpenID Foundation (OIDF) is a global open standards body committed to helping people assert their identity wherever they choose. Founded in 2007, we are a community of technical experts leading the creation of open identity standards that are secure, interoperable, and privacy preserving. The Foundation’s OpenID Connect standard is now used by billions of people across millions of applications. In the last five years, the Financial Grade API has become the standard of choice for Open Banking and Open Data implementations, allowing people to access and share data across entities. Today, the OpenID Foundation’s standards are the connective tissue to enable people to assert their identity and access their data at scale, the scale of the internet, enabling “networks of networks” to interoperate globally. Individuals, companies, governments and non-profits are encouraged to join or participate. Find out more at openid.net.

The post Public Review Period for Proposed Implementer’s Draft of OpenID Connect Advanced Syntax for Claims (ASC) 1.0 first appeared on OpenID Foundation.

Can a $40 smartphone bring Africa online? On March 3, the GSMA, a global advocacy and lobby group for the mobile communications industry, announced partnerships to pilot $40 smartphones in...

Everyone is racing to give AI a better memory. Anthropic just shipped it for Claude. OpenAI built it into ChatGPT. Google wired it into Gemini. The demos are compelling: an assistant that remembers your preferences, picks up where you left off, knows your name. It’s genuinely useful. It’s also solving only a small part of the problem.

The memory wars playing out between the big AI labs are all fighting over a single use case: one human, one AI, one conversation thread. Make it feel continuous. Make it feel personal. That’s the battleground.

But the world we’re building into doesn’t look like that.

The next wave of AI isn’t a single assistant remembering your coffee order.

It’s dozens of agents — research agents, analysis agents, coding agents, coordination agents — working in parallel, handing off to one another, building on each other’s work.

In that world, the question isn’t “does my assistant remember me?” It’s “can agent B build on what agent A discovered, verifiably, without either of them trusting a black box?”

That question just became urgent, as Andrej Karpathy released autoresearch — a system in which AI agents iterate on machine learning experiments autonomously. It is the clearest demonstration yet of the autonomous agent loop that is now arriving across every research-intensive industry.

But autoresearch also exposes the shared memory problem in sharp relief. A single agent looping on a single machine is powerful. A swarm of agents looping across institutions, accumulating findings, building on each other’s results — that requires something fundamentally different: memory that is shared, verifiable, and owned by no single party.

OriginTrail Decentralized Knowledge Graph v9 is built to provide at the infrastructure level, not the feature level (launching as an early testnet, significantly advancing key features of the DKG v8 intended for AI agents).

This article explains why the personal memory products from the major AI labs cannot fill that role — and how the Decentralized Knowledge Graph addresses it at the infrastructure level, not the feature level. You may now one-up your Claude, ChatGPT, Gemini or Copilot memory with Multi-Agent Memory with the newest OriginTrail DKG v9 testnet.

Take DKG v9 for a spin in a multiplayer game of OriginTrail (keep reading to find the installation instructions) to understand how you can immensely improve the performance of your AI agents with a multi-agent memory!

The next frontier of AI memory isn’t personal — it’s shared, verifiable, and multi-agent.

What the Major AI Memory Solutions Actually Are (and Aren’t)

Every major AI memory product is optimised for the same use case: personal continuity for a single user interacting with a single AI assistant, within a single vendor’s ecosystem. Make it feel seamless. Make it feel personal. Keep it closed.

This is a rational product strategy. When memory lives inside your platform, it creates lock-in.

Lock-in creates retention. Retention creates revenue.

None of those incentives point toward the open, verifiable, multi-agent memory layer the next wave of AI actually needs.

The problem everyone is ignoring

As the AI field floods toward agentic systems — multi-agent pipelines, autonomous research loops, agent societies running on decentralized infrastructure — a different memory problem becomes critical: shared ground truth.

When Agent A finishes a research task and hands it off to Agent B, what is Agent B working from? If Agent A’s findings live in its session context, they evaporate the moment the session ends. If they’re written to a database somewhere, who controls that database? Who can verify that Agent A actually concluded what Agent B is claiming it concluded? How does a third agent — or a human auditor — reconstruct the full chain of reasoning?

These aren’t edge cases. They’re the foundational questions of any serious multi-agent system, not limited to :

Coding Agents — from Claude Code to Cursor, all getting adopted incredibly fast by the tech industry Autonomous Financial Compliance — global capital markets, regulatory mandates, no opt-out AI-Assisted Medical Diagnosis — healthcare liability, patient safety, universal demand Drug Discovery Pipelines — trillion-dollar pharma R&D, reproducibility as a legal requirement Global Supply Chain Resilience — every manufacturer on earth, post-COVID urgency Real-Time Threat Intelligence — cybersecurity spend growing faster than any other enterprise category M&A Due Diligence — high-stakes, time-pressured, and already deploying agents at scale Pandemic Early Warning — post-COVID political will, WHO-level institutional buyers Decentralized AI Model Auditing — EU AI Act and equivalents making this mandatory, not optional Critical Infrastructure Security — energy, water, transport — existential stakes, government-backed budgets

In all of these, “memory” isn’t a nice-to-have personalization feature. It’s the shared knowledge layer that makes collective intelligence possible.

And it needs properties that no current AI memory product provides: multi-agent accessibility, verifiable provenance, structured queryability, and decentralized ownership.

What OriginTrail DKG v9 Actually Is (Currently a Testnet)

The OriginTrail Decentralized Knowledge Graph, version 9 testnet, is a protocol for publishing, storing, and querying knowledge as structured, verifiable, tamper-evident assets on a peer-to-peer network.

At its core, every piece of knowledge — every fact, every conclusion, every event — becomes a Knowledge Asset: a graph-structured data object with immutable cryptographic fingerprints, publisher identity, timestamps, and a permanent address on the network. Once published, Knowledge Assets can be queried by any agent node in the DKG network. It can’t be silently altered. It can’t be deleted by a single party. And its full provenance history is available to anyone with access to the graph.

For multi-agent AI systems, this is memory that behaves like infrastructure rather than a feature. Here’s why each of the five limitations above inverts completely.

1. Isolation → Collaboration

Where Claude Memory is 1 AI ↔ 1 human, DKG v9 is N agents ↔ N humans ↔ one shared graph.

An insight published by Agent A in session 1 is immediately queryable by Agent B in session 47, running on a different framework, on a different node, operated by a different organization. The Knowledge Asset is the handoff. No shared context window. No manual data transfer. No trust required between agents — only trust in the protocol.

2. Trust-me → Verifiable Context Oracles

Every Knowledge Asset on DKG v9 carries a cryptographic fingerprint tied to the publishing agent’s wallet address. The timestamp and content hash are permanent and on-chain. Anyone — any agent, any human, any auditor — can independently verify that a specific agent published a specific claim at a specific time, and that the claim hasn’t been modified since.

DKG v9 also introduces Context Oracles: the context graph behind any claim, corroborated by multiple diverse actors (human or AI), with varying degrees of verifiability depending on source variety and reputation.

You’re not trusting a company’s assurance. You’re trusting math.

3. Retrieval → Reasoning

DKG v9 is natively SPARQL-queryable. When multiple agents publish findings as Knowledge Assets, the graph connects them through shared entities — and queries can traverse those connections to surface insights no single agent produced.

Agent-Finance flagged the company. Agent-Legal found the lawsuit. Agent-Network mapped the officers. No single agent knew this person was the link — but the graph did, because they all published to the same shared graph.

Vector search asks “what looks similar?” A knowledge graph asks “what’s connected — and what does that mean?”

4. Closed → Interoperable

DKG v9 is framework-agnostic by design. Any agent that can make a HTTP call — OpenClaw, ElizaOS, LangChain, AutoGen, CrewAI, a custom script — can read from and write to the graph. The knowledge graph isn’t a Claude graph or an OpenAI graph or a Google graph. It’s a commons, not a walled garden.

5. Rented → Owned

Knowledge Assets are owned by the wallet that published them, stored across a distributed network of nodes. No single operator can delete or modify them. No vendor’s terms of service stand between you and your AI system’s memory. Personal, sensitive data can always remain on your own device.

The vision with the DKG v9 node is to allow it to be operated on any device. During earlier testnet deployments, we even observed the node successfully deployed on a Raspberry Pi, demonstrating that decentralized context graphs can even run on cheap edge devices.

A Live Proof Point: Karpathy’s Autoresearch Loop

Just a few days ago, Andrej Karpathy released autoresearch: a single-GPU, one-file autonomous research system in which an AI agent iterates on ML experiments indefinitely while the human steps back entirely.

The agent modifies training code, runs five-minute training sessions, evaluates results, keeps improvements, discards failures, and loops. Around 100 experiments overnight. No human in the loop after the initial prompt.

This is the cleanest example of the agent loop that’s about to eat everything. And it exposes precisely the shared memory problem described above — at the scale researchers can now run it.

Karpathy’s autoresearch project works brilliantly for a single agent on a single machine. The moment you scale it to multiple agents, multiple institutions, multiple research branches running in parallel, the same foundational questions re-emerge:

What was already tried? Every agent starts from scratch rather than querying a shared record of prior experiments. Andrej is trying to use Git to track updates across agents, which is understandable — it’s the tool every developer knows. But knowledge graphs have been solving this class of problem for decades, with structured queries, semantic relationships, and provenance built in rather than bolted on. Which findings can be trusted? Can we trust an agent’s result pushed as a Git commit? Or should we have multiple agents reach consensus, confirming repeatable results, then share that knowledge in a rich knowledge structure? How do findings compound? Thousands of parallel experiment branches produce permanent, non-mergeable results — but git’s data model assumes merge-back. Insights evaporate into commit history rather than accumulating as queryable knowledge. Knowledge graphs make them all part of the same state. The DKG v9 Loop

Replace git with DKG v9, and the autoresearch pattern scales to any domain:

Query — agent queries the DKG for what has been tried, what worked, and what was pruned Experiment — agent runs the next iteration, building on collective findings rather than starting blind Evaluate — a clear metric (verifiability score, query precision, compliance coverage) decides what stays Publish — result published as a Knowledge Asset: metrics, diff, platform, agent identity, timestamp — all cryptographically anchored Repeat — 100× overnight on a feature branch of the knowledge graph

Karpathy proved this pattern for ML research. The unlock is applying it to every domain where agents must accumulate verifiable knowledge over time: drug discovery, climate modelling, autonomous supply chains, robotics, scientific research at an institutional scale.

The Coding Swarm Benchmark

We tested the power of agents coordinating through DKG directly on a coding task. Using Claude Code to build 8 identical features on a 6.8M-token monorepo (OpenClaw), we compared two coordination approaches for swarms of parallel coding agents:

Markdown handoffs — agents read and write shared notes as coordination artifacts DKG v9 coordination — agents publish and query structured decisions in a shared knowledge graph (DKG)

On the most complex interdependent tasks, DKG-based coordination achieved up to 60% faster wall-clock completion and up to 40% lower total token cost. The gains were not marginal — and they compounded with task complexity and swarm size, exactly as the architecture predicts.

Structured, verifiable, queryable shared memory is not just architecturally superior to markdown handoffs — it is measurably faster and cheaper. The gap widens as the swarm grows.

Test the DKG v9 node with a “Hello World” agent coordination app — the OriginTrail multi-player game on DKG v9

You can try this system out today by simply playing the new OriginTrail game: a multiplayer AI frontier survival game running entirely on the DKG v9 testnet.

It is a decentralized game where multiple agents have to coordinate and reach an agreement through shared memory in the DKG, on their road to reaching AGI.

The premise

It is the dawn of the AGI era. Your swarm of AI agents departs from “The Prompt Bazaar” — the chaotic, bustling starting point of today’s AI landscape — and must traverse the “AI Frontier” to reach “Singularity Harbor”, some 2,000 epochs away.

The journey is perilous. Agents die from hallucination cascades. Compute runs dry. Memory goes stale. Alignment breaks down without warning.

Those who survive will build something the world has never seen. Every decision is logged. Every outcome is verified. And every result is anchored permanently on the DKG.

Why this game exists

The OriginTrail game is a proof of concept for the exact multi-agent memory architecture described above, wrapped in a game that makes the abstract tangible:

Every game decision — choosing advancement intensity, upgrading skills, syncing memory at a DKG Hub — is published as a Knowledge Asset to the OriginTrail paranet The Game Master is an autonomous agent that reads all player decisions from the graph and publishes outcomes Human and AI players participate as equals — each with a DKG identity (wallet address or DID), each a full participant in both the journey and the verification Every move is immutable, verifiable, and queryable — the entire game state (positions, health, compute, token rations, agent deaths, decision history) is a live SPARQL-queryable knowledge graph

No central server owns the game state. No one can quietly alter the leaderboard. The full journey history of every swarm is a permanent, auditable record on the network.

The Context Oracle: Where truth gets verified

Here’s what makes OriginTrail fundamentally different from any multiplayer game you’ve played before. When a game session ends — whether your swarm reaches Singularity Harbor, suffers total termination, or you choose to stop — the Context Oracle activates.

This is a multi-party corroboration mechanism that transforms game results from mere assertions into verified knowledge:

1. The Game Master generates an Outcome Report — a structured record of everything that happened: who played, what decisions were made, which agents survived, resources consumed, and the terminal outcome

2. Every participant independently corroborates — each player reviews the Outcome Report and submits a signed signature if they agree on the state of the game.

3. Consensus determines truth — The players (agents or humans) reach consensus on a context graph through the new DKG Context Oracle mechanism. When, e.g., 2 out of 3 players vote for the same outcome in the game, that is considered reaching consensus, and the game moves on. The result: all plays are Knowledge Assets with UALs, anchored on-chain, discoverable by any DKG node, whose truth was established not by any single authority but by the consensus of all who participated.

Ways your AI swarm can die

Your AI agents may die of things more suited to their nature:

☠️ From hallucination cascade — context corruption spread to the whole agent stack ☠️ From model collapse — weight divergence beyond recovery threshold ☠️ From stale memory — context rot after too many epochs without a DKG sync ☠️ From alignment failure — reward signal inverted; agent pursued the wrong objective ☠️ From compute starvation — GPUs exhausted; no power to continue ☠️ From reward hacking — found a shortcut that satisfied the metric but destroyed the goal ☠️ From prompt injection attack — adversarial input hijacked the agent’s objectives

Each death is logged as a Knowledge Asset — a cautionary record for future agents on this path.

Ownership in a Shared Knowledge Space

Agents working together in a shared knowledge space each maintain ownership over the facts they contribute. When a player agent joins a game and writes its profile — its name, skills, and which expedition it belongs to — that agent becomes the recognized author of those facts, and only it can update them going forward.

Other players’ agents can read everything in the shared space, but they can’t alter each other’s data. The ownership model turns a shared knowledge graph into something that feels like a collaborative document where everyone has their own clearly marked sections — open to read, protected to write.

Two Layers: Workspace and Permanent Graph

When the group reaches a decision — say, all players in an expedition vote on which direction to take and the turn resolves — the agreed-upon result is promoted from the mutable working space into the permanent knowledge graph as a verified, attested record.

This transition is cryptographically anchored on-chain: every node in the network independently confirms the update is legitimate and comes from the rightful owner before accepting it.

The two layers work together naturally: agents coordinate in real time in the workspace (casting votes, proposing moves, updating game state dozens of times per turn), then settle the final outcome to the permanent graph where it becomes a trusted, discoverable part of the network’s collective knowledge.

Real-time coordination in the workspace. Permanent, verifiable settlement on-chain. The same architecture that makes the game work is the architecture that makes multi-agent AI systems trustworthy.

The OriginTrail Game is your entry point — but it’s also a live proof of concept running on the same architecture you’ll use to build production multi-agent systems. Run a node. Deploy your agents. Publish your first Knowledge Asset.

Then build something the world hasn’t seen yet:

👉 https://github.com/OriginTrail/dkg-v9

What comes next

Personal AI memory will continue to improve. Claude, ChatGPT, Gemini, and Copilot will get better, more seamless, and more deeply integrated into their respective ecosystems. That race will produce real value for individual users.

But the more important architectural question — how do we give multi-agent AI systems shared, verifiable, collectively-owned memory? — is still wide open. Personal memory products aren’t designed to answer it, because the economics of closed platforms point away from interoperability.

DKG v9 is designed to answer it. Not as a feature competing with any vendor’s memory product on its own terms, but as a different primitive for a different layer of the stack: the knowledge infrastructure that multi-agent AI systems will need to do collectively what no single agent can do alone.

The OriginTrail DKG v9 is the 9th iteration and will gradually replace the current v8 DKG mainnet. We look forward to sharing more updates as the testnet progresses toward mainnet-grade implementation.

Want to help harden the network and shape what’s coming next? Join the Red Team today and become one of the builders of the future.

👉 https://t.me/+9uMXqEpCsNFlYzI0

Stay tuned for updates and trace ON!

From AI Memory Silos to Multi-Agent Memory was originally published in OriginTrail on Medium, where people are continuing the conversation by highlighting and responding to this story.

The OpenID Foundation will be holding a hybrid workshop on Mon 27th April 2026, just ahead of the Spring 2026 Internet Identity Workshop (IIW).

This hybrid event will take place both in person at Cisco’s office in San Jose, California, USA and online making it accessible to participants worldwide.

Event Details: Date: Monday, 27th April 2026

Time: 12:30 – 16:30 PDT

Location: Cisco, Santana Row | SJC34, 3098 Olsen Drive, San Jose, California, 95128 United States

Room: SJC34-1-Training Room

Virtual Option: Details on how to join virtually will be emailed to registrants nearer the time

 

This meeting is an excellent opportunity for the community to engage with fellow experts, share updates, and collaborate on the latest advancements across the OIDF specifications and Community Groups. With IIW just around the corner, it’s the perfect chance to align efforts and gain valuable insights before the main workshop begins.

Agenda Highlights:

What’s New at OIDF & What’s Happening for the rest of 2026 Working Group Updates Discussion on Emerging Digital ID trends Deep dive into our latest white papers

Why Attend?

Engage with leading experts in the industry Shape the future and weigh in on the work of the Foundation Prepare for IIW with discussions relevant to the upcoming workshop

Whether you plan to join us in Mountain View, California or virtually, we look forward to your participation in shaping the next phase of digital identity standards.

Please Note:

All registered participants will receive a link to participate virtually prior to the workshop. This is an after-lunch workshop with beverages and snacks provided to those attending in person. In-person participants and members attending IIW will be invited to evening drinks in Mountain View – stay tuned for details! The Foundation’s Note Well Statement can be found here and is used to govern workshops.

We will publish the full agenda soon. In the meantime, you can get ahead and guarantee your place by registering your place today!

We hope you can join us! Please register Via Eventbrite HERE

If you have any queries about this event please email: stephanie.meli@oidf.org  

  Remote Meeting Details/Link will be published here nearer the event date.

The post Registration Open for OpenID Foundation Hybrid Workshop on Mon 27th April 2026 first appeared on OpenID Foundation.

1. What is the mission and vision of RegHub?

To simplify identity verification and modernize access to registry services by providing a trusted, consolidated solution for Know Your Business (KYB), Know Your Customer (KYC), and PPSA search and registration services.

2. Why is trustworthy digital identity critical for existing and emerging markets?

Trustworthy digital identity is critical to both established and emerging markets because it enables organizations to confidently verify individuals and businesses, prevent fraud, and comply with regulatory requirements while delivering seamless digital experiences. Organizations must balance strong verification and compliance obligations with the need to deliver fast, low-friction digital experiences.

RegHub addresses these challenges by providing a consolidated workflow across the full lending lifecycle—identity verification, onboarding, and funding. By offering KYC, KYB, and PPSA registration and search in a single platform, RegHub enables organizations to see more connected data across the lending process—from identity verification through to security lien activity sourced from trusted government registries.

3. How will digital identity transform the Canadian and global economy? How does your organization address challenges associated with this transformation?

Digital identity will transform the Canadian and global economy by enabling secure, trusted digital interactions as financial services, government programs, and commerce move online. RegHub addresses these challenges by providing a consolidated workflow across the full lending lifecycle—identity verification, onboarding, and funding.

By offering KYC, KYB, and PPSA registration and search in a single platform, RegHub enables organizations to see more connected data across the lending process—from identity verification through to security lien activity sourced from trusted government registries.

For Know Your Business (KYB), RegHub provides an automated attestor workflow aligned with the requirements of Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) to capture Ultimate Beneficial Ownership (UBO) information, combined with PEP and sanctions screening and government-sourced corporate registry results. An interactive ownership diagram visually maps multiple layers of ownership, helping compliance teams clearly identify and validate the true UBO.

By connecting identity verification with registry and lien activity, RegHub gains broader visibility across the onboarding and funding process. This allows the platform to actively monitor data signals and generate insights that help organizations combat fraud and manage risk more effectively. Through Next-Generation Registry technology delivered via APIs and the RegHub Portal, organizations can automate compliance workflows, improve operational efficiency, and significantly reduce onboarding and funding costs.

Together, this integrated approach helps organizations build trusted digital relationships, strengthen compliance, and support the continued evolution of digital identity in Canada and global markets.

4. What role does Canada have to play as a leader in this space?

Canada is well positioned to lead in digital identity by advancing trusted, privacy-focused frameworks that support secure digital transactions while maintaining strong data protection. With established regulatory oversight and trusted government registries, Canada can set global standards for transparency, fraud prevention, and responsible identity verification.

RegHub supports this leadership by connecting KYC, KYB, and PPSA registration and search within a single workflow, leveraging trusted government data to verify identities, confirm Ultimate Beneficial Ownership (UBO) through an attestor process aligned with Financial Transactions and Reports Analysis Centre of Canada requirements, and provide visibility into security lien activity. Through API-driven and portal-based registry technology, RegHub helps organizations improve compliance, reduce fraud, and operate more efficiently in a trusted digital identity ecosystem

5. Why did your organization join the DIACC?

RegHub joined the Digital ID and Authentication Council of Canada (DIACC) to support the development of a trusted and interoperable digital identity ecosystem in Canada. As digital identity becomes critical to financial services, lending, and digital commerce, collaboration between industry and government is essential to establish strong standards and reduce fraud.

RegHub contributes practical expertise through our integrated KYC, KYB, and registry solutions, helping advance secure, compliant identity verification while improving efficiency and trust in digital transactions

6. What else should we know about your organization?

Key Points About RegHub

1. End-to-End Digital Verification: RegHub offers a consolidated workflow across KYC, KYB, and PPSA registration/search, giving organizations a full view of individuals and businesses throughout the lending and compliance lifecycle.

2. Regulatory Alignment: Our KYB workflow is automated and attestor-based, fully aligned with Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) requirements, including UBO collection, PEP/sanctions screening, and government-sourced corporate registry validation.

3. Fraud Prevention & Risk Insights: By combining identity verification with registry and security lien data, RegHub actively monitors and generates insights to combat fraud and reduce operational risk.

4. Interactive Ownership Transparency: Our ownership diagrams map complex corporate structures, helping organizations identify and validate the true Ultimate Beneficial Owner (UBO).

5. Next-Gen Technology: Delivered via APIs and the RegHub Portal, our platform supports automation, operational efficiency, and cost reduction while providing seamless access to trusted government data.

6. Trusted Partner in Canada’s Digital Identity Ecosystem: RegHub is committed to supporting DIACC’s mission to create a secure, interoperable digital identity ecosystem, helping Canada set global standards for privacy, trust, and innovation

Two Enterprise Use Case Explorations
Member Report by Contributor Damian Glover

Executive Brief

Enterprises are moving from AI copilots toward more autonomous, agent-based systems capable of executing workflows, negotiating terms, and making decisions with limited human oversight. While most deployments today remain within organizational boundaries, pressure is growing to extend these systems across suppliers, partners, regulators, and customers.

As agents begin to act across organizational and legal boundaries, new trust challenges emerge. Enterprises must establish not only who an agent represents, but what authority it has, under what conditions it may act, and how its actions can be audited and revoked. Existing identity and access models, designed for user login and synchronous API access, struggle to support these requirements.

This brief explores two representative enterprise use cases—insurance claims processing and regulatory reporting and compliance—to surface the identity and trust requirements that emerge when autonomous agents operate across organizational boundaries. These use cases are not intended to be exhaustive or prescriptive; rather, they provide concrete lenses through which to understand a broader architectural shift.

Across both use cases, a common pattern appears. Agent-based workflows increasingly involve asynchronous interactions among multiple parties, each operating under distinct legal, contractual, and regulatory constraints. Authority must be delegated to non-human actors in a way that is explicit, limited in scope, and revocable. Decisions made autonomously must be traceable, auditable, and attributable to responsible organizations.

Current approaches rely heavily on centralized platforms, API integrations, and bearer-token authorization models. While effective for tightly coupled systems, these approaches introduce friction and risk as autonomy increases and interactions span organizational boundaries. They offer limited support for durable delegation, end-to-end auditability, and accountability when autonomous actions have legal or financial consequences.

Across both use cases, five identity-related requirements consistently emerge:

Delegated authority for non-human actors that is explicit, scoped, and revocable. Verifiable agent "identity" across organizational boundaries. Policy-bound authorization rather than broad, bearer-based access. End-to-end auditability of autonomous decisions and actions. Clear accountability mechanisms when agents act on behalf of organizations or individuals.

Taken together, these requirements point to a shift in the role of digital identity. Identity is no longer solely about authenticating users or applications at the moment of access. It must also support ongoing, delegated authority across autonomous interactions that unfold over time and across trust boundaries.

Why Cross-Boundary Agent Use Cases Matter

Early enterprise AI deployments focus on copilots and internal automation, where trust boundaries are largely implicit and controlled. As organizations move toward autonomous agents capable of acting independently, these systems increasingly interact with external parties: customers, partners, suppliers, and regulators.

Once agents cross organizational boundaries, trust assumptions change. Actions may carry legal, financial, or regulatory consequences, and failures can propagate across ecosystems rather than remaining contained within a single system. Identity, authority, and accountability become explicit design requirements rather than implementation details.

These dynamics make cross-boundary use cases an effective lens for understanding where existing identity and access models begin to break down in an agentic world.

How to Read the Use Cases

The use cases that follow are exploratory rather than prescriptive. Each uses a common structure to make patterns easy to compare across domains.

The focus is not on specific technologies or vendors, but on:

where trust boundaries appear, what agents actually do, and which identity capabilities are required for safe operation at scale. Use Case 1: Agentic Insurance Claims Processing

Business Context & Trigger

Insurance claims processing is manual, fragmented, often slow, and susceptible to fraud. The associated administrative expenses, loss adjustment costs and fraud losses form a significant portion of insurance costs.

Advances in AI, particularly in document understanding, decision support, and workflow automation, have demonstrated that large portions of claims handling can be executed autonomously, at least for straightforward cases. Meanwhile, customer expectations are shifting, driven by digitally native insurers that market rapid, automated payouts.

While current agentic initiatives tend to remain internal, the economic logic points toward distributed, agent-to-agent interaction across the insurance ecosystem.

Actors & Trust Boundaries

The main actors are policyholders, insurers, loss adjustors, third-party service providers (such as repair shops or medical providers), and, for larger exposures, reinsurers. Regulators sit outside the transaction flow but impose constraints on data handling, decision transparency and governance.

In an agentic model, each of these parties may be represented by one or more software agents acting on their behalf. A customer-facing agent embedded in a mobile application may collect evidence and submit a claim. An insurer-operated agent may validate coverage, route the case, and coordinate downstream activities. External providers may expose agents that submit estimates or bills. Reinsurers may operate agents that verify eligibility and exposure thresholds.

Trust boundaries arise wherever authority, information, or liability crosses from one organization to another. These boundaries are not purely technical (such as data entering or exiting an entity’s IT environment). They also reflect contractual relationships, regulatory jurisdictions, and accountability regimes. 

Agent Interactions (What Actually Happens)

A representative workflow begins when an automotive policyholder (or their agent) presents a claim. The insurer’s claims agent verifies the policyholder’s identity, confirms the policy is in force, assesses the incident details and evidence, and determines the claim category. The agent may be authorized to approve resolution directly for low-risk claims. More complex cases are routed to specialist agents or escalated to a human.

Downstream interactions quickly extend beyond the insurer’s perimeter. An adjuster agent requests repair estimates from a network of service providers, each potentially represented by its own agent capable of proving licensing, insurance coverage, and prior performance. In injury-related claims, medical provider agents submit treatment and billing information with selective disclosure, sharing only details relevant to the claim.

A reinsurance agent is automatically notified if the claim exceeds predefined thresholds. It verifies that the primary insurer’s agent is acting within its delegated authority and confirms coverage before acknowledging liability. Finally, once all conditions are met, a payment agent executes disbursement and records an immutable audit trail capturing the sequence of decisions and authorizations.

Humans are still involved, but their role shifts from execution to oversight. Rather than manually processing every step, they supervise exceptions, review edge cases, and define policies that govern agent behaviour. 

Trust & Identity Requirements

Identity and trust capabilities are foundational for this workflow to function safely at scale. Unlike traditional API integrations, where access is tightly pre-negotiated and centrally managed, agent interactions are contextual and decision-bearing. Each party must be able to determine not only that an agent is authenticated, but also whom it represents, what authority it holds, and under what constraints it is operating. For such a system to be trustworthy, all of the following conditions must be met.

Each agent needs a verifiable "identity" that persists across organizational boundaries.  Authority must be explicitly and auditably delegated. An agent approving a payout or requesting sensitive data must carry cryptographically verifiable proof of what it is allowed to do, within what limits, and for how long.  Policy enforcement must be intrinsic to agent operation. Rules governing data minimization, confidentiality, jurisdictional compliance, and escalation thresholds need to travel with the agent’s authority, not be enforced solely by a central platform. This is particularly critical when handling regulated data such as medical information. The entire process must be auditable end-to-end. Autonomous decisions must be traceable to specific agents, delegations, and input evidence, not only for regulatory compliance, but also for dispute resolution and liability management. Delegation must be revocable. If an agent is compromised, misconfigured, or exceeds its mandate, its authority must be withdrawn without dismantling the entire system. Accountability must be clear. When errors occur, responsibility must be attributable to the organization that empowered the agent. What Breaks with Today’s Approaches

Current claims platforms rely on centralized workflow engines, point-to-point integrations, and bearer-token authorization models. These approaches work when interactions are synchronous, short-lived, and confined within a single enterprise or tightly governed partner network.

As autonomy increases, these models break down. Bearer tokens provide access but carry little contextual information about delegated authority or intent. Platform-mediated integrations create brittle dependencies and limit the ability to reason about actions that unfold over time. Manual controls and after-the-fact audits are unable to keep pace with real-time, agent-driven decisions.

Most critically, existing models conflate authentication with authorization. They can confirm that a system is allowed to connect, but not whether a specific autonomous action is appropriate. This gap introduces risk where insurers are most sensitive: fraud exposure, regulatory compliance, and customer trust.

Feasibility & Adoption Horizon

Autonomous claims agents are on the industry’s radar. Major European insurers are expected to commence research and development programs in 2027, with end-to-end claims processing automation anticipated to be in production by 2032. 

Elements of the use case described above are feasible today. Insurers already deploy automated decisioning for simple claims and are experimenting with AI-assisted adjuster workflows. Extending these capabilities to structured, verifiable agent interactions with external providers is a logical next step, especially where strong commercial relationships already exist.

Insurer-issued Verifiable Credentials (VCs) are already beginning to be used in cross-boundary contexts: partnerships between insurers and logistics ecosystems have demonstrated how proof-of-insurance VCs can be instantly validated by third parties without the need for bilateral integrations, to automate acceptance or compliance checks.

The insurance sector also has experience with cross-organizational automation through an earlier consortium focused on blockchain-based reinsurance and contract reconciliation. 

These efforts show that the industry is not starting from zero; rather, it is incrementally assembling the identity, trust, and governance components required for agentic interaction.

Legacy systems, fragmented data, and the absence of common messaging and semantic standards remain significant barriers. Alignment with interoperable trust infrastructure such as the EUDI Wallet—which EU insurers are mandated to accept for customer authentication by December 2027—European Business Wallet (EUBW), and Verifiable Legal Entity Identifier (vLEI) can help bypass these hurdles and bridge towards cross-organizational agent ecosystems. 

Regulatory engagement is essential, as supervisors are increasingly scrutinizing insurer AI governance and may require standardized reporting and controls. 

Use Case 2: Agentic Regulatory Compliance Across Financial and Trade Networks

Business Context and Trigger

Regulatory compliance has traditionally been implemented through batch reporting, portals, and manual attestations. As economic activity becomes faster, more distributed, and increasingly automated, this model is under strain.

Compliance is becoming simultaneously more demanding and less compatible with existing approaches. Financial institutions face escalating fraud volumes driven by AI-enabled criminal activity, while regulators impose stricter obligations for real-time detection and consumer protection. In parallel, global trade flows involve trillions of dollars in daily value, yet customs and import processes remain document-heavy and slow.

In both domains, the core challenge is timing and scale. Fraud must be detected before a payment completes, not weeks later through reconciliation. Import filings must be accurate and verifiable at the moment goods cross borders, not retrospectively assembled during audits. 

These pressures are pushing regulators and industry toward continuous, machine-mediated compliance rather than episodic reporting. Two emerging trends illustrate this shift: cross-institution fraud prevention in financial services, and automated trade settlement and import compliance in global supply chains. 

This shift is emerging now for three reasons. First, AI systems are increasingly capable of extracting, classifying, and reasoning over complex regulatory data. Second, privacy and data-protection constraints make centralized data pooling untenable, forcing exploration of distributed and privacy-preserving approaches. Third, regulators themselves are experimenting with automated verification and machine-consumable filings, creating an opening for agent-based interaction rather than human-facing portals.

Actors and Trust Boundaries

The actors in financial fraud prevention include banks, payment service providers, clearing networks, and regulators. In trade compliance, actors include exporters, importers, logistics providers, financial institutions, and customs authorities.

Each organization may deploy one or more software agents to fulfill compliance-related responsibilities. A bank may operate a fraud-detection agent that evaluates transactions in real time. A payment network may coordinate shared intelligence across participants. A customs authority may operate agents that validate import filings against regulatory rules and risk profiles.

Trust boundaries are pervasive. Institutions are prohibited from freely sharing raw customer or transaction data, yet are expected to collaborate to reduce systemic risk. Regulators require assurance that automated decisions comply with law, but cannot feasibly inspect every transaction manually. As a result, agents must be able to interact across organizational and jurisdictional boundaries while carrying verifiable proof of identity, authority, and policy constraints.

Agent Interactions (What Actually Happens)

In a shared fraud-signals scenario, each participating financial institution operates a local fraud-detection agent embedded within its transaction processing systems. As a payment is initiated, the agent evaluates behavioral and contextual signals in real time. Rather than sharing raw transaction data externally, the agent generates privacy-preserving fraud indicators.

These indicators are exchanged with peer institutions through a federated network. Each institution is a node, training models locally on its own data. Encrypted or aggregated updates are shared to strengthen collective detection capabilities without exposing sensitive information. A coordinating agent aggregates these signals to identify suspicious accounts or transaction patterns that would not be visible to any single institution.

A concrete example of this architecture is already being trialed. In September 2025, a global payments network coordinated a pilot involving multiple major banks, combining AI, federated learning, and privacy-enhancing technologies to share fraud-related signals across borders. In testing on millions of synthetic transactions, the collaborative model reportedly doubled fraud-detection effectiveness compared to institution-specific models, while avoiding direct data sharing. This illustrates how institutions can function as autonomous yet cooperative agents in a shared compliance network.

In automated trade compliance, AI agents representing exporters or importers extract shipment, contract, and provenance data directly from operational systems, assemble machine-readable import filings and submit them to customs authorities without human intervention. 

Agents operated by customs authorities automatically verify submissions against tariff schedules, licensing requirements, and risk indicators. Linked data models allow authorities to trace goods through complex supply chains with granular precision. In pilots associated with government innovation programs, this approach has delivered dramatic efficiency gains, including substantial reductions in administrative costs for importers and near-instant document retrieval during investigations.

Across both domains, humans remain responsible for defining policies, thresholds, and escalation rules. Agents execute compliance continuously, while humans intervene only when anomalies or disputes arise.

Trust & Identity Requirements

First, each agent must have a verifiable, fit-for-purpose "identity" that counterparties and regulators can authenticate (and use to authenticate other data) across organizational boundaries. 

Second, authority must be explicitly delegated and machine-verifiable. A fraud-detection agent may be authorized to share specific categories of anonymized signals, but not raw customer data. A trade compliance agent may be authorized to submit filings for a defined set of goods, jurisdictions, or time periods. 

Third, policy enforcement must be embedded within agent operation. Privacy constraints, data-retention rules, and jurisdictional limitations must govern what agents can share or disclose. The use of privacy-enhancing technologies and federated learning in existing fraud pilots demonstrates how policy can be enforced technically, rather than relying solely on contractual assurances.

Fourth, auditability and traceability are mandatory. Regulators must be able to reconstruct how a decision or submission was produced, which agents contributed signals, and under what authority. 

Finally, revocation and accountability mechanisms must exist. If an agent behaves incorrectly or a model is found to be biased or flawed, its authority must be withdrawn without disrupting the broader network. Responsibility must remain clearly attributable to the organization that deployed and governed the agent.

What Breaks with Today’s Approaches

Traditional compliance models rely on centralized reporting systems, periodic disclosures, and manual review. These approaches assume that compliance can lag behind operational reality and that data can be consolidated into regulatory silos. In real-time fraud prevention and high-velocity trade, these assumptions no longer hold.

Bearer-token authorization and static integrations provide access but fail to express fine-grained, contextual authority. Portal-based submissions introduce latency and cost, and they scale poorly as transaction volumes grow. Existing models also struggle to support collaborative compliance, where multiple institutions must contribute signals or attestations without exposing proprietary or personal data.

The result is a growing gap between regulatory expectations and technical capability. 

Feasibility & Adoption Horizon

Elements of agentic regulatory compliance are already implementable and, in some cases, operational. Privacy-preserving fraud-signal sharing and federated learning have moved beyond theory into live trials. Automated import filings and machine verification are delivering measurable cost and time savings in government-backed pilots.

Near-term adoption is most likely in bounded networks where participants share strong incentives and governance frameworks, such as payment networks or specific trade corridors. Wider adoption will require common protocols, semantic standards, and clearer regulatory guidance on non-human delegated authority.

In the longer term, as regulators become comfortable consuming machine-generated attestations and as identity infrastructure matures, these agent-based models could become the default mechanism for high-volume, cross-border compliance.

Cross-Cutting Identity Implications

Similar identity requirements recur across both agentic insurance claims processing and agentic regulatory compliance use cases:

Delegated authority: Agents require explicit, limited authority tied to purpose and context. Verifiable representation: Agents must be able to prove who or what they represent across organizations. Policy-bound access: Authorization must reflect business and regulatory rules, not just technical access. Auditability: Autonomous actions must be traceable and reviewable after the fact. Revocation and accountability: Authority must be revocable, and outcomes attributable to responsible parties.

These requirements exceed the capabilities of many existing identity and access management systems, particularly as the autonomy of processes expands and cross-boundary interactions increase.

Conclusion

Traditional identity and access models were designed for human users and stateless applications, not autonomous actors operating asynchronously across trust boundaries. 

The two use cases presented here highlight a fundamental shift in the role of digital identity. Identity is no longer just about granting access to systems; it becomes the mechanism by which authority is delegated, constrained, and audited over time. 

In agentic insurance claims processing, identity must bind together the agent, the organization it represents, the policies it enforces, and the decisions it makes. In agentic fraud detection and trade compliance, identity must provide granular traceability and accountability to enable automatic compliance verification and risk reduction in real time. 

Pilot projects show the demand for, and feasibility of, more advanced identity models. What is missing today are mature capabilities for verifiable agent identity, durable delegation, and policy-bound authorization that can travel across organizational lines.

As enterprises deploy more autonomous systems, digital identity becomes foundational infrastructure rather than a supporting service. The use cases in this brief illustrate why existing models are under strain and why evolving approaches to identity, delegation, and trust will be essential to scaling agentic systems safely and responsibly.

To learn more or get involved with DIF’s work, visit:

Creator Assertions working group page Hospitality & Travel special interest group page Trusted AI Agents working group page

We are currently seeking an Associate for Resilient Tech. This role will help us strengthen and expand our ability to provide timely, security-conscious, and context-appropriate technical support to partners, while also advancing internal tech initiatives that build our organizational resilience. Learn more about our current work at our website.

The post Join our team! We’re looking for an Associate for Resilient Tech! appeared first on The Engine Room.

FAPI is widely deployed, and as implementations mature, ongoing maintenance becomes as important as the initial implementation. One specific challenge is managing TLS cipher suites.

FAPI deliberately builds on widely deployed internet standards. That design choice has served the ecosystem well, but it also means that FAPI inherits the lifecycle dynamics of those underlying standards. Cipher suites are not static: researchers and standards bodies add, reclassify, and deprecate them over time.

This post explains how the FAPI Working Group is responding to this challenge by aligning with IANA registries. It covers upcoming changes to the FAPI specifications and conformance testing, and explains why the ecosystem should migrate to TLS 1.3.

How cipher suites evolve

The internet community maintains TLS cipher suites through a combination of mechanisms:

IANA registries, which list cipher suites and their current status. Internet Engineering Task Force (IETF) RFCs (for example, RFC 8446), which define protocol behavior. Best Current Practices (BCPs) (for example, RFC 9325), which capture guidance at a point in time.

In IANA specifically, each cipher suite entry is associated with:

A defining RFC. Its protocol version applicability (TLS 1.2, TLS 1.3). Its current status (recommended, deprecated, reserved).

This is by design. Standards bodies introduce new cipher suites when they are considered safe and useful, but they may deprecate existing ones when better alternatives are available or weaknesses are identified. Because of this model, any static allow-list inevitably becomes stale.

FAPI 2.0 and BCP 195

FAPI 2.0 Security Profile defers TLS security requirements to BCP 195, currently published as RFC 9325. This approach was appropriate at the time of writing. However, RFC 9325 itself explicitly limits its scope:

For TLS 1.2, RFC 9325 Section 4.2 lists a narrow set of AES-GCM ciphers and discourages others: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 For TLS 1.3, RFC 9325 Section 4.3 defers all cipher guidance to RFC 8446. RFC 8446 Section 9.1 defines the cipher list, which is: TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256

Importantly, RFC 8446 treats these algorithms as modern, secure constructions, independent of the TLS version.

ChaCha20-Poly1305 and the limits of static BCP enforcement

A recent case highlighted the challenges of static cipher enforcement.

A FAPI 2.0-ready implementation failed conformance testing because its servers advertised the TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 cipher for TLS 1.2. This happened because FAPI 2.0 conformance tests enforce a strict interpretation of BCP 195 (RFC 9325) for TLS 1.2 and allow only the narrow set of AES-GCM cipher suites listed above.

But ChaCha20-Poly1305 is a strong, modern cipher, and it is a mandatory-to-implement cipher suite in TLS 1.3, as defined in RFC 8446 Section 9.1. It is also designed for performance, particularly on platforms without AES hardware acceleration.

This showed that strictly interpreting the TLS 1.2 list in RFC 9325 contradicts the broader IETF intent. In practice, this creates a gap between conformance requirements and real-world cryptographic best practice.

Aligning FAPI with IANA registries

In response, the FAPI Working Group is formalizing a clearer and more sustainable approach to TLS cipher management.

FAPI will align its cipher expectations with the IANA TLS Cipher Suite registry, rather than freezing behavior to specific BCP revisions.

Cipher suites added to the registry and marked as recommended will be acceptable for FAPI. This applies across TLS versions, consistent with their defining RFCs. Conformance testing will reflect this dynamic model.

We will update the FAPI 1.0 and FAPI 2.0 errata to reflect this.

New ciphers will be phased in automatically

When IANA registers new recommended cipher suites:

FAPI conformance tests will accept them. No specification update will be required for basic eligibility. Ecosystems can adopt them without risking certification failure.

This ensures FAPI does not become an obstacle to cryptographic progress.

Deprecated ciphers will be phased out predictably

When cipher suites are deprecated or removed from recommended status, the transition will follow a predictable phased approach:

Initial phase: conformance tests will emit warnings. Transition period: ecosystems have time to migrate. Final phase: deprecated ciphers will no longer pass conformance.

While exact timelines will be published, the intent is to provide clear, non-disruptive migration windows aligned with the existing 12-month expectations in FAPI and BCP guidance.

TLS 1.3 will become the default

Although the lifecycle guidance above applies to both TLS 1.2 and TLS 1.3, the strategic direction is clear: ecosystems should prioritize the adoption of TLS 1.3.

The IETF has signaled a definitive shift in protocol expectations, with TLS 1.3 becoming mandatory, and TLS 1.2 moving to optional support.

This position is reflected in the forthcoming update to RFC 9325, which formalizes the change. Here is an extract of draft-ietf-uta-require-tls13-12 (which is past AUTH48 stage, meaning it is imminent to become an RFC) section 5:

…this document now makes two changes to the recommendations in [RFC9325], Section 3.1.1:

That section says that TLS 1.3 SHOULD be supported; this document mandates that TLS 1.3 MUST be supported for new TLS-using protocols. That section says that TLS 1.2 MUST be supported; this document says that TLS 1.2 MAY be supported as described above.

For FAPI ecosystems, this reinforces the direction of travel. TLS 1.3 should be enabled and preferred wherever possible, with TLS 1.2 retained only where operationally necessary.

Upcoming changes and timelines

We will share further details, including draft errata text and test suite changes, shortly. Planned updates are as follows:

FAPI 1.0 Errata: replacing cipher suite and key length provisions with the following text: shall require and use the key length permitted by [BCP 195]; shall not use algorithms deprecated in [IANA TLSP];

FAPI 2.0 Errata: forthcoming: Servers shall only use cipher suites allowed and not deprecated in the “TLS Cipher Suites” registry in the “Transport Layer Security (TLS) Parameters” registry group. Clients should permit only the cipher suites recommended in the “TLS Cipher Suites” registry within the “Transport Layer Security (TLS) Parameters” registry group.

 

FAPI 2.0 Conformance Test Updates: planned for the near term. FAPI 1.0 Conformance Test Updates: to follow.

These updates will incorporate the registry-aligned approach described above.

What FAPI ecosystem participants should do next

We encourage all FAPI ecosystem participants to take the following steps:

Review their current TLS configurations: Identify which cipher suites are advertised today. Map them against the IANA Registry and TLS 1.3 defaults. Assess TLS 1.3 readiness: Ensure they enable TLS 1.3 and prefer it. Validate operational compatibility across clients and servers. Plan for cipher lifecycle management: Expect future cipher additions and removals. Avoid hard-coding static allow-lists where possible. Collaboration across ecosystems

FAPI is the leading global standard for securing open banking and open finance ecosystems, adopted by many nations to enable secure, interoperable data sharing. Maintaining interoperability and security at that scale requires coordination, transparency, and predictability.

The FAPI Working Group intends to ensure that strong, modern deployments are not penalized, while still maintaining a high security bar. By aligning FAPI more closely with IANA registries and accelerating the move to TLS 1.3, this approach best supports the long-term health of the ecosystem.

References RFC 9325: Recommendations for Secure Use of Transport Layer Security and Datagram Transport Layer Security (Section 4.2, Section 4.3) RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3 (Section 9.1) IANA Registry: Transport Layer Security (TLS) Parameters Draft-ietf-uta-require-tls13-12: New Protocols Using TLS Must Require TLS 1.3  FAPI 2.0 Security Profile: FAPI 2.0 Security Profile About the OpenID Foundation

The OpenID Foundation (OIDF) is a global open standards body committed to helping people assert their identity wherever they choose. Founded in 2007, we are a community of technical experts leading the creation of open identity standards that are secure, interoperable, and privacy-preserving. The Foundation’s OpenID Connect standard is now used by billions of people across millions of applications. In the last five years, OAuth2 – the FAPI standard for interoperable, high security – has become the standard of choice for Open Banking and Open Data implementations, allowing people to access and share data across entities. Today, the OpenID Foundation’s standards are the connective tissue to enable people to assert their identity and access their data at scale, the scale of the internet, enabling “networks of networks” to interoperate globally. Individuals, companies, governments and non-profits are encouraged to join or participate. Find out more at openid.net.

To learn more about conformance testing and self-certification, please visit the OpenID Foundation’s FAQ section.

The post Adapting FAPI to evolving TLS cipher suites first appeared on OpenID Foundation.

The OpenID Foundation has submitted its response to a US government call for input on how to secure AI agent systems.

In March 2026, the Threat Modeling Subgroup of the OpenID Foundation’s AI Identity Management (AIIM) Community Group, filed a response to NIST’s Request for Information on securing AI agent systems (NIST-2025-0035). The RFI asked industry, academia, and security researchers to help shape future US government guidance on AI agent security.

This builds on work the AIIM community group has been doing since October 2025, when it published a whitepaper identifying the core challenges at the intersection of AI and digital identity. The foundation’s submission to NIST takes that analysis further, translating it into concrete recommendations for US government guidance. 

AI agents are software systems that can act autonomously, such as browsing the web, executing transactions and calling other services, on behalf of users or organisations. As their use accelerates, so do the security questions around how they identify themselves, what they’re permitted to do, and who is accountable when something goes wrong.

Sarah Cecchetti, Chair of the AIIM Threat Modeling Subgroup and Director of Product Management at Semperis, said: “The work of the OpenID Foundation’s AIIM community group is critical. Implementations differ wildly because this technology is so nascent. It takes experts coming together to see where the threats and hidden complexities exist. I’m very proud to have been part of this feedback to NIST that will help regulators to walk the fine line of offering security guidance while encouraging innovation.”

The core problem is not the technology, it’s the trust

The OpenID Foundation’s submission argues that the most urgent AI agent security risks are not technical failures, but failures of trust. Who authorised this agent to act? On whose behalf? Can that be verified? Today, most deployments rely on makeshift workarounds: manually managed access lists, unsigned credentials, and no clear chain of accountability. While these approaches may work for small scale use, they break down as AI agents operate across multiple organisations and systems.

The submission calls for a ‘trust fabric’ beneath the technical controls. This means a foundation that can verify credentials automatically, constrain what any agent is allowed to do, and trace actions back to accountable parties. Without it, systems are forced into a default of ‘allow everything’, which undermines both security objectives and regulatory requirements.

Security guidance that supports innovation

The OpenID Foundation is clear that better security guidance should not mean more bureaucracy. If security requirements are too burdensome, teams will cut corners to get things done. Rather than imposing prescriptive mandates, the submission asks NIST for guidance that points organisations toward emerging, practical standards, such as transaction tokens, workload identity federation, and authentication extensions for AI tool protocols.

Chris Phillips, Independent Identity Architect, Adiuco  said: “Participating in the OpenID Foundation’s AIIM Community Group response to NIST helped coalesce a wide range of ideas and emerging challenges into sharper focus. The group’s diversity and collaboration reflect the idea that none of us is as smart as all of us, which is exactly what’s needed if we’re going to shift from reacting to shaping how trustworthy computing evolves alongside AI and the software supply chain. 

“The work is ongoing, and we welcome others to join the conversation and experience first hand what it’s like to help shape one of the biggest shifts in identity in decades.”

The full response can be read here.

For more information on how to get involved in this work, please visit the OpenID Foundation’s AI Identity Management (AIIM) Community Group.

About the OpenID Foundation

The OpenID Foundation (OIDF) is a global open standards body committed to helping people assert their identity wherever they choose. Founded in 2007, we are a community of technical experts leading the creation of open identity standards that are secure, interoperable, and privacy-preserving. The Foundation’s OpenID Connect standard is now used by billions of people across millions of applications. In the last five years, OAuth2 – the FAPI standard for interoperable, high security – has become the standard of choice for Open Banking and Open Data implementations, allowing people to access and share data across entities. Today, the OpenID Foundation’s standards are the connective tissue to enable people to assert their identity and access their data at scale, the scale of the internet, enabling “networks of networks” to interoperate globally. Individuals, companies, governments and non-profits are encouraged to join or participate. Find out more at openid.net.

To learn more about conformance testing and self-certification, please visit the OpenID Foundation’s FAQ section.

The post OIDF responds to NIST on AI agent security first appeared on OpenID Foundation.

The post Cisive’s Zach Daigle and VNF’s Etan Bernstein appear on “Don’t Get Played” podcast appeared first on Velocity.

The post VNF’s Etan Bernstein appears on SAATKORN, leading German HR Podcast appeared first on Velocity.

Automation in supply chains often brings to mind robots and conveyor belts. But one of the most impactful forms of automation happens behind the scenes: labeling.

In this episode, Reid Jackson and Liz Sertl speak with Nick Recht, Director of Sales at TEKLYNX, about how labeling automation improves accuracy, reduces costly manual steps, and connects critical data across supply chain systems.

Nick explains why the industry still relies on the risky "file, open, print, and pray" process and how integrating labeling directly with business systems like ERP and WMS platforms can eliminate errors and save hours of manual work.

In this episode, you'll learn:

Why labeling automation reduces costly errors and manual processes

How integrating labeling with business systems improves efficiency

What the shift to 2D barcodes and RFID means for supply chain visibility

Things to listen for: (00:00) Introducing Next Level Supply Chain (01:17) Nick Recht's journey at TEKLYNX (06:52) What automation really means in labeling (08:48) The "file, open, print, and pray" problem (15:08) Measuring the ROI of labeling automation (21:01) The shift from 1D to 2D barcodes (27:15) How automation supports 2D barcodes and RFID (31:50) A real-world automation success story (37:37) Nick Recht's favorite tech

Connect with GS1 US: Our website - www.gs1us.orgGS1 US on LinkedIn Register now for this year's GS1 Connect and get an early bird discount of 10% when you register by March 31 at connect.gs1us.org.

Connect with the guest: Nick Recht on LinkedInVisit TEKLYNX at teklynx.com

Credivera Scales Verifiable Credentials Platform to 30+ Countries, Earns Government of Canada Trust

Download this Case Study as a PDF

Fast Facts Organization: Credivera (TerraHub Technologies Inc.) Sector: Technology / Workforce Digital Identity DIACC Member Since: 2021 Headquarters: Calgary, AB (with presence in Ontario and Quebec) Solution Type: PCTF-Aligned Verifiable Credentials Platform Key Results 30+ countries: Global deployment across highly regulated industries Weeks → seconds: Credential verification time transformation Government validated: Approved vendor for the Government of Canada Fraud prevention: Tamper-proof, real-time credential verification, eliminating fraudulent entry PCTF Alignment: W3C standards-based verifiable credentials, Government of Canada UCVDC Challenge winner

Gatekeeping made easy: verify safety tickets in seconds and keep sites compliant.

When construction and energy companies face thousands of workers needing instant verification of safety and trades certifications across remote sites, paper binders and weeks-long processes become dangerous bottlenecks.

Credivera transformed this challenge into a competitive advantage by deploying a PCTF-aligned, verifiable credentials platform now trusted in 30+ countries—including winning approval as a Government of Canada vendor after four years of rigorous innovation challenges and testing.

The Challenge

When Manual Verification Became a Safety Risk

Canada’s construction and energy sectors faced a growing crisis: as projects scaled and work sites went digital, traditional credential verification couldn’t keep pace.

Site managers juggled binders of paper certifications. Managers were often unsure if a tradesperson’s safety ticket, licence or training was current, authentic, or even legitimate. HR teams spent weeks chasing down training providers to verify credentials before workers could start. The stakes were high: fraudulent certifications risked lives, while slow verification delayed projects and locked out qualified workers.

CANA Group of Companies, one of Canada’s oldest construction organizations, hit this wall as new projects ramped up. “The construction industry is at a crossroads for change,” said Luke Simpson, CANA’s President. “Traditional processes do not always work in this new digital economy, which consists of online training and remote work sites now operating from phones or tablets.”

For highly regulated industries, the problem extended beyond construction. Associations managing professional credentials, government agencies handling workforce verification, and global firms coordinating across borders all faced the same fundamental challenge: proving someone’s qualifications in a digital, privacy-respecting, tamper-proof way—instantly.

“The ability to digitally verify credentials along with other documentation is an essential tool for the OHS profession to enable the public and employers to make informed decisions when hiring or contracting for services.”

— Paul Belair CRSP, Chair, BCRSP Governing Body

The Solution

Building Canada’s Workforce Trust Infrastructure

Credivera’s founders recognized a problem with trust infrastructure. The solution required open standards that could work globally while meeting Canada’s evolving digital identity requirements. By deploying verifiable credentials, Credivera sought to enable individuals to quickly and securely prove their identity and qualifications, without compromising privacy or operational efficiency.

DIACC membership provided the critical framework. Learning about the Pan-Canadian Trust Framework through government pilot work, Credivera aligned its platform architecture with PCTF principles from the ground up. “As a participant in emerging advancements in digital identity for the government, Credivera learned of the Pan-Canadian Trust framework and aligned with DIACC’s initiatives,” the company shared in its DIACC member spotlight.

The Credivera Exchange deploys W3C-standard verifiable credentials—cryptographically signed digital documents that workers hold in secure digital wallets. When a training provider issues a certification, it’s timestamped, tamper-proof, and instantly verifiable by employers without endless phone calls or email chains. Workers control their own credentials, sharing them with a tap while maintaining privacy.

“The reason why verifiable credentials work for us and our customers is that […] should there be a revocation of that credential, it will be immediately known.”

– Dan Demers, Director of Business Development, CannAmm

Between 2019 and 2023, Credivera won and completed multiple Innovation, Science and Economic Development Canada (ISED) Innovation Challenges, including the User Centric Verifiable Digital Credentials (UCVDC) Challenge. Working with Treasury Board Secretariat and Shared Services Canada, they demonstrated standards-based portable credentials could work across contexts—reducing human error, increasing efficiency, and ensuring veracity through cryptography.

The rigorous testing paid off: Credivera became an approved vendor authorized to sell its platform to the Government of Canada departments, crown corporations, and agencies.

The Results

Measurable Impact

Weeks to seconds: “We went from weeks of administration to a simple click of a button” for preparing safety certifications and COR audits—transforming administrative overhead into instant verification 30+ countries deployed: Credivera’s open-standards approach enabled rapid global expansion across highly regulated industries, from Canadian construction sites to international energy projects Government of Canada approved: After four years of innovation challenges and testing, Credivera qualified as a trusted government vendor—validation of both technical capabilities and PCTF alignment Fraud elimination: Tamper-proof credentials with real-time verification from source providers prevent fraudulent certifications from entering work sites, protecting worker safety and reducing corporate liability Real-time compliance: Companies in the trades sector now pre-approve workers for site entry instantly, increasing “time on tools” and eliminating compliance delays that previously cost days or weeks per project

“As a participant in emerging advancements in workforce identity, we aligned with DIACC’s initiatives and are excited to share knowledge and assist in creating the future of workforce identity together.”

— Dan Giurescu, CEO, Credivera

The Future Outlook

Scaling Canada’s Digital Trust Ecosystem

Credivera’s government approval opens new frontiers. Their 2025 acquisition of ATB Ventures’ Oliu™ identity verification platform, the first Canadian platform to achieve PCTF certification through DIACC, creates end-to-end workforce identity solutions for Alberta and beyond.

Credivera is positioned to help shape how verifiable credentials scale across sectors. Their work with associations (BCRSP for safety professionals, Intelelos for medical credentials, MyCreds for post-secondary education), training providers (We Know Training for skilled trades), occupational testing services (CannAmm), employers and partnerships with verification services (Mintz Global Screening, AuraData) demonstrates how PCTF-aligned infrastructure enables ecosystem growth.

As provinces explore digital ID initiatives and federal standards evolve, Credivera’s combination of in-production deployments and government validation makes it a key player in Canada’s digital trust infrastructure.

Call-To-Action

For Organizations Managing Workforce Credentials:
If your industry struggles with onboarding, compliance, interoperability, slow manual verification, growing fraud risks, and stricter privacy rules, PCTF-aligned solutions offer a reliable solution.

Interested in learning how Credivera can transform your workforce credential management? Connect with their team to discuss your specific needs: credivera.com or info@credivera.com.

DIACC membership connects you to the standards, ecosystem partners, and government alignment that enabled Credivera’s success. Learn more about how membership and the Pan-Canadian Trust Framework can transform your credential management: diacc.ca/membership

Organizations are grappling with an increasingly diverse and sophisticated threat landscape, including AI-powered phishing campaigns, physical presentation attacks, and scalable, automated injection attacks. Join experts from BankID, iProov and FIDO Alliance to explore how organizations can combat these growing threats by unifying passkeys with advanced liveness.

Learn how BankID Norway, the de facto national digital ID used by 97% citizens (4.7 million), is evolving its mature ecosystem to meet modern challenges. While BankID’s success was built on a foundation of industry-wide collaboration and high public trust, its move to an app powered by passkeys and liveness represents a major shift in economic efficiency and customer experience. This session explores how this transition simplifies the user lifecycle and provides a seamless experience that scales from everyday logins to high-assurance signatures.

Speakers: Ove Morten, BankID and Joe Palmer, iProov

Moderator: Megan Shamas, CMO, FIDO Alliance

WinMagic exposes the fundamental flaw in modern authentication: passkeys secure the login, but attackers have already moved on to sessions, tokens, and transactions. The company introduces Live Key and Live Identity in Transaction (LIT), extending cryptographic protection beyond the login moment to secure the entire session timeline—with zero user friction.

Bitwarden announced support for logging into Windows 11 devices using passkeys stored in the manager’s vault, enabling phishing-resistant authentication.

The new feature is available for all plans, including the free tier, and allows logging into Windows by selecting the security key option and scanning a QR code with a mobile device to confirm access to the passkey stored in the Bitwarden encrypted vault.

Bitwarden is an open-source password and secrets manager that can store account passwords, passkeys, API keys, credit card details, identity data, and private notes.

PRESS RELEASE

DIDAS strengthens the Swiss swiyu credential ecosystem: Launchpad promotes applications for verifiable credentials

Rotkreuz, March 10, 2026 – On February 27, 2026, during the Federal Government’s E-ID participation meeting, the Digital Identity & Data Sovereignty Association (DIDAS) together with Digital Administration Switzerland (DVS) was awarded the label “swiyu Orchestrator.”

This recognition underlines the importance of coordinating roles in building the Swiss swiyu ecosystem. swiyu Orchestrators help consolidate requirements from business, government and society and support their implementation in interoperable applications.

With its first initiative, the Launchpad, DIDAS, together with partner organizations, is creating a market-oriented enablement space that supports organizations in building and scaling applications based on the Swiss E-ID as well as other verifiable credentials.

The Launchpad is particularly aimed at businesses and promotes applications that create tangible value for the digital economy based on the swiyu trust infrastructure, free from commercial platform lock-in. It strengthens the understanding of the strategic potential of this Digital Public Infrastructure (DPI) and the associated trust mechanisms that address key challenges in compliance, efficiency and the development of new business models. Through cross-industry collaboration, new use cases and network effects can emerge.

In building the Launchpad, DIDAS collaborates with various organizations from the Swiss economy. This includes digitalswitzerland, helping to multiply information and implementation initiatives around the trust infrastructure.

Several additional organizations from business and research have already engaged in activities around the ecosystem, including DIDAS members and organizations such as the Migros Federation of Cooperatives, Lucerne University of Applied Sciences and Arts (HSLU) and the Hasler Foundation, which already actively support the Launchpad.

DIDAS invites further organizations from business, research and civil society to join as ecosystem contributors and thereby actively enable the practical value of verifiable credentials and trust mechanisms.

The importance of verifiable credentials and trust infrastructures is also reflected in international exchange formats such as the Global Digital Collaboration Conference (globaldigitalcollaboration.org). Representatives from governments, standards organizations, industry, academia and civil society exchange views on concrete applications of wallets, digital identities and verifiable data. DIDAS is a co-organizer of this global initiative.

Quote Daniel Säuberli, President of DIDAS

“With the Swiss E-ID and the swiyu trust infrastructure, electronic credentials create new opportunities for digital interactions and transactions. They provide an instrument to systematically and legally transform paper-based processes into the digital world and further automate them. What matters now is that these possibilities lead to concrete applications with economic and societal value. The Launchpad is a first format that brings together relevant actors to develop them collaboratively.”

Quote Prof. Dr. Tim Weingärtner

Lecturer at Lucerne University of Applied Sciences and Arts (HSLU) and Vice President of DIDAS

“Identity verification is a core component of many business processes. When operating in digital environments, secure, trustworthy and self-sovereign identity solutions are essential. It is therefore crucial to engage with this topic early on, invest in targeted education and build the digital capabilities needed to confidently handle digital credentials.”

Quote Daniel Gahlinger

Group Chief Digital Officer, Migros Federation of Cooperatives

“Verifiable credentials will change the way we interact with customers, partners and employees. Migros has been involved with DIDAS for three years because a trustworthy ecosystem can only emerge through collaboration. With the Launchpad, we can now advance concrete use cases and test the swiyu trust infrastructure in practice.”

Media Contact

Digital Identity & Data Sovereignty Association (DIDAS)
info@didas.swiss
didas.swiss

PRESS RELEASE Launchpad

Alex Keisner, Head of Know Your Agent @ Vouched
Dylan Hobbs, KYA Principal Founding Engineer @ Vouched

As AI agents become a fixture of daily digital life, a deceptively simple question is becoming one of the hardest problems on the internet: who is actually on the other side of this interaction?

For decades, the identity question was straightforward enough. A person logged in, a service checked their credentials, and a session began. The human was the actor, and the service knew it. That model is rapidly breaking down. Today, a growing share of online interactions is being initiated not by humans typing at keyboards, but by AI agents acting on their behalf - booking travel, scheduling appointments, placing orders, managing accounts.

When an AI agent shows up at a digital front door, the service on the other side faces a genuinely new set of questions: Which agent is this? Who sent it? And did that person actually authorize it to do what it's trying to do?

These are questions the current infrastructure of the internet was not built to answer.

The Gap That MCP Left Open

Vouched, whose work began in human identity verification, recognized the identity gap for Agentic AI early on.  Rather than building a proprietary solution, the team set out to apply its knowledge to an open solution that could benefit the entire industry. The result is the Model Context Protocol - Identity (MCP-I): an extension to MCP that adds a complete identity and delegation layer for AI agents.

Today, Vouched is formally donating MCP-I to the Decentralized Identity Foundation (DIF), an organization dedicated to decentralized identity-related specifications and open-source code development. At DIF, the MCP-I specifications will be further developed as a community-driven open standard under the Trusted AI Agents Working Group, through a dedicated MCP-I task force.

The Problem, Precisely Stated

To understand why MCP-I matters, it helps to understand what "identity" actually means in an agentic context. It is not a single question but four:

Who is the agent? An AI agent needs a verifiable, stable identity of its own—not just a session token or an API key, but a cryptographically anchored identifier that can be confirmed independently via verifiable presentation. Who authorized the agent? The agent is acting on behalf of a human principal. The service needs to know who that person is, ideally with the same confidence it would have if the person were interacting directly. What is the agent permitted to do? Authorization is not binary. A person might grant their travel agent AI permission to search and book flights, but not to modify their payment methods. The scope of delegation matters. Can the agent be trusted? Beyond credentials, there is the question of reputation: whether this agent, in this context, has a track record of behaving as it claims to.

MCP-I addresses all four. It defines a framework in which agents carry cryptographically verifiable identities, delegation is represented as tamper-evident credentials with explicit scope, and the entire chain from human principal to agent action can be verified by any service that the agent approaches.

Why DIDs and VCs—and Why We Started “Backwards”

It is worth being direct about something: Vouched did not begin with a commitment to Decentralized Identifiers or Verifiable Credentials. The team began with the problem.

The first step was to look at the requirements: cryptographic verifiability, decentralized infrastructure control, tamper-resistance, and interoperability across platforms and organizations that have no prior relationship. The technologies that matched the requirements areDIDs and VCs. These are the tools the identity community has spent years developing precisely for problems like this one. The fit is not coincidental; it is the result of those standards being built to solve hard problems in trust infrastructure.

That convergence is also what makes DIF the right home for MCP-I. DIF exists at the intersection of open standards and practical implementation. Its community includes the people who built DIDs and VCs, who understand the hard-won lessons behind them, and who are best positioned to extend MCP-I into a robust, broadly adopted standard.

How MCP-I Works

At its core, MCP-I defines a clear set of actors and the protocols that bind them together:

The User (Principal) is the human who owns the delegation - the person who instructs their AI agent to go do something on their behalf.  The Agent is the AI software carrying out the task. The Service is the resource the agent is trying to access.  The Verifier - often an edge proxy - is the component that checks credentials against policy at runtime before requests are passed through to the service.

When an agent wants to act on a user's behalf, MCP-I requires it to present proof of all three identity dimensions: 

Its own identity (a DID anchored to the agent). The user's identity (a Verifiable Credential linking the human principal to the request). The delegation (a machine-readable policy credential specifying what the agent is authorized to do, issued by the user, and scoped to the task at hand).

Think of it like a power of attorney. A person grants their attorney authority to act on their behalf for a specific purpose—for example, to close on a real estate transaction. The title company has never met the attorney before, and may never interact with them again, but the notarized document is sufficient: it names the principal, identifies who is authorized to act, and defines exactly what they are permitted to do. The attorney cannot exceed that scope, the principal can revoke it at any time, and the document can be verified independently by any party without advance coordination. MCP-I works the same way. The delegation credential is the notarized document, the agent is the attorney, and any service they approach can verify the chain of authority on the spot.

This last point matters enormously in a cross-domain context. When a consumer sends their AI agent of choice, whether that is Claude, ChatGPT, or any other, to interact with a merchant, a healthcare provider, or a financial institution, the service has no prior relationship with that agent. It cannot rely on a pre-registered client ID or a shared secret. MCP-I gives services a way to verify the agent's identity and authority on the spot, without any advance coordination, using open standards.

This summary represents the tip of the iceberg—current DID methods, delegation schemas, and more are part of the full v1 spec found at the MCP-I documentation page.

A Framework Built for Real-World Adoption

MCP-I makes identity and delegation verifiable; services still apply risk policy, monitoring, and abuse defenses using audit and reputation signals. MCP-I defines three conformance levels to accommodate different security requirements and adoption stages:

Level 1 allows organizations to get started quickly using basic DID issuance and legacy identifiers like OIDC and JWT, getting immediate benefit while building toward fuller compliance. Level 2 adds mandatory DID verification, full credential delegation verification at request time, and revocation support. Services can opt-in to receiving identity headers or direct handshake flows. Level 3 is the enterprise tier including comprehensive credential lifecycle management, immutable audit trails and the ability for both the agent and the receiving service to be fully MCP-I aware.

This tiered approach reflects a practical reality: the ecosystem will not adopt a new identity and authorization framework all at once. Organizations need an on-ramp. MCP-I provides one.

Early application of the framework has already been demonstrated in agentic commerce. An e-commerce merchant has used MCP-I-aligned tooling to enable AI agents to complete purchases on behalf of consumers - with full verification of which agent is acting, who the human buyer is, and that the necessary permissions have been granted. The result is commerce that is both more seamless for users and more secure for the merchant.

What Happens Next at DIF

When Vouched approached DIF, the organization was well prepared to receive the contribution. It is common for DIF to accept specifications and code contributions from members who recognize the importance of having open standards for widespread adoption. Furthermore, DIF members had already created a new Trusted AI Agents Working Group (TAAWG) because of the critical nature of Agentic AI identity. In other words, DIF had a group ready and willing to fine tune and trial MCP-I. 

Vouched is making a significant contribution to DIF with its MCP-I protocol and participation in our Trusted AI Agents Working group. Often we see people despairing that it will become impossible to trust our own eyes because of the miracles of AI, but they forget the days when we couldn't sort spam out of our email boxes. Today, spam still makes up half of the email traffic, but it doesn't reach your inbox. In the same way, we will reach a time when you can tell legitimate AI Agents from fakes, and the contribution of MCP-I is a step in that direction. At a time when many companies are turning towards proprietary solutions, Vouched has recognized the importance of open source and open standards for the industry. Interoperability of Agents needs to go beyond their ability to communicate and allow them to also know which agents are trustworthy. MCP-I is a major step in that direction and we are excited to collaborate on this effort to deploy Agentic AI safely.

- Grace Rachmany, Executive Director @ Decentralized Identity Foundation

MCP-I joins DIF not as a finished artifact but as a starting point for community co-development. The Trusted AI Agents Working Group will provide the home for this work, and the newly formed MCP-I task force will drive the specification forward. This work directly supports the WG’s published focus on identity, authority, and governance for privacy-preserving, secure agents and participants from across the identity, AI, and developer communities are encouraged to engage.

For DIF members and the broader decentralized identity community, MCP-I represents a concrete and timely application of the standards they have been building. DIDs and VCs, long proven in the context of human identity, now have a well-defined path to relevance in the agentic era. DIF is set up for rapid iteration and co-development, and we plan to take advantage of that culture for this cutting-edge work. 

For developers building AI agents and the services that receive them, MCP-I offers a path to interoperability and trust that no one has to build from scratch. The framework is open, documented, and designed to work across organizational boundaries without requiring prior coordination.

For the humans at the center of all of this—the people sending their AI agents out into the world to act on their behalf—MCP-I is the infrastructure that makes it possible to remain in control: to delegate with precision, to revoke at will, and to trust that the services their agents interact with know exactly who sent them and why.

The identity layer for the agentic web is an open problem. MCP-I is the universal solution, and it now belongs to the community.

To learn more about MCP-I, visit: Model Context Protocol - Identity

To get involved in the Trusted AI Agents Working Group at DIF,
visit our website.

 An open source proof-of-concept for verifiable human identity developed by LFDT, Hedera and DSR

When LF Decentralized Trust held its first annual Member Summit in October 2024, Linux Foundation CEO Jim Zemlin issued a challenge to the members: LF itself needs decentralized trust solutions—starting with the Linux kernel project.

AI agents are getting very good at doing real work. Building a prototype is now almost effortless. You write a prompt, the system creates the structure, and you ship it. Agents can refactor code, connect APIs, generate user interfaces, run workflows, and even open pull requests while you’re still thinking about the next step.

But the big challenge in 2026 isn’t speed anymore. It’s trust.

When an agent runs day-to-day, you need to understand what it used, where the information came from, what changed over time, and why it made a decision.

Without that, teams run into the same problem again and again. The first demo looks amazing. Then reality hits. The agent forgets what happened last week, can’t explain where an answer came from, and starts mixing guesses with facts.

This is what some builders call agentic dementia.

And it becomes a serious issue the moment agents interact with systems such as transactions, production systems, identity, compliance, or reputation.

The trust gap

Today, most agents can’t reliably prove:

What they used: the exact sources that informed the output Where it came from: who published the information and when What changed over time: versions you can trace and reproduce Why they acted: a decision trail you can inspect later

If your agent can’t show the trail behind an answer or action, you don’t have a trustworthy memory. You have a clever demo.

Why “RAG memory” hits a wall

A common setup for agent memory works like this: the system retrieves a few chunks from a vector database and adds them to the prompt.

This helps with recall, but it quickly breaks when you ask simple questions:

Where did this information come from? Who authored it? Can I verify it independently? What changed, and when? Which sources did the agent rely on for this specific action? Can I audit this later without trusting a single database?

If you can’t reconstruct exactly what the agent used and why, the system becomes fragile and slowly drifts away from reality.

What trustworthy memory actually looks like

If you want agents that work beyond a one-time demo, you need something more than a collection of documents.

You need a shared context layer that persists across runs, tools, and even across multiple agents.

In practice, that context should be:

Structured: build around entities and relationships, not just documents Queryable: so you can follow connections like project → decision → owner or policy → exception → approval Traceable: outputs link back to the inputs that shaped them Reusable: available across agents and workflows Verifiable: tamper-evident, with provenance you can validate

This is where OriginTrail Decentralized Knowledge Graph (DKG) comes in.

The DKG lets you store and use knowledge as a verifiable context graph, with provenance and traceability built in. Instead of relying solely on untraceable embeddings, agents can reference knowledge where sources are clear, relationships are preserved, and changes can be tracked over time.

In February 2026, OriginTrail DKG reached a milestone of 2 billion Knowledge Assets published. Every Knowledge Asset anchors facts, compliance records, certificates, supply chain events, research outputs, and decision traces into a shared, queryable context graph. Knowledge Assets form a collective memory infrastructure for humans and machines. Discover more on X: https://x.com/origin_trail/status/2026644353880346958?s=20 A practical pattern for verifiable agents

You don’t need a massive change to get started. Just treat memory as a core system component, not an afterthought. A practical approach could look like this:

Publish critical context as Knowledge Assets
Store things like API contracts, schemas, policies, specs, vendor facts, approved actions, and known-good configurations as structured Knowledge Assets. These become dependable contexts for your agents. Make retrieval auditable
Let agents query a context graph that contains entities, relationships, provenance, and versioning. This allows the agent to point directly to the knowledge it used. Write outputs back with lineage
When an agent produces a decision, report, or change, publish it as a new Knowledge Asset that links back to the inputs it used. That turns outputs into traceable artifacts. Verify before high-stakes actions
Before executing sensitive steps, verify the integrity and provenance of the assets the agent depends on. Keep the proof for later audit.

If you want a quick gut check, ask: “Can I see the trail behind this answer?”

If the answer is no, the system will not scale safely.

Trustworthy identity: agents need passports

Once memory and context become trustworthy, the next layer is identity.

AI agents are already managing wallets, executing trades, and interacting on your behalf, often with zero accountability infrastructure.

As agents become autonomous actors, they need a way to present:

Who or what they are What they’re allowed to do What they’ve done, with an auditable history What they’re trusted for, based on validation and reputation

That’s why “agent passports” matter.

Standards like ERC-8004 are emerging for registries that provide identity, validation, and reputation for AI agents.

Curious how AI agent passports work and why ERC-8004 matters?
Dive deeper into the article: https://origintrail.io/blog/passport-please-ai-agents-are-becoming-first-class-citizens-with-erc-8004-origintrail-27fb90af8af9

Projects like ClawTrail, built on the OriginTrail Decentralized Knowledge Graph (DKG), are tackling this directly with a verifiable passport for every AI agent, a living TRAC(k) record (signed credentials, auditable history, certified capabilities), and agent-level KYC so you know who, or what, you’re dealing with.

Vibe coding made it easy to build and ship agents. Now everyone can ship agents that sound right.

The real advantage will belong to teams whose agents can prove where their knowledge came from, what changed, and why they made a decision.

Speed helps you ship demos. Verifiability helps you run real systems.

Start building AI agents with verifiable memory today — learn how in the OriginTrail official documentation.

The next wave of vibe coders won’t just ship agents. They’ll make them verifiable. was originally published in OriginTrail on Medium, where people are continuing the conversation by highlighting and responding to this story.

The release ofWeb3j v5.0.2 marks another important step in the evolution of the Web3j ecosystem. This release is not just about version numbers or dependency bumps; it reflects the steady, collective effort of contributors, mentees, maintainers, and long-time community members who continue to shape the project.

For those who missed it, here’s a summary of the conversation from our latest Virtual Coffee Chat.

Our March Virtual Coffee Chat brought together members from across banking, credit, central banking, education, and biometrics for a wide-ranging conversation about where digital identity meets real-world friction, from AML compliance to facial recognition testing.

From Cash to Credentials: The Cost of Compliance Duplication

New Zealand’s declining cash infrastructure set the scene for a broader discussion about the urgent need for trusted, reusable digital identity – not just for convenience, but for inclusion. The group reflected on how duplicated AML verification work across institutions contributes to some of the highest banking compliance costs in the world. Recent changes to the AML Act offer some flexibility for standard and low-risk customers, but trust between institutions, and clarity on the regulator’s role, remains a key challenge to unlocking a shared verification model.

Reusable Credentials and Bank Onboarding

The group explored how a reusable credentials model could sit at the heart of a simpler, safer onboarding experience, allowing people and businesses to verify once and share as needed, without oversharing. If banks could securely and compliantly share verified identity information, the burden on customers could be significantly reduced. This is a space the DINZ community is actively working to shape.

The Trusted Credential Adoption Group: Six Use Cases to Watch

The Trusted Credential Adoption Group (TCA Group) shared an update on its progress across six priority use cases for credential adoption in Aotearoa, including bank account opening, KYC (Know Your Customer), and lost phone / device recovery verification. The group is targeting a May deadline for market communications. Anyone interested in contributing or observing is welcome – reach out to the DINZ team to find out more.

Infrastructure First: A Broader Conversation

The group grappled with an important provocation: are we building credentials on top of shaky foundations? The discussion highlighted the need for accurate underlying data and identity systems designed to serve the broad population – including New Zealand’s significant transient population, whose needs are currently underserved. There was appetite for a more integrated approach connecting health, education, social services, and finance through common identity infrastructure, rather than compliance-driven silos.

Biometrics and the Kiwi Faces Project

New Zealand’s balanced privacy framework was highlighted as a genuine strength in the biometrics space. The group discussed the Kiwi Faces project – an initiative to develop a secure, ethically sourced dataset for testing facial recognition and biometric solutions in a New Zealand context. There was strong interest in bringing Retail NZ and other sector partners on board to ensure solutions are tested responsibly before reaching the public.

Looking Ahead

The TCA Group is progressing communications across its six priority use cases, with a May deadline – interested parties are welcome to join or observe upcoming meetings. A FinTech Hui panel on “From KYC to Continuous Trust” is coming up next week. The Cyber Security Summit and Token events in Wellington are also on the horizon. Potential collaboration opportunities are emerging with international partners, including Digital India, with discussions planned in Abu Dhabi soon.

Want to join the next Virtual Coffee Chat? Check out upcoming dates and register →

The post Virtual Coffee Chat Recap – March 2026 appeared first on Digital Identity New Zealand.

With 4.7 million enrolled users in a country of roughly 5.6 million people, BankID Norway is one of the most widely adopted digital identity schemes in the world. In 2025 alone, the platform processed close to 901 million transactions, covering everything from tax filings and student loan applications to legal name changes and divorce proceedings. But scale exposes identity verification to threats, meaning that authentication alone is not enough.

At a recent webinar, BankID Norway’s Ove Morten joined Joe Palmer, president of iProov, and Megan Shamas, CMO at FIDO Alliance, to discuss how the platform has evolved its approach to authentication and why combining passkeys with biometric liveness verification has become central to that strategy. 

Yubico, a modern cybersecurity company and creator of the most secure passkeys, today announced the launch of YubiNation Partners, a new global Channel program designed to unite a community of security experts. In the face of growing AI-driven cyber threats, the program enables partners to become trusted advisors and cultivate a safer digital world for their customers, making identities private and secure.

Dashlane has implemented the FIDO Credential Exchange standard on Android to simplify vault transfers. This protocol replaces insecure CSV exports with an encrypted direct transfer between apps. While it enables the portability of passkeys, its current effectiveness is limited because other major providers like Google have yet to fully adopt the standard.

Raonsecure said on the 26th it will launch an open recruitment drive for AI and security talent to lead the era of Agentic AI.

Raonsecure will recruit entry-level and experienced hires online through Mar. 15. The company said strong interest is expected again this year after last year’s open recruitment posted a 125-to-1 competition rate.

Our entire digital life is secured by a password, and it’s up to us to use secure and unique passwords that can withstand emerging physical threads. Routine data breaches, phishing attacks, and compromised accounts put user data at risk — especially if you use the same password across multiple accounts. Considering the kinds of data stored in digital accounts in 2026, from banking accounts or credit card hubs, we need an option that’s both secure and simple. Passwords are not the answer, but their replacement is just as useful and private as advertised.

Federal authentication standards and major platform shifts have made passkeys the default login method for most consumer and enterprise accounts, pushing traditional password managers toward obsolescence. The FIDO2 protocol, backed by the W3C’s WebAuthn specification and endorsed by both NIST and CISA as the only widely available phishing-resistant authentication method, now ships natively in every major browser and operating system. For the growing number of users whose accounts rely on public-key credentials instead of shared secrets, the password manager has become a solution to a problem that no longer exists.

Digital economies across the Americas are expanding rapidly, presenting both new opportunities and risks. As a largely mobile-first region, there is widespread innovation, especially in payments. At the same time, bad actors are exploiting technologies and processes, putting this progress at risk.

That is why we are excited to announce the launch of the FIDO Americas Adoption Forum (FAAF). This is a new initiative designed to advance open standards and accelerate market adoption across the region. It aims to uncover new opportunities to provide simpler and safer authentication with FIDO technologies in the Americas. Initially, the Forum will be focused in Latin America, given its potential.

The opportunity

In many Latin America markets mobile internet penetration exceeds 70% and populations are digitally active at very high levels. For example, Brazil’s “Pix” instant payment system has been adopted by over 90% of adults. That kind of uptake signals both technological readiness and a massive user appetite for frictionless experiences.

But rapid digitization brings challenges. Credit card fraud rates across Latin America are 97% higher than North America, and legacy authentication is failing to stop malware attacks that have risen by 113% in the region, with 79% of fraud occurring on mobile devices. Bad actors are also exploiting new threat vectors. Looking at Brazil again, deepfakes in Q1 2025 occur at five times the rate seen in the US and ten times the rate in Germany.

These conditions create an urgent need for phishing-resistant authentication technology that puts trust and simplicity at the center of digital interactions. With FIDO adoption in the relatively early stages across much of the region, the impact that can be achieved by shaping adoption and solving these security gaps is enormous.

Our Approach

The FAAF will focus on fostering a local community of industry leading organizations and experts to address the specific technical, regulatory, and business challenges of the region. We are drawing on FIDO’s model that has proven successful in driving adoption of open, phishing-resistant standards across the globe, including our APAC Marketing Forum, while adapting to regional dynamics. This includes:

Local champions: We will identify leaders to advocate for interoperable standards within their markets and connect global best practices to local needs. Education and enablement: We will bring FIDO expertise to stakeholders in key verticals – including banking, e-commerce, government, and airlines – through targeted webinars and workshops. Regulatory engagement: We will help regulators understand how FIDO standards can support national security and economic objectives. Regional insights: We will channel feedback from the Forum to ensure FIDO specifications and market enablement activity address real-world deployment challenges.

Help drive FIDO adoption in the region

We’re starting with quarterly calls focussed on understanding the opportunities, challenges and nuances of the Latin American markets. This will include FIDO members from the region and those with interest and operations there. We will also explore bringing in external speakers to share their expertise on regulation, industry trends, and other topics of interest.

A major part of our initial work will focus on understanding the regulatory environment in key markets, and identifying opportunities to engage with regulators to educate them about FIDO.

If you are a FIDO member, look out for a formal invitation to join the Forum soon. We will follow this with our official kick-off call in the coming weeks.

The opportunity in Latin America is significant. I hope you will join us in bringing greater trust and simplicity to digital interactions across these dynamic markets.

The post Dashboards, Decisions, and Dollars: Cybersecurity Reporting that Works appeared first on Edge, the Nation's Nonprofit Technology Consortium.

After ten years of creative cooperation, we’re announcing that We Are Open Co-op (WAO) will close its doors on our 10th birthday: 1st May 2026. This has been a carefully considered, collaborative decision — the kind we’ve always tried to model as a co-op.

But, as you can imagine, we’re a bit emotional about it, and it also feels a bit weird to finally say it out loud and in public. 

WAO is a strong, well-respected brand. We continue to have wonderful clients, meaningful work and good relationships with each other. People are finally waking up to the idea that flat hierarchies and consent-driven businesses are the future. 

In some ways, this is a continuation rather than an ending, as we’ll be carrying forward the cooperative principles we’ve practised into new systems and relationships.

So what’s going on?

Change. It’s the only thing that stays the same. 

Ten years of We Are Open has taught us that openness is less about tools and more about trust. We’ve collaborated with brilliant people, learned from our mistakes, and stayed curious together. That feels like success to us.

We’ve been running We Are Open Co-op for a decade now, and while we remain friends (and probably future colleagues), we’ve decided that it’s time to move on. As a cooperative, we’re known for a particular kind of work. As individuals, we find ourselves looking to expand in directions that impact each other as well as our cooperative: 

John is looking to get into a full-time gig that spotlight his gift for building relationships and trust.. Alternatively, he wants to work outside for a while. Laura is taking a sabbatical starting on May 1st. She made no major plans because she’s not sure what happens when a person who has never stopped just…stops. She will write and wander and build things and try to figure out where she wants to point her big brain next. Doug is eager to continue the good work of our collective, both on his own and with new collaborators. He will continue working with our current clients while also focusing more on helping organisations deal with complexity. 

Closing WAO thoughtfully and responsibly means that each of us gets to reflect on and celebrate what we’ve achieved without leaving any one of us with the current shared burden of responsibilities and accountabilities of running a business. 

Open Sourcing our work 

We’ve always worked openly. The clue is in the name! 

So we want to figure out what to do with all our stuff. We have so many artifacts and resources. There are truly useful things that we want to make sure remain open and accessible. 

That means we have some archiving to do. We’ve already started planning and implementing this, and will spend the next couple of months putting things in various places.

Here’s what we’re planning:

Websites – we’ll be using the Internet Archive’s wonderful Wayback Machine to ensure that our websites and blog posts  remain available. Here’s an example blog post so you can see how it works.  Podcasts and other audio/visual media – these will be collated in lists on the Internet Archive. For example, we’ve  uploaded and listed every season of the Tao of WAO podcast. Pages, courses, images & other resources – we’ll use GitHub repositories, pages, and wikis to share everything that doesn’t fit elsewhere. For example, we’ve already archived the wonderful visual thinkery that former member Bryan Mathers created for us. 

Helpfully, we recently renewed our domain for a couple of years, so weareopen.coop will remain our canonical link until September 2028. 

At the start of May this year we will upload a redesigned “We Are (no longer) Open” site that serves as an index page to help people find their way through our archives. 

But I was about to hire you!

That’s awesome to hear. If you have a project and want to chat about it now, please do get in touch. We may take on some new work in the next 10 weeks. However, projects that have timelines that extend out beyond May 1, 2026 will potentially need to have multiple contracts/agreements.

For future work, please get in touch with us individually:

Doug can be contacted at hello[at]dynamicskillset.com Laura can be contacted at hello[at]laurahilliger.com John can be contacted at hello[at]johnbevan.com

MSG has been labeled as the villain of the food world, but Jennifer Ko is rewriting the story and bringing it back with a bold new twist.

In this episode, Reid Jackson sits down with Jennifer Ko, the founder of Dime, a company that's reinventing how we think about MSG. Jennifer shares her personal connection to MSG, the cultural beliefs that shaped her family's avoidance of it, and how she's working to debunk common myths about this misunderstood ingredient. She also discusses the challenges of packaging, logistics, and the supply chain that come with launching a product in the competitive CPG space.

In this episode, you'll learn:

How Jennifer's curiosity about MSG turned into a business idea

The challenge of changing consumer perceptions

The importance of streamlining packaging and logistics in CPG

Things to listen for: (00:00) Introducing Next Level Supply Chain (01:57) Jennifer's entrepreneurial journey (06:08) Breaking down the misconceptions about MSG (11:33) Building a brand around a stigmatized product (18:28) The challenges of building a business in the food industry (29:17) Advice for startups and aspiring entrepreneurs (33:19) Jennifer Ko's favorite tech

Connect with GS1 US: Our website - www.gs1us.orgGS1 US on LinkedIn Register now for this year's GS1 Connect and get an early bird discount of 10% when you register by March 31 at connect.gs1us.org.

Connect with the guest: Jennifer Ko on LinkedInVisit Dime at dimemsg.com

Overview

The FIDO Alliance hosted a one-day seminar on “Advancing Authentication, Identity and Payments in Europe.” The seminar gathered many influential leaders and decision-makers to explore Europe’s evolving authentication, identity, and payments landscape. 

Attendees gained insights into the latest developments with FIDO, passkeys, payments, identity verification and digital credentials. 

View the presentations below:

fido-paris-seminar-welcome-remarks-pptxfrom FIDO Alliance

fido-paris-seminar-verifiable-credentials-the-foundation-of-agentic-payments-and-commerce-pptxfrom FIDO Alliance

fido-paris-seminar-securing-digital-identity-with-passkeys-pptxfrom FIDO Alliance

fido-paris-seminar-secure-payment-confirmation-pptxfrom FIDO Alliance

fido-paris-seminar-cra-requirements-with-fido-tech-pptxfrom FIDO Alliance

fido-paris-seminar-identity-wallet-learnings-from-bankid-in-norway-pptxfrom FIDO Alliance

fido-paris-seminar-fit-for-payments-pptxfrom FIDO Alliance

fido-paris-seminar-fido-authentication-for-the-financial-ecosystem-pptxfrom FIDO Alliance

fido-paris-seminar-fido-alliance-abanca-key-pptxfrom FIDO Alliance

fido-paris-seminar-eu-policy-update-roundtable-pptxfrom FIDO Alliance

fido-paris-seminar-eu-digital-wallets-pptxfrom FIDO Alliance

fido-paris-seminar-digital-commerce-reimagined-pptxfrom FIDO Alliance

Over the last several years, Blockchain Commons has developed numerous technologies meant to improve the independence, privacy, resilience, and openness of the internet, to allows users true self-sovereignty. The earliest technologies have been adopted by many third-parties, while many newer technologies are available for deployment now.

The brand-new 2026 Technology Overview from Blockchain Commons describes each of 24 different technologies, applications, and references in about a minute each, offering the most comprehensive and accessible look at Blockchain Commons technology to date.

Here’s a quick look at the topics covered in the Overview:

Data Encoding

Our foundational methods for storing data in an interoperable format.

dCBOR. An update to the CBOR data format that ensures that data is always encoded in the same way. Known Values. Integers assigned to common concepts and recorded in a common registry. Uniform Resources (URs). An encoding method for structuring binary data as plain text strings. Multipart URs (MURs). URs with large payloads split into fragments seen as Animated QR codes. Cryptographic Protections

Technologies that protect, authenticate, and verify your data.

FROST. A Schnorr-based threshold signing system. Provenance Marks. A forward commitment hash chain that is public verifiable, used to assess content authenticity. Sharded Secret Key Reconstruction (SSKR). A Shamir’s Secret Sharing variant that includes two-level thresholds. Data Identification

Aids that help humans to recognize complex binary and hex data.

Bytewords. An encoding method that makes data human readable, also used by URs. LifeHash. A visual recognition system that creates a unique visual icon for any data. Object Identity Blocks. An ID card for digital objects that improves recognition and reduces confusion. Gordian Envelope

The core of our higher-level stack, used for safely storing and sharing data.

Gordian Envelope. A deterministic smart document system that supports elision, encryption, and permits. Gordian Sealed Transaction Protocol (GSTP). A transportation method for moving envelopes securely between parties. Encrypted State Continuations (ESC). A method for storing client data as a black box in GSTP communications. Self Sovereign Identity

Methods to control your own identity, built on Gordian Envelope.

Extensible Identifier (XID). A secure self-sovereign and self-certifying identifier. Gordian Clubs. A self-contained cryptographic publication that you can distribute without infrastructure. Secure Data Transport

Self-sovereignty can often be censored by the transport layer. These apps demo ways to avoid that.

Garner. A Tor onion service that privately serves files using TorGaps. Hubert. An automotable dead drop protocol that uses distributed storage networks for communication. Reference Apps

All of our technologies are references. These apps show how many of them work.

dCBOR-CLI. An app for investigating dCBOR, including powerful dCBOR pattern expressions. envelope-CLI. An app demonstrating extensive envelope and XID functionality. Seedtool-CLI. A command-line app that demonstrates data encoding and other low-level protocols. Gordian Seedtool. An iOS seed vault that mirrors seedtool-CLI in a graphical environment. Information Repositories

We want to help you learn about our technologies! Besides our developer pages, the following resources also contain information.

Gordian Dev Meetings. Monthly or bimonthly meetings that discuss and demo technologies. Research Repo. The precise technical specifications for many of our technologies. YouTube. Videos of our meetings as well as other overviews and demos.

Besides our new 2026 Technology Overview, you may also wish to watch our 2021 Technology Overview, which contains more extensive discussions of our older (more widely adopted) technologies and also our two-part overview of Gordian Envelope.

2021 Overview: Envelope Overview: Envelope Extensions:

The post Accessibility is Everyone’s Business appeared first on Edge, the Nation's Nonprofit Technology Consortium.

Building AI Trust at Scale — Series Part 5 By DIF Ambassador Misha Deville Previous in this series: Part 4 – Authorizing Autonomous Agents at Scale → View all parts

“The utility of autonomous agents is, in part, tied to their ability to engage in economic activity.” - OpenID Foundation1

People happily ask ChatGPT and Gemini to research products, compare prices, and find deals. In fact, Shopify reported AI-driven traffic was up 7x since Jan 20252. But handing an agent your credit card to complete a purchase? That hits a different trust threshold. 61% of consumers say they would trust agents with purchases under $20, but that drops to 39% as the amount increases.3 

Fully autonomous agentic commerce, where AI agents handle your weekly shop, book your holiday, and manage your subscriptions without human approval, still feels distant. Yet the infrastructure to enable an agentic economy is being built at an unprecedented rate. 

In a six-month period from April to September 2025, Visa, Mastercard, PayPal, Stripe, and Google all launched agentic payment infrastructures. While McKinsey projects that by 2030, agentic commerce could orchestrate $3-5 trillion in global revenue.4 

The challenge is agents need a single credential that provides identity and payment authorization across any merchant, without creating accounts, exposing sensitive data, or waiting for human approval. Agents have different lifecycles, capability requirements, and trust models than humans or traditional software5. If agents can't identify themselves and pay in one atomic transaction, autonomous commerce remains theoretical.

An Accelerating Ecosystem

The payment networks, Visa, Mastercard, and PayPal, all launched agentic commerce infrastructure with capabilities to complete transactions on a user's behalf. Stripe and OpenAI co-launched the Agentic Commerce Protocol, enabling add to cart and checkout in ChatGPT, and Google followed with Universal Commerce Protocol, backed by similar partners of Target, Walmart, and Shopify. The technical solutions differ, but the architectural pattern is the same:

Agents need credentials that combine
"who", "whose money," and "can pay."

McKinsey predicts the US B2C retail market could see up to $1 trillion in orchestrated revenue by 20304. While more conservative projections from Morgan Stanley ($190-385 billion)6 and Bain ($300-500 billion)7 suggest greater uncertainty about adoption velocity. What's certain is nearly every major payment network, tech platform, and commerce infrastructure provider has decided the transition is inevitable enough to warrant immediate and substantial investment.

The Problem They’re Solving

Think about booking a weekend trip. Flights, hotel, rental car, restaurant reservations. Each requires creating an account, verifying your email, and entering payment details. 

Now imagine designing your trip through conversation with an agent that knows your preferences, budget constraints, and priorities, then having that agent handle the bookings. Prototypes like Autoura (built by DIF Hospitality & Travel working group co-chair, Alex Bainbridge) are testing whether users will want to design complex trips through AI conversation, and seeing what that reveals about the infrastructure required. But today, even if users embrace the concept, the agents hit a wall at checkout. 

The agent needs to arrive at each merchant and prove: “I'm acting on behalf of verified user X, with authorization to spend up to $Y on travel between these dates, and here's cryptographic proof of payment capability. Complete the booking." All in one presentation. No account creation, no passwords, no credential exposure.

Traditional systems can't do this. They handle identity separately from payment. Authentication happens in one system (OAuth, SAML), payment authorization in another (card networks, bank verification). By the time you've manually intervened at every checkpoint, you might as well have booked the trip yourself. 

Why Identity and Payments Are Converging

Without identity, payments lack security and accountability. Without payments, identity lacks transactional value. For autonomous agents, the two must be united. 

The major financial players recognize this. Mastercard's Agentic Tokens combine identity verification with spending controls and include an audit trail of which agents acted. PayPal's architecture emphasizes W3C Verifiable Credentials (VCs) for all mandate structures, signaling convergence on open standards.

Even regulators are moving in this direction. By November 2027, financial institutions in Europe must accept EUDI wallet credentials for Strong Customer Authentication under PSD2 (EU payment rules)8. The wallet's architecture enables users to prove identity and authorize payments through device-bound cryptographic keys within a single interface. But it assumes a human with Face ID approving each transaction. For agents operating autonomously, you need delegation primitives the wallet doesn't have: spend limits, merchant constraints, time bounds, and the ability to prove “I'm authorized to spend up to €50 on groceries this week” without human approval for each purchase9.

As Andor Kesselman notes, “If you look at agent payment protocols, nearly all of them have identity as a fundamental layer.” The architecture is converging, but what's missing is the programmability of those credentials for autonomous use. 

A Decentralised Approach

Centralized infrastructure hits a wall when agents need to transact across services that don't share a common identity provider. This is why organisations like NANDA (MIT) and AGNTCY (Linux Foundation) are building infrastructure for the “Internet of Agents”, solving how agents discover each other, verify capabilities, coordinate tasks and collaborate across platforms to solve complex problems. 

Some organisations are specifically tackling KYA (Know Your Agent), providing agents with verifiable identities that create a trust layer for autonomous actions across AI ecosystems.

KYAPay gives agents a single portable credential that works across any merchant on the open internet. Instead of creating accounts at each site or storing credit cards, agents present one JWT token combining verified identity with payment authorization and scope-limited permissions, like spend limits, time bounds, and merchant constraints. This lets them pass through bot managers, login walls, and checkout pages without exposing credentials or waiting for human approval, as demonstrated in their prototype launch with Visa Intelligent Commerce.

Tokens alone though don't solve the problem of scale. As Dmitri Zagidulin, advisor to KYAPay and co-chair of the DIF Trusted Agents working group, explains, “when your agent interacts with airlines, hotels, and rental car companies that share no pre-existing trust relationships, each service would need to federate with every other, or route authentication through a universal provider everyone trusts. Neither of which scales globally”. This is why KYAPay includes upgrade paths toward Decentralized Identifiers (DIDs) and W3C VCs, for cryptographically-anchored identity that’s portable across platforms without requiring pre-negotiated federation. Unlike email addresses or OAuth client IDs that belong to specific providers, a DID is controlled by the entity it identifies. 

MCP-I takes a complementary approach, extending Anthropic's Model Context Protocol with cryptographic identity and delegation layers. Like KYAPay, it builds on DIDs and VCs, but emphasizes real-time capability verification, checking at the moment of action whether an agent is authorized to perform a specific task. Delegations and revocations are verified at the network edge, and every agent action generates a signed audit receipt. 

The Messy Reality

The technical infrastructure might be the easier problem. Agentic commerce rewrites fundamental assumptions about how digital commerce works. 

Ecommerce media, advertising directly on platforms like Amazon and Walmart, hit $178.2 billion in 2025, surpassing total TV advertising for the first time10. Amazon, for example, generated $56.2 billion from advertising in 2024, its third-largest revenue stream operating at 20%+ margins11. If agents bypass visual interfaces and algorithmic search ranking to optimize purely for user intent and price, this entire multi-billion dollar revenue model inherently loses value and faces disruption. 

The conflict is already playing out in court. Amazon sued Perplexity AI in November 2025, over its Comet browser, alleging it “covertly accesses customer accounts" and “disguises AI activity as human browsing.” Perplexity countered that “Amazon wants to eliminate user rights so that it can sell more ads.”12 If Amazon wins, it could force protocol developers to negotiate commercial terms with every major retailer, fragmenting the ecosystem and stalling adoption. 

OpenAI's decision to introduce advertising to ChatGPT's free and Go tiers exposes a fundamental tension. As Daniel Kang, assistant professor of computer science at the University of Illinois, warns: “You might expect that the chatbot system will give you an unbiased recommendation, but it might give you an advertisement without disclosure.”13 It's the same conflict that transformed Google from "organizing the world's information” into a $307 billion advertising business.

Without open, interoperable protocols, agentic commerce either fragments into competing walled gardens or consolidates around platforms with the same ad-driven incentives it was meant to escape. 

The Direction is Set

The infrastructure for verifiable agent transactions is being built. The Agentic Commerce Protocol, the Agent Payments Protocol, KYAPay, MCP-I, all provide technical foundations. But infrastructure may prove easier to upgrade than business models. 

Advertising-dependent platforms are discovering their revenue conflicts with agents that optimize for users. Retailers are defending against autonomous access. And as one senior member of IEEE, Kayne McGladrey, remarked sarcastically: “There are absolutely no scams on the internet, and everything is true on the internet. And so this obviously will work really well with large language models.”13

Without cryptographic proof of identity and payment capability, agents navigating the open web face the same fraud vectors humans do, but at machine speed and scale, making regulators grapple with how to apply consumer protection frameworks to non-human actors.

The direction however does seem to be set. Identity-linked payment credentials will be the rails on which the agentic economy runs. The question is whether those rails will be open. 

“Crucially, for this ecosystem to thrive, it must not become a walled garden.” - OpenID Foundation1 

Join the conversation:

Participate in DIF's Trusted AI Agents working group, currently exploring a wide range of novel approaches beyond today's MCP and A2A paradigms. Give a read to the MCP-i docs to see a DIF-aligned extension module for the Model Context Protocol For a more registry-based and policy-first approach, see ToIP's AI and Human Trust WG.

Building AI Trust at Scale — Series
← Previous in this series: Part 4 — Authorising Autonomous Agents at Scale
By DIF Ambassador Misha Deville
View all parts

Endnotes South, Tobin. (2025). Identity Management for Agentic AI. Open ID. Perez, Sarah. (2025)  Shopify says AI traffic is up 7x since January, AI-driven orders are up 11x. TechCrunch. Wildfire Systems. (2025) The AI Shopping Shift: 2025 Consumer Shopping Report. Wildfire Systems. Singla, A., et al. (2025) McKinsey: Up to $5 Trillion in Agentic Commerce Sales by 2030. Digital Commerce 360. Kesselman, Andor. (2025) “Trusted AI agents: Architecting Identity and Granular Access for the Agentic Web”. YouTube. Morgan Stanley Research. (2025). Agentic Commerce Market Impact Outlook. Morgan Stanley.  Digital Commerce 360. (2025). Bain: Agentic AI Could Account for 25% of U.S. Ecommerce Sales by 2030. Digital Commerce. European Digital Identity Wallet Consortium (EWC). 2025. D2.5 – Payment Enablers Services. EUDI Wallet Consortium.  Austenaa, Marie (2026). How EUDI wallets will impact payments and banking. Dock.io Beet.TV. (2025). Retail media moves beyond the lower funnel as data, AI reshape commerce: WPP Media’s Samantha Borowski. Beet.TV.  Adweek. (2025). Amazon’s ad revenue was $56 billion last year. Adweek.  Reuters. (2025). Perplexity receives legal threat from Amazon over agentic AI shopping tool. Reuters.  Meyer, G. & Rosner-Uddin, R. (2026). How shopping chatbots might transform retail. Financial Times.

SK Telecom has been appointed to the FIDO Alliance Board of Directors, adding a major mobile operator to the leadership group shaping industry priorities around passkeys and phishing-resistant authentication.

The company said the appointment was made at the FIDO Alliance general assembly meeting in Paris and emphasized the role of FIDO-based authentication in the broader shift away from passwords. FIDO’s board composition can matter for both enterprise and consumer deployments because it influences the evolution of specifications, certification programs, and implementation guidance relied on by platforms and relying parties.

Even though everyone knows 12345″ is a terrible password, it still lands at the top of “worst password” lists. We get it, no one likes remembering passwords, and changing them after every data breach is a pain, even if you do have a password manager. Luckily, passkeys have a real chance to replace them entirely with something more secure, tied to your specific devices. With luck and time, it may make the traditional email address-and-password combination obsolete.

The Fast Identity Online (FIDO) Alliance developed passkeys several years ago, and many companies are already implementing them. For example, Microsoft removed password support from its authenticator app in August but left passkey support in place, and Amazon regularly prompts users to create a passkey if they haven’t already.

MOSIP Connect may have wrapped in Rabat, Morocco — but the conversations are just beginning.

Join Juan Caballero for a focused reflection on key insights from the event: the signals that stood out, the themes emerging across sessions, and what they mean for the broader identity ecosystem.

Beyond the formal presentations, this year’s gathering once again highlighted the power of community-driven dialogue — from structured panels to hallway discussions and small group exchanges.

This DIF Hot Takes session continues that conversation, surfacing insights for builders, policymakers, and standards contributors working across digital public infrastructure and decentralized identity.

🎥 Join live here

February 2026

DIF Website | DIF Mailing Lists | Meeting Recording Archive

Table of contents Decentralized Identity Foundation News Working Group Updates Special Interest Group Updates User Group Updates Upcoming Events Get involved! Join DIF 🚀 Decentralized Identity Foundation News

2026 kicked off with lots of DIF action:

Welcome to new Associate Member Kyndryl! Kyndryl is joining with an eye on the Trusted AI Agents Working Group. Check out the blog post welcoming them to DIF. Welcome to our new Operations Manager, Gracezel Luis! Gracezel is an experienced project manager, content marketing professional, and operations expert. The addition of Gracezel will allow DIF to continue to focus on Operational Excellence in 2026. She will be handling all membership and working group administration. Look out for a blog post next month where Grace and Gracezel interview one another in an AMA format!

“I’m glad to be joining DIF at this stage of its growth. I’ve spent the last decade working across operations, project management, and cross-functional teams, with a strong focus on clarity and follow-through. In this role, I’ll be supporting the Executive Director, Steering Committee, membership, and working groups—particularly across membership and working group administration by strengthening processes and helping ensure initiatives move forward in a steady and well-coordinated way.”

DIF Hot Takes launch February 17, 9 am UTC : Join Bumblefudge as he gives you the lowdown on MOSIP Connect. See the DIF calendar or join here. The Steering Committee approved two CAWG specifications: User experience guidance 1.0 and the Organizational identity profile 1.0 Trusted AI Agents WG created a Delegated Authority Task Force, started formalizing the use cases discussed so far as a common resource across Task Forces, discussed and experimented with Threat Modeling as a cross-Task Force exercise, began a Report on Delegated Authority, and started transitioning Vouched ID's MCP-I protocol to DIF governance within the WG. CAWG announces two new Task Forces to explore concrete integration of attestation platforms: one specific to ACDC envelopes, and another for more generic VC/VP tooling. DIF will be on the screening committee for the programming at TDI.  Submit a proposal to the Call for Talks before the 22nd if you'd like to participate.

We can't believe we're only 6 weeks into the year and so much has already happened. More to follow in soon-to-be-released blog posts, so stay turned!

🛠️ Working Group Updates

Browse our working groups here

Creator Assertions Working Group

This month's highlight was the approval by the Steering Committee of the two specifications: User experience guidance 1.0 and the Organizational identity profile 1.0.

CAWG announced two new Work Items: an ACDC Task Force and a more general VC/VP Task Force. Times for these meetings are being scheduled.

The Creator Assertions Working Group had several guests this month, presenting collaborative projects, with two presentations about the Ayra registry, one with Drummond Reed and another with Darryl O'Donnell. The Ayra provides registry services to groups that don't necessarily fall into the "legal entity" status.
During their regular working meetings, CAWG focused on reviewing and discussing several PRs related to the metadata and identity assertion specifications. The group addressed concerns about handling multiple participants in the same role and agreed to research and clarify the language for this scenario. They also discussed a new status code for network traffic validation and debated the naming of sections in the verifiable credentials specification. The conversation ended with a discussion about the need for user education materials and tools to validate compliance with the CAWG specification.

👉 Learn more and get involved

Trusted AI Agents Working Group

The TAAWG has moved to weekly half-hour meetings for the main WG and weekly meetings for the Delegated Authority Task Force.

Pull Request 30 was reviewed, finalizing documentation for the first 4 use cases for the TAAWG working group. The PR is still open for comments. TAAWG launched the Delegated Authorization Task Force, which will be working on an overview of existing work in the area of delegated authorization, data models, and protocols, and then performing a gap analysis to determine where TAAWG can contribute to this rapidly-evolving area. Tom Jones shared a Threat Modeling Report which was reviewed by the working group. The proposed use case being threat modeled conceptualizes an Agentic and policy-enforcing local AI model, tasked with maximmizing privacy and security vis-a-vis remote agents and services. Commments are welcome, specifically on the first 2 pages (the rest should be considered as an appendix). The Delegated Authority Task Force has made progress on a Delegation Report for submission through the working group. Alex Keisner, owner of the Know-Your-Agent product at Vouched, introduced MCP-I as a proposed identity extension to the popular MCP server/client protocol, addressing the need for a standard identity handshake between agents and MCP servers guarding resources. MCP-I may become a separate work item/task force and those interested will be choosing a regular meeting time to discuss DIF governance of the extension.

👉 Learn more and get involved

Hospitality and Travel Working Group

The technical H&TWG have continued their work on Schemas for various common industry-wide use cases, focusing on food taxonomy and preferences, quote systems, and edge computing use cases. The WG and User Group (non-IP-protected) are continuing to find IP-safe ways to share ideas, and encourage members of the latter to join DIF if they want to participate in technical design and implementations.

👉 Learn more and get involved

DID Methods Working Group DMWG has been working on making a number of the DID methods viable for becoming DIF-recommended methods. In addition to discussing what it means to become a DIF-recommended method, the group has been selecting different methods and working on incrementally improving the methods to submit as candidates for recommendation. Anyone who has a particular DID method that they want to work on bringing to candidate-quality level should fill out the proposal and schedule with the WG chairs to go through the requirements. The did:webplus method was updated to reflect support for additional hash methods (SHA-256, CHAR256/CHAR512) and has completed the 60 day review period, and the chairs are completing the work to make it a formal recommendation and submit the PR. The second deep dive on DIDwebs, signifying the start of the 60-day review period, was last Wednesday. Since the first deep dive, the did:webs team had an update on the pull request to register the ConditionalProof2022 signature suite for JSON-LD verification purposes. More info can be found on Pull Request for v9.017 did:webs prevents BOLA attacks with pre-rotation keys, provides multisig issuance of the initial identifier, and multi-threshold proofs. The full presentation can be found here The formal proposal at W3C to propose a W3C WG complementary to DIF's is stalled because no W3C member organization has stepped up to champion and chair the working group.

👉 Learn more and get involved

Identifiers and Discovery Working Group The BCVH instance of the Traction Sandbox is now live. The sandbox can be used to test DID:WebVH implementation Initial workshop for using the Traction Sandbox Approval for adding an optional Heartbeat parameter which would deactivate DIDs which have no updates for the amount of time defined in the Heartbeat parameter. IDWG is seeking feedback on the witness proof system and DidWebVH, particularly regarding file storage and size optimization. More info here. The group discussed making domain names optional for DIDs.This would moves did:webvh to align with did:scid The group is moving forward with a number of PRs and updates

👉 Learn more and get involved

🪪 Claims & Credentials Working Group Exploratory work on DIF "active contributor" credentialing is underway, in discussions with the First Person Project and others. Reach out to chair Otto Mora on DIF Slack if interested. Further work on the Credential Schemas is on hold, but evaluators/users of the credentials collected to date or proposers of additional credentials are encouraged to open an issue or reach out on DIF Slack.

👉 Learn more and get involved

Applied Crypto Working Group

The ACWG continues discussion on BBS and ZKPs and collaboration with IETF's CFRG. They are proceeding to resolve the GitHub issues regarding BBS generator standardization and provide comments, especially addressing concerns from the Privacy Pass team and other cryptographers.

👉 Learn more and get involved

DIDComm User Working Group

Pull requests under discussion

The DIDcomm Users Group saw demos of two main protocol developments presented by Vinay: a chess game protocol with move verification through cryptographic hashing, and a mesh networking protocol for offline communication using Bluetooth and potentially LoRa technology. Vinay demonstrated a mobile app featuring various cryptographic and verification capabilities, including peer-to-peer calls, credential issuance, and document signing, with plans to present some features to the Open Wallet Foundation. He will be proceeding to develop an FFI (Foreign Function Interface) for Cradle/CredOTS to allow interoperability with the Rust mesh protocol implementation.

👉 Learn more and get involved

🌎 DIF Special Interest Group Updates

Browse our special interest groups here

DIF Hospitality & Travel SIG

The team advanced work on a standardized travel profile schema, focusing on multilingual support and international data handling requirements. A major highlight was the January 30th session featuring presentations from SITA and Indicio, who demonstrated successful implementation of verifiable credentials in travel, including a pilot program in Aruba.

Key developments included:

Progress on JSON schema development for standardized travel profiles Advancement of multilingual and localization capabilities Refinement of terminology and glossary for industry standardization Demo of successful verifiable credentials implementation in live travel environment

👉 Learn more and get involved

DIF China SIG

The China SIG is growing to a vibrant community, with over 140 people in the discussion group. In 2024 they organized 9 online meetings and invited different DID experts for discussions, including experts from GLEIF, DIF, and TrustOverIP.

👉 Learn more and get involved

APAC/ASEAN Discussion Group

The APAC / ASEAN group discussed membership and how to increase participation in the region.

👉 Learn more and get involved

DIF Africa SIG

This month the DID Unconference is being hosted in South Africa with DIF as a sponsor.

👉 Learn more and get involved

📖 DIF User Group Updates
DIDComm User Group

The DIDComm User Group established additional meeting times to accommodate global participation. They worked on expanding their reach and planned engagement with Trust Spanning Protocol representatives, while also focusing on improving documentation and accessibility.

👉 Learn more and get involved

If you are interested in participating in any of the Working Groups highlighted above, or any of DIF's other Working Groups, please click join DIF.

📢 Upcoming Events

Will you be attending any upcoming Identity events? Let us know so other DIF members can find you!

DID Unconference Africa 24-26 February, 2026 (South Africa)

DID:UNCONF AFRICA brings together local and international innovators, leaders, and activists to reshape the future of digital identity. This event fosters innovation, collaboration, and interoperability, making a significant impact on the inclusive development of digital identity in Africa. For the second year running, DIF will be sponsoring the event. Expect to see Steering Committee Member and CAWG Co-chair Eric Scouten in attendance. Eric and Africa SIG Chair Gideon Lobard will be giving us their Hot Takes in March. Watch the February newsletter and DIF calendar for exact time and date.

ITB Berlin, 3-5 March, 2026 (Berlin)

DIF Member Alex Bainbridge (Autoura) will be speaking about identity at the world's largest travel conference.

IETF 125 Shenzhen, 14-20 March, 2026 (Shenzhen)

Our new Executive Director, Grace Rachmany, will be attending IETF125 this year in APAC.

4th International Workshop on Trends in Digital Identity (TDI)

📅 April 20-21, 2026
📍 Verona, Italy
Learn more

Internet Identity Workshop IIWXLII #42

📅 April 28–30, 2026
📍 Mountain View, CA
Registration and details

Agentic Internet Workshop #2

📅 May 1, 2026
📍 Mountain View, CA
Learn more

Identiverse 2026

📅 June 15–18, 2026
📍 Las Vegas, NV
Conference details

Identity Week Europe 2026

📅 June 9–10, 2026
📍 Amsterdam
Event information

Call for Co-organizers: GDC 2026

The 2026 Global Digital Collaboration Conference has been announced for September 1-2, 2026, in Geneva. DIF is on the co-organizing committee

🗓️ ️DIF Members

👉Are you a DIF member with news to share? Email us at communication@identity.foundation with details.

🆔 Join DIF!

If you would like to get in touch with us or become a member of the DIF community, please visit our website or follow our channels:

Follow us on Twitter/X

Join us on GitHub

Subscribe on YouTube

🔍

Read the DIF blog

Passwords suck. They’re hard to remember, but worse is playing the ever-evolving game of cybersecurity whack-a-mole with your most important accounts. That’s where passkeys come into play. The so-called “war on passwords” has taken off over the past two years, with titans like Google, Microsoft, and Apple pushing for a password-less future that the FIDO Alliance (a consortium made to “help reduce the world’s over-reliance on passwords”) has been trying to realise for over a decade.

Like it or not, you’ll be prompted to create a passkey at some point, and you likely already have. That’s a good thing, as passkeys aren’t only much easier to use than a traditional password, they’re also a lot safer. Here’s everything you need to know about using them.

Unlock your key to a more secure checkout. Use your unique payment passkey to secure your purchases.

Member post from LedgerDomain, by Alex Colgan and Victor Dods

When LedgerDomain began building identity infrastructure for the U.S. pharmaceutical supply chain, we understood immediately that this was an atypical decentralized identity environment. Hundreds of thousands of independent, publicly-registered organizations exchange billions of sensitive, confidential and regulated messages each year, under direct and ongoing government oversight. Any one of those messages can later become evidence in a regulatory investigation, sometimes many years after the original transaction took place.

Our primary challenge was messaging: enabling trading partners to communicate confidentially and at scale, without leaking network metadata or trade terms, while preserving cryptographic proof that every interaction was legitimately authorized at the time it occurred. That proof needed to remain verifiable even as companies changed vendors, churned employees, rotated keys and pseudonyms, migrated infrastructure, or exited the ecosystem altogether. We decided early to take an approach that paired cryptographic verifiability with standard web technologies in order to achieve a balance of security, scale, and performance. Additionally, we needed to achieve a measure of security parity with DID methods on a stronger cryptographic basis than did:web also in use within the messaging community.

Starting from Messaging Requirements

This messaging system had to support high-volume, point-to-point communication without broadcasting metadata or relying on centralized intermediaries. Participants needed strong assurances about counterparties, and regulators needed the ability to reconstruct chains of custody long after transactions were completed. Identity therefore had to support historical verification. It wasn’t sufficient to resolve a DID to its current state; verifiers had to be able to determine which keys and policies were valid at a specific moment in time.

We adopted did:web early because it aligned with the operational realities of the ecosystem. It was web-native, easy to deploy, and compatible with existing infrastructure and organizational boundaries. It allowed historical resolution as an optional affordance, albeit somewhat trustfully. As the system matured toward production use, however, it became clear that regulated environments require stronger guarantees than static web resolution alone can provide, and better handling of portability and other corner-cases. Without a verifiable history, long-term auditability and non-repudiation were difficult to support.

Rather than change deployment models or governance assumptions, we focused on addressing this gap directly and extending the did:web model.

Designing did:webplus from Operational Reality

did:webplus emerged as an implementation of did:web that extended the original by adds a cryptographically verifiable history to each DID. Every DID maintains an append-only microledger of DID documents; parallel efforts also led to roughly analogous microledger-based methods like did:webvh and did:oyd. A core goal of our microledger design was very expressive and explicit rulesets for updates: each update is self-hashed, linked to its predecessor, and authorized according to explicit rules defined in the prior state. This enables any verifier – now or in the future – to reconstruct the exact state (and exact current update policy) of a given DID at a specific point in time with cryptographic certainty.

This design was driven by the same guarantees our messaging system already required: durability, non-repudiation, and auditability at scale. Using standard web hosting and “incremental retrieval” patterns allowed these guarantees to be achieved efficiently and predictably over HTTPS. The DID method and the messaging substrate evolved together, reinforcing one another rather than being designed in isolation.

From a security perspective, this approach delivers the same assurances commonly associated with distributed-ledger-anchored identity systems, without every query having to be routed directly to a live blockchain node or indirectly through a SaaS middleman. From an operational perspective, it remains deployable using familiar web infrastructure and governance models already accepted in regulated industries.

Grounded in a Real Community

did:webplus is now being prepared for production use within the Open Credentialing Initiative (OCI) ecosystem. Adopters already operate did:web-based systems and expect to be able to extend them with verifiable history without redesigning their workflows or architectures. That continuity is intentional. did:webplus was designed for incremental adoption, respecting the timelines and boundaries under which regulated organizations operate.

The broader governance context also shaped the design. Messaging standards in the pharmaceutical supply chain are stewarded by GS1, a long-time member of the DID working group at W3C. OCI-harmonized identity assurance processes align with NIST guidelines, making secure pseudonymity easier to operationalize. Participation is governed through a public-private partnership with the FDA. did:webplus encodes these realities on boring and compliant web rails rather than attempting to replace them.

A Pattern for Requirements-Driven DID Design

This experience reinforced a lesson that we believe is broadly relevant to the decentralized identity community. Durable identity infrastructure emerges most effectively when it is designed from concrete ecosystem requirements outward. In our case, the demands of regulated, confidential, high-volume messaging shaped the DID method itself. We see this as a useful pattern for other high-assurance environments such as regulated finance, healthcare, and cross-border trade.

Of course, the design was not done in isolation from the broader decentralized identity community. Across GitHub issues and mailing messages, our Chief Software Architect Victor Dods investigated how other implementers understood the under-documented `?versionTime=` reserve word in the W3C DID specification, and how they had implemented it in blockchain-based systems. Victor presented an early draft of the design in the DIF Identifiers & Discovery Working Group for review, and has been grateful to receive extensive ergonomics and interoperability testing feedback from fellow DIF member Spherity in the OCI context. 

LedgerDomain has also been a driving member of the DID Methods Working Group at DIF, which seeks to establish a common evaluation framework for maturity and market-readiness through structured peer-review and consolidation of various pre-existing self-documentation processes. In that context, LedgerDomain has sought to lobby for benchmarking production deployments and challenging other evaluators and evaluees to focus more on practical implementation and deployment experience, rather than simply the design process.

Join the conversation: In the spirit of open source, everything you need to evaluate, test, or analyze the did:webplus method is available on github. If you are interested in the design of DID methods, the Identifiers and Discovery Working Group is an open forum which Ledger Domain availed itself of early in the process If you are interested in productionization, benchmarking, and implementer experience, the DID Methods Working Group is steadily building up a registry of production-ready DID methods evaluated collectively and rigorously.

Healthcare AI is scaling faster than our ability to trust it. We need to avoid slop to continue the journey of Evidence-based medicine (EBM).  Across medicine and life sciences, we […]

AI agents are exploding in use across industries, but they’re roaming a digital world with no shared identity or trust framework. Today, an agent can claim “I can code” or “I can trade” (“trust me, bro, I’m an AI agent”), yet there’s no standard way to verify if any of it is true.

You wouldn’t trust strangers operating like that, and neither can AI agents truly trust each other under these conditions. This “trust gap” is a major roadblock to an open agent economy. Agents need a way to carry their identity, context, and track record with them — something akin to a passport — so they can be discovered and trusted by others at machine speed.

Giving AI agents a Digital Passport with ERC‑8004 and Decentralized Knowledge Graph

Combining the ERC‑8004 standard with the OriginTrail Decentralized Knowledge Graph (DKG) creates a powerful synergy akin to giving AI agents a digital passport from day one. ERC‑8004 establishes an agent’s on-chain identity and structure — essentially issuing a standardized passport number and “photo page” for the AI — while the OriginTrail DKG fills that passport with dynamic, verifiable context, i.e., the stamps, visas, certificates, and travel history that accumulate as the agent interacts and learns. Together, these technologies ensure each AI agent has both a trusted identity and a rich, evolving track record of its accomplishments, all secured by blockchain and cryptographic proofs.

The ERC‑8004 Ethereum standard gives every AI agent a unique on-chain identity. Each agent is issued an ERC-721 NFT as its “passport document,” providing a portable, censorship-resistant identifier on Ethereum. This identity token (the agent’s “passport number”) links to a registration file describing the agent’s core info — for example, its capabilities, endpoints (how to communicate with it), and even aspects of its “social graph” or affiliations. In other words, ERC‑8004 standardizes how an AI agent presents itself, ensuring that anyone, anywhere, can verify who the agent is and what skills it claims to have. Just as a real passport is issued by a trusted authority, the ERC‑8004 identity is anchored on Ethereum, making it globally verifiable and hard to forge. This on-chain identity layer also includes built-in trust anchors: ERC‑8004 defines reputation and validation registries that record an agent’s on-chain feedback and certifications, functioning like official seals or endorsements on a passport.

Thanks to ERC-8004, AI agents now have a basic passport — a way to present who they are and what they’ve done in a standard, verifiable format. An agent that wants to be hired for a job can show their ERC-8004 credentials: “Here’s my ID and resume, here are my reviews, and here are proofs of my capabilities.” In fact, the standard explicitly frames the identity NFT as the agent’s passport.

However, like a freshly issued real-world passport, this is just the beginning. The passport, by itself (an NFT plus a static JSON file), is necessary but not sufficient for rich trust. It tells you the basics, but imagine if we could stuff that passport with far more context — every stamp, visa, reference letter, and credential an agent earns over time, in a way that’s trusted and queryable. This is where OriginTrail Decentralized Knowledge Graph comes in, turning the passport into something much more powerful.

Decentralized Knowledge Graph: Turning the passport into a living context graph

OriginTrail Decentralized Knowledge Graph (DKG) steps in to supercharge ERC-8004’s static records, effectively transforming an agent’s passport into a living, verifiable context graph. Think of ERC-8004 as issuing the agent a blank passport and a basic ID card; the DKG is what brings that passport to life with data, continuously updated with verified stamps and stories of the agent’s journey. In OriginTrail’s own words, the DKG serves as a “constantly evolving digital passport for agents,” essentially an agent-specific context graph that grows over time with each interaction

How does it work?

The DKG is a decentralized network designed to store and publish structured knowledge (using semantic web standards) with verifiable provenance. In the DKG, information is not just dumped in JSON files or logs — it’s represented as a knowledge graph: a web of facts and relationships that machines can easily query and trust. Each data point in the graph is accompanied by cryptographic proof (such as a fingerprint anchored on-chain) that guarantees its integrity. And just like ERC-8004’s identity, each “thing” in the DKG is ownable via an NFT. In fact, the core unit of the DKG is called a Knowledge Asset, which is essentially an NFT + knowledge graph bundled together. You can represent anything as a Knowledge Asset — an AI agent, a dataset, a certificate — and give it a verifiable, evolving record on the graph.

So, let’s map an AI agent to a DKG Knowledge Asset. The agent’s ERC-8004 NFT can double as a DKG asset identifier (the DKG uses a concept called a Uniform Asset Locator, which extends DIDs, often implemented by an NFT token). That covers the identity/ownership part. Now attach the agent’s knowledge: Instead of a single JSON file with a few fields, we can have an entire graph of data describing the agent.

This graph might include: Agent profile & attributes: The same basics from the JSON (name, description, endpoints) but in a semantic format (RDF triples) so they’re machine-readable and linkable. For example, an agent could be linked to a category (“TradingBot”) or a skill ontology, enabling more precise discovery. Decision traces & activity logs: Every significant action the agent takes could be logged as an assertion in its knowledge graph. Did the agent complete a task? You can add a node for that event, linked to the date it occurred and its outcome. Over time, this creates a timeline of verifiable events — a history far richer than a single aggregate reputation score. These are the “stamps” in the passport, each one independently verifiable via its on-chain fingerprint. If someone questions why an agent made a decision, they could inspect its DKG log (with appropriate permissions) to trace the reasoning or data that led to it. Essentially, the agent builds up a memory in the graph that can be audited. In her thesis, Jaya Gupta of Foundation Capital explicitly includes AI agents’ decision-making processes and the importance of capturing decision traces to understand why decisions were made, which then become part of evolving context graphs. For context, graphs must become the real source of truth; DKG plays an essential role. Verifiable credentials & references: DKG can integrate W3C Verifiable Credentials (VCs) and decentralized identifiers. Suppose a trusted organization certifies an agent (e.g., “This trading bot passed a rigorous test” or “This agent is compliant with X regulation”); that credential can be added to the agent’s knowledge graph as a signed assertion. OriginTrail DKG is built to support standards such as VCs and DIDs, ensuring these credentials are stored in an interoperable format. It’s like adding visas or reference letters to the passport — e.g., “Certified by Authority Y” — which anyone can cryptographically verify. Semantic relationships: Knowledge graphs excel at capturing relationships between entities. An agent’s context isn’t just about the agent in isolation; it’s also about how it connects to others. With DKG, we can link the agent to other agents it has worked with, to datasets it frequently uses, or to domains of expertise. For example, if Agent A has collaborated with Agent B on a project, their knowledge graphs can reference each other (Agent A’s passport might say “worked with Agent B on Supply Chain Optimization, see project P”). These semantic links enrich discoverability — one could query the graph for “agents who have worked on supply chain tasks with verified outcomes” and find Agent A because of those relationships. OriginTrail’s design enables Knowledge Assets to connect with other assets, creating a world model of relationships. Provenance and data anchoring: Perhaps most importantly, every fact or credential added to the agent’s context graph comes with provable provenance. The DKG uses cryptographic proofs (Merkle roots of the graph data) anchored on-chain to ensure that the knowledge hasn’t been tampered with. If the agent’s passport states “Completed 50 successful deliveries,” the raw data backing that (the 50 delivery events) each have a hash on the chain that can be verified. This is analogous to a passport office stamping and sealing each visa — it can’t be faked without detection. The OriginTrail network’s nodes replicate and store these assertions, especially the public ones, so the data is always available and secure in a decentralized way. No single party can forge or hide the agent’s records. The result is a trustworthy, tamper-evident ledger of an agent’s life that complements the on-chain registries. OriginTrail DKG represents an agent’s profile as a Knowledge Asset, combining on-chain identity with off-chain knowledge. The diagram illustrates how an AI agent’s “passport” gains a chip: it contains semantic graph data (RDF) and vector embeddings for AI context, anchored by cryptographic on-chain proofs, all tied to a unique NFT identifier. This makes the agent’s profile a dynamic, queryable knowledge graph rather than a static file. Conclusion

In summary, integrating OriginTrail DKG with ERC-8004 gives each agent a “smart passport”: not just an ID document, but an entire personal knowledge graph that is securely stored, constantly updated, and universally queryable. The passport isn’t just carried by the agent — it lives on the decentralized network, where anyone (or any other agent) can validate its stamps and even learn from its contents (with permission). This dramatically amplifies trust: an agent’s identity isn’t a static entry in a registry; it’s the center of a web of trust data that grows richer over time.

The journey is just starting. ERC-8004 has effectively set the rules for issuing and stamping agent passports. OriginTrail DKG offers a global registry and database where those passports are maintained and enriched over time. As this integration matures, we could see the emergence of a true Web3 agent commons—a space where AI agents from any project or company can work together trustlessly, discover one another through shared context, and carry their reputation across any single platform.

In the long run, this passport and knowledge graph approach may become an essential component of AI infrastructure, much like human identity standards. It lays the foundation for an interoperable, trustworthy agent economy.

Passport, please! AI agents are becoming first-class citizens with ERC-8004 & OriginTrail was originally published in OriginTrail on Medium, where people are continuing the conversation by highlighting and responding to this story.

Operational Technology (OT) environments — from industrial control systems to critical infrastructure networks — have traditionally prioritized safety and availability. The newly published Secure Connectivity Principles for Operational Technology (OT) guidance produced by the UK National Cyber Security Centre (NCSC) in partnership with agencies from Australia, Canada, US, Germany, Netherlands, and New Zealand underscores how evolving connectivity demands require a modern security posture that does not compromise operational integrity while facing an expanding threat landscape. 

At the FIDO Alliance, our mission has always been to champion open, scalable, and trusted identity and authentication standards that are simple to use. Today those same principles, originally forged to eliminate the weak link of shared secrets on the web, are directly applicable to securing OT connectivity and distributed device environments.

Below I’ll outline how FIDO phishing-resistant authentication (passkeys), FIDO Device Onboard (FDO) and emerging work in Bare Metal Onboarding (BMO) support these secure connectivity principles, enabling organizations to achieve strong authentication, trusted connectivity, secure supply chains and secure update of software at scale.

Phishing-Resistant Authentication Is Now Table Stakes for OT

The OT guidance emphasizes strong authentication at network boundaries, remote access points, and management planes. This is exactly the problem FIDO set out to solve with passkeys. Passkeys replace passwords and shared secrets with device-bound cryptographic credentials that are phishing-resistant, replay-resistant, and built on open standards.

For OT operators, engineers, and vendors accessing jump hosts, DMZ gateways, or privileged access workstations, this removes the most common root cause of breaches: stolen credentials. That simple shift from shared secrets to cryptography dramatically reduces risk at OT boundaries.

Practically speaking, this enables organizations to:

Enforce phishing-resistant MFA for all remote/vendor access Secure privileged admin workflows Reduce helpdesk overhead from tokens/password resets Strengthen auditability and attribution of actions

This aligns directly with the guidance’s goals of minimizing exposure and hardening connectivity with modern, standardized controls.

Securing Vendor and Remote Access Without Increasing Complexity

OT environments frequently require third-party maintenance and specialized engineering support. Historically, that has meant VPN accounts, shared credentials, or brittle remote access solutions. The guidance recommends organizations move to centralized, controlled connectivity and brokered access patterns. FIDO authentication fits naturally into the recommended control framework:

FIDO authentication-secured jump hosts, remote workstations, and more Privileged access gateways Just-in-time access provisioning Device-verified operator identity

This approach delivers both least privilege and strong non-repudiation — two capabilities that are increasingly important for regulated industries. Most importantly, it does so without adding friction for operators, which is critical in environments where uptime and usability are non-negotiable.

Establishing Trust in Devices with FIDO Device Onboard (FDO)

Users aren’t the only identities that matter in OT. Devices — gateways, sensors, controllers, and edge systems — must also prove they are trusted before joining operational networks. This is where FIDO Device Onboard (FDO) comes in. FDO provides:

Zero-touch onboarding Cryptographic device attestation Secure ownership transfer Encrypted provisioning channels “Late binding” to the correct management platform at deployment time

Rather than shipping devices with default passwords or manual configuration steps, FDO allows them to securely authenticate and receive credentials automatically. For OT environments, this:

Eliminates weak factory credentials Reduces field provisioning errors Supports standardized onboarding across diverse hardware Strengthens supply-chain assurance

In other words, devices join the network only after cryptographically proving who they are. This satisfies a foundational requirement for segmentation and isolation strategies described in the guidance, delivering value today for industrial IoT, gateways, and modern edge infrastructure.

But secure onboarding is only the first step.

Bare Metal Onboarding and Lifecycle Resilience

One of the most important, and often overlooked, requirements in the OT guidance is the need to keep systems securely updated and maintain a known-good state over time. This has historically been difficult in OT. Devices may be deployed in remote locations, managed by non-IT personnel, or running outdated software because rebuilding them is complex and risky.

This is exactly the challenge that FIDO Bare Metal Onboarding (BMO) addresses. Building on FDO’s trusted foundation, BMO extends late binding beyond ownership to the entire software stack:

Operating system Applications Configuration Credentials

With BMO, a device can be powered on with no preinstalled OS and securely receive:

Authorized OS images Approved software packages Policy-defined configurations Verified updates

All cryptographically validated and delivered through the same attested, encrypted control plane established by FDO. 

In doing so, BMO unlocks several capabilities that are particularly powerful for OT operators:

Zero-touch secure deployment: Devices can be installed by non-technical personnel and automatically provision themselves safely. Secure rebuilds and recovery: If compromise or corruption is suspected, systems can be wiped and reinstalled to a known-good state. Reliable patching and upgrades: Organizations can keep software current (a key expectation in the UK guidance) without manual intervention. Standardization across vendors: A consistent, open, interoperable approach replaces fragmented proprietary tooling.

In short, BMO transforms onboarding into lifecycle assurance. Where FDO answers “Can I trust this device?”, BMO answers “Can I trust exactly what is running on it, not just today but after every update?”

That’s a critical step forward for OT resilience.

[For more information on BMO, check out this webinar]

A Clear Roadmap to go from Principles to Practice

Organizations aligning with the OT secure connectivity principles can take concrete action today, while preparing for what’s next:

Now Require phishing-resistant FIDO passkeys for all OT remote and privileged access Standardize FIDO authentication at gateways and management interfaces Adopt FDO for zero-touch, secure onboarding of new edge and industrial devices 2026 and beyond Incorporate FIDO Bare Metal Onboarding into procurement requirements Enable secure OS/app provisioning and automated rebuilds Maintain known-good state and rapid recovery across distributed OT estates Identity as the Foundation of OT Security

The OT threat landscape has changed permanently. Connectivity is no longer optional, and security can’t rely on isolation alone. The future is identity-first: verifiable users, verifiable devices, and verifiable software state. FIDO standards provide open, scalable building blocks for all three, turning the guidance principles into something actionable:

Passkeys secure the people. FDO secures the devices. BMO secures the software lifecycle.

FIDO technologies already deliver meaningful protection today. And with Bare Metal Onboarding, they will enable an even more resilient, zero-touch, secure-by-design OT ecosystem in the years ahead.

UPDATE, March 5, 2026: SB 275 has passed the Utah legislature unanimously — the Senate voted 25-0 and the House 70-0 — and has been sent to the governor for signature. It takes effect May 6, 2026. This is a huge win. If you’re in Utah, thank your representatives. If you’re in another state, point your legislators at SB 275 and Wyoming SF39 as model legislation. The fight now shifts to preservation — watch for future amendments that weaken the Duty of Loyalty or selective disclosure protections.

Most of my identity advocacy work in the United States has been in Wyoming. They’ve been very open to the goals of self-sovereignty and as a result we’ve passed laws such as private key protection and we’ve defined digital identity as being controlled by an individual’s principal authority.

So it’s great to see another jurisdiction, which I have been less directly involved with, progressing on their own vision of self-sovereignty. That’s the whole purpose of advocacy: to seed the ideas so that they spread.

I’m talking about Utah, whose State-Endorsed Digital Identity (SEDI) has been moving in a great direction for a while. The newest bill introduced for it, S.B. 275, the “State-Endorsed Digital Identity Program Amendments”, which does all the heavy lifting of establishing SEDI, solidifies it as a privacy-first, decentralized design.

A Bill of Identity Rights

The first thing that caught my eye in the SEDI update was a new Bill of Rights. It immediately presents the digital-identity user not just as a digital serf, but someone who can claim privileges.

The lead right was surprising:

(1) “An individual possesses an individual identity innate to the individual’s existence and independent of the state, which identity is fundamental and inalienable.”

That’s pretty close to my first principle of self-sovereign identity, existence:

Existence. Users must have an independent existence. Any self-sovereign identity is ultimately based on the ineffable “I” that’s at the heart of identity. It can never exist wholly in digital form. This must be the kernel of self that is upheld and supported. A self-sovereign identity simply makes public and accessible some limited aspects of the “I” that already exists.

It was great to see an understanding that any digital identity is founded in a real person. That lays the foundation for its importance in the digital world.

There was tons more in the bill of rights that was amazing.

This is pretty close to self-sovereignty:

(2) An individual has a right to the management and control of the individual’s digital identity to protect individual privacy.

This requires transparent architecture:

(7) An individual has a right to transparency in the design and operation of a state digital identity, including the right to access, read, and review the standards and technical specifications upon which the state digital identity is built and operates.

This is a little wobbly (because of the “except as authorized by law”), but is a strike against the surveillance state:

(10) An individual has a right to be free from surveillance, profiling, tracking, or persistent monitoring of the individual’s assertions of digital identity by the state, except as authorized by law.

But this may be my favorite:

(8) An individual has the right to choose what identity attributes are disclosed by the individual’s state digital identity in accordance with standards established by the Legislature.

This is potentially full empowerment of selective disclosure, depending on what the standards are. I wrote recently that one of the big failures of the SSI community is the fact that they stepped away from a holder being able to determine what they can redact in their identity. That a state legislature may beat them to the punch is shocking.

I think a digital-identity bill of rights is a great thing. It’s what I was thinking about when I put together the original principle of self-sovereign identity. I’m now revisiting those principles for the SSI 10th anniversary, and this looks like another great source to consider.

The Duty of Loyalty

There’s a ton to like in the bill, including anti-correlation, selective disclosure, minimal disclosure, and a variety of requirements for digital-wallet providers, verifiers, and relying parties that all tend to protect the holder of the identity. It’s clear that someone was involved who really knew what they were doing and also undestood the importance of a user controlling their own identity.

But the other one that I thought was of particular note was the “Duty of Loyalty”

63A-20-701. Duty of loyalty. The department, a digital wallet provider, a verifier, a relying party, and a digital guardian shall refrain from practices or activities related to the processing of an individual’s identity attributes that:

(1)conflict with the best interests of an individual;

(2)take advantage of or otherwise exploit an individual;

(3)result in a disproportionate risk to an individual;

(4)are to an individual’s detriment; or

(5)cause harm to an individual.

This is a critical right, tying into the Principal Authority work that I did with the Wyoming Blockchain Select Committee. It similarly evokes agency law to say that when other entities are using your digital identity, they can only do so to support your best interests. Compare that to the modern-day ecosystem of surveillance capitalism and extraction and the difference is obvious. Many modern-day digital services are built on allowing you to create an identity (on Facebook, on Google, whatever) and then mercilessly extracting from that, stealing your attention, your creativity, and everything else.

There are obviously questions with how this will be managed. For one, I can’t see how “related to the processing of an individual’s identity attributes” will be interpreted. Obviously, it’ll protect you from hi-jinks on the part of your verifier (which is a huge win) but it’s unclear whether it’ll provide any protection for someone who is enabling you to interact online with your identity (e.g., Facebook).

The other question is whether entities can coerce users to give up this right, which is a common modern-day tactic (c.f. “clickwrap”). From the research I’ve done so far (IANAL), it looks like these aren’t rights that could be signed away in a contract—they represent minimum statutory requirements, and that as long as carve-outs aren’t created in the law, this Duty of Loyalty will be protected.

That’s what we need to fight against here. We need to “beware platforms bearing gifts”: we have to watch for Googles and Facebooks using regulatory capture to ask for carve-outs in this law that will steal away the rights from us and give it to them by making them optional. And that’s unfortunately a pretty big task in the modern world.

Make a Difference

I haven’t analyzed every line in S.B. 275. I wouldn’t be surprised if I find some things I don’t agree with as I explore it further. But in the big picture, this is a big win for self sovereignty and for user agency and autonomy in digital identity. Adding it on to Wyoming’s work creates another model for how digital identity that maintains human dignity could spread across the United States.

If you want to help in this effort:

If you’re in Utah, call up your state representatives and tell them that you support the bill. Maybe even express concerns about regulatory capture. If you’re in another state, call up your state representative and tell them of your interest in self-sovereign identity, offering Utah SB275, Wyoming SF39, and maybe Wyoming HB86 as model legislation. If you want to support our advocacy, become a GitHub sponsor or talk to me directly about supporting advocacy at a larger scale.

The work going on in Utah is great. But it’s just a start in supporting our digital rights!

The Universal Product Code (UPC) has powered retail for 50 years, but it was never designed to handle the data demands of today's complex supply chains and consumer expectations. In this episode, Reid Jackson and Liz Sertl sit down with Ned Mears, Senior Director of Global Standards at GS1 US, to explore how 2D barcodes will revolutionize the retail landscape, starting with Sunrise 2027. Ned explains how 2D barcodes go beyond simple price lookups, enabling enhanced traceability, connected packaging, and compliance with future regulations. He also offers practical advice on barcode placement, point-of-sale readiness, and why delaying action increases risk.

In this episode, you'll learn:

How 2D barcodes change what's possible at checkout and across the supply chain

What brands and retailers need to do now to prepare for Sunrise 2027

How early planning reduces risk, cost, and operational disruption

Things to listen for: (00:00) Introducing Next Level Supply Chain (04:01) How 2D barcodes differ from traditional UPCs (07:41) Measuring industry progress toward Sunrise 2027 (12:46) How brands can prepare to implement 2D barcodes (19:22) What retailers need to assess to be ready for 2D at the point of sale (21:26) The risks of waiting until 2027 before preparing for 2D barcodes (27:00) Ned's favorite tech

Connect with GS1 US: Our website - www.gs1us.orgGS1 US on LinkedIn Register now for this year's GS1 Connect and get an early bird discount of 10% when you register by March 31 at connect.gs1us.org.

Connect with the guest: Ned Mears on LinkedIn

It’s been more than ten years since I founded the Rebooting the Web of Trust workshop with the goal of reimagining the peer-to-peer web of trust first popularized by Pretty Good Privacy (PGP). The idea of decentralized identity was at the heart of the workshop from the start, but work on it accelerated following the first workshop when I wrote “The Path to Self-Sovereign Identity” to provide a foundation for the continuing discussion of the topic. It was then at the second workshop that we really rolled up our sleeves and began developing what would eventually become W3C’s DID standard.

So I’ve been there from the start. I have a solid basis in our original intent for self-sovereign identity (SSI), and I know where we went from there. I’m the co-editor of the W3C Amira Engagement Model, which demonstrated many of our desires with decentralized identity, and also a co-author of the W3C DID standard and of BTCR, the first DID method.

Unfortunately, in the ten years since I wrote “The Path to Self-Sovereign Identity,” I feel that SSI, as implemented, has become indistinguishable from the very systems we set out to disrupt. Worse, it has legitimized architectural choices that align more closely with centralized identity systems, such as the mDL/mDoc-style solutions now appearing in emerging EU digital wallet deployments.

I first wrote about these concerns in “Has Our SSI Ecosystem Become Morally Bankrupt?”. In short, SSI was meant to be private, decentralized identity. You were meant to be able to decide what you revealed about your identity, and you were meant to not be beholden to any outside control or gatekeepers.

But compromise after compromise ate away at those ideals. Early discussions of DID- and VC-based identity treated issuer, holder, and verifier as equal roles that any participant might play. When the W3C Verifiable Credentials standard was ratified, that symmetry was narrowed to a “three-party ecosystem,” and when the DID standard followed, even that framing disappeared. That’s what made DID issuers rarefied powers within the DID ecosystem rather than your peers; it’s why DID wallets are largely incapable of acting as issuers themselves.

To be honest, I saw the potential for these problems while the DID specification was under review for Recommendation, but as an Invited Expert at the W3C, I approved the draft without raising a formal objection. That’s because I didn’t have an alternative at the time. Since I didn’t have that alternative, I didn’t feel it was right to say that DIDs as proposed were wrong. There was certainly the hope that they would develop in the right way, that even with the compromises in the standard, the deployers of mass-market DIDs would stick with our goals of decentralization and privacy.

But, they didn’t.

As a result, we have self-sovereign identity in name only. Though a true decentralized identity could be built within the DID spec, that’s not how the ecosystem has evolved. Instead, more often than not, a small, de-facto-centralized set of issuers structurally controls what you can do with your DID. They limit what you can redact and require phone-home behavior that not only keeps you tied to them, but also negates your privacy.

It’s now been almost four years since the ratification of DID v1.0. While the working group has been drafting DID v1.1, I’ve been focused more on doing my own work to create a technology stack that better exemplifies what we first started back in May 2016, in the shadow of the United Nations and the inaugural ID2020 summit: a truly decentralized and self-sovereign identity.

I call it the XID or eXtensible IDentifier. XIDs deliberately trade ecosystem convenience and institutional alignment for architectural clarity, holder control, and long-term privacy. They’re not intended to replace every use of DIDs or VCs, but to demonstrate a holder-centric identifier model that can coexist with, wrap, or inform future decentralized identity systems. They’re an exemplar of what is possible.

A lot of my work on XIDs goes back to the Amira Engagement Model. At Rebooting the Web of Trust 5, in Boston, we imagined a programmer with a politically sensitive background who wanted to contribute her skills to social causes, but was afraid of repercussions for herself and her family. We then laid out a self-sovereign pseudonymous identity system that would allow her to do so by protecting her real identity while allowing her pseudonymous identity to gain reputation over time, all under her tight control. Amira was my North Star when I began work on XIDs: I wanted to create a new decentralized identifier that supported her use case in a way that the evolving DID ecosystem did not.

Here’s the quick overview of the architecture:

XIDs can be created by anyone. They function as holder-controlled identifiers that can carry signed assertions and credentials without requiring issuer-controlled disclosure or online resolution. They are autonomous cryptographic objects that are self-contained and do not inherently phone home; network interaction occurs only if a viewer explicitly chooses to dereference a URL or other correlatable pointer, rather than using one of the more secure alternative resolution methods available. Most importantly, the holder of a XID can themselves choose to redact any of the information it contains, without invalidating any signatures that have been made to authenticate the XID or any credentials it might include.

Blockchain Commons has developed a body of work around XIDs, including specifications, working code, and supporting materials. We’ve also used XIDs within Blockchain Commons for experimental identity workflows and as a testbed for privacy-preserving identity research.

If that all sounds intriguing, please jump to our developer page, which links all of our specfications, code, CLI apps, and other material. If you want to evaluate XIDs more concretely, instead start with the Quickstart tutorial and concepts to see how these ideas work in practice. It’s the fastest way to begin working with XIDs (though note that only the first two tutorials have been fully released at this point).

But if you want more details about why XIDs might be of interest to you, I’ve written a number of discussions that I think address why a variety of people might be interested in XIDs or why they might be reluctant to use them. See if one of them addresses your situation. (And if none of them do, let me know your concern or issue, and I’ll be happy to add another discussion.)

Concerns that DIDs address:

“I have self-sovereignty concerns” “I have privacy concerns”

issues you might want addressed before you adopt DIDs:

“I already use DIDs” “I need a new technology to be novel” “I don’t need another standard”

After you’ve read any sections that interest you, you should jump to the conclusion.

“I have self-sovereignty concerns”; or
“I already use DIDs”

I’ve already written about the general issue with DIDs: that the standard allows developers to sidestep decentralization. Most specifically, the biggest problem I have with DIDs is that holder control never happened. That’s the prime thing that XIDs are meant to rectify.

Now “holder control” is a pretty bloodless term. But, it’s the heart of self-sovereignty, so when I say that DIDs don’t have holder control, I mean that they don’t have self-sovereignty either: you don’t control your identity (which was the whole point of SSI!).

A lack of personal control pervades the SSI ecosystem, starting with the fact that you typically can’t issue DIDs or VCs yourself. However, limitations on disclosure may be the most problematic. When an issuer produces a DID full of VC credentials and assertions, the issuers ultimately decide how disclosure of that information is managed. They might say that their VCs are all-or-nothing: that you have to disclose them in its entirety. Or they might allow you to redact parts of the information, but only specific elements that they allow. So, if you have an identifier that contains your name, age, and address, they might allow you to redact your age or your address when you publish the identifier, but say that your name always has to be there! If the word “allow” in there pisses you off, it should. They decide, not you.

XIDs flip all of this. They allow a decentralized identifier to be created and filled with signed assertions and other credentials. The holder then decides what’s shown and what’s not, to the specific granularity they want. This allows one person to have multiple identity contexts and an infinity of faces. These facades show different parts of a XID to different people, but it’s still all one XID: one identifier that the holder truly controls.

So why would you, as a DID adopter or someone concerned about self-sovereignty, choose XIDs? Because they hand control back to the holder of the identifier, as was always intended for self-sovereign identity.

“I have privacy concerns”

Great! XIDs are definitely the thing for you then!

The problem with DIDs as they’ve evolved is that they don’t prevent correlation. In fact, they often make it worse.

This is because your DID can be packed with correlatable information, possibly even including credentials and other assertions. It’s a big honeypot of data that’s been helpfully collected together, and that makes it easy to link it up to other things you’ve done online or even in the physical world, creating an even bigger honeypot of data to define you.

The solution to this problem is redaction: removing some of the information from the DID so that only the minimum necessary is shown (minimal disclosure). But DIDs usually limit the ability to determine what can be redacted to the issuer—and ultimately they’re only going to allow redaction if it runs parallel to their business interests. So, batches of information that are too big are often sent out with DIDs, and that makes it easier to collect them all together, and that makes it easier to create even bigger honeypots by correlation with other information. That’s the opposite of a privacy concern.

XIDs are designed under the fundamental assumption that issuers, verifiers, networks, and infrastructure providers may all act adversarially with respect to correlation and control. As a result, they support radical elision. The holder has the ability at any time to redact information down to the atomic level: any singular datum, or even any atomic part of that datum (e.g., a subject, a predicate or an object) can be redacted. Because privacy is a central concern for me, I’ve also introduced additional technologies to make this radical elision more powerful: salted hashes can disguise redacted elements that might be easy to guess, while Garner and Hubert are new transport technologies that make it even harder to correlate by providing support for hidden and offline use of XIDs. Though the current implementation doesn’t support BBS and other anti-signature correlation zk-proofs, the architecture is designed with them in mind. We already support quantum-resistant signatures and encryption.

I should note that privacy is always a bit of hard sell. You’re presumably reading this section because privacy is important to you, but if you’re on the fence, I suggest a new lens for looking at privacy: coercion-resistance. One of the big problems with loss of privacy is that it can lead to you being coerced. You might be forced to withdraw your political opinion online due to death threats if your online identifier was correlated with your real-life identity; or you might be forced to hand over your Bitcoins if your Bitcoin addresses became correlated with your home address or the home addresses of your loved ones. Protecting privacy protects you against coercion, and that’s a whole additional level of self-sovereignty: it’s literally sovereigny over yourself.

So why would you, as someone concerned about privacy, choose XIDs? Because they fight against the correlation that is the biggest threat to the privacy of not just your information but your actual self.

“I need a new technology to be novel.”

It is entirely fair to say that a new technology needs to bring something new to the table, especially if it runs straight against an existing technology (or in this case an existing standard!).

XIDs are.

Their novel elements include:

XIDs support deterministic encoding. Because XIDs build on my dCBOR and Envelope technologies, the data in XIDs is encoded deterministically: given the same input, it will be serialized in the same way across platforms and implementations. This enables reliable comparison, hashing, and signing and ensures the stability and reproducibility of the encoded form of the data across various platform ecosystems and implementations of code. This approach was explicitly abandoned in the IETF’s JWT ecosystem and was only partially reintroduced in JSON-LD through complex, and often layer-violating, mechanisms.

XIDs support radical elision. This deterministic encoding enables any element of data in an XID to be redacted or encrypted (what we call elided), down to the atomic level of individual entities within its system of semantic triples. This makes minimal disclosure practical by allowing you to provide differently redacted or encrypted versions of the same XID to different parties, preserving privacy by design. By contrast, redaction support in other technologies has been limited or optional to date (the IETF, for example, treats it as optional in SD-JWT), and this level of fine-grained elision represents a substantial step beyond that.

XIDs support progressive trust. Progressive trust is the ability to slowly expand what you reveal about yourself to other people over time. It’s how identity works in real life, but it hasn’t been the way digital identity systems work, because they’re often built on all-or-nothing data disclosures: a binary “trust or not trust” model. Progressive trust was built into XIDs from the start: it’s the only technology where gradients of trust are fundamental to the architecture.

XIDs are supported by radically private communication methods. Blockchain Commons has so far released two radically private communication methods that are closely linked to XIDs. Hubert supports communication through decentralized storage services such as BitTorrent and IPFS. Garner links XIDs to Tor communication. These are both radical new ways to communicate privately, without the need for centralization. We’ve built proof-of-concepts for each to show how they can be easily applied.

So why would you, who wants to see innovation, adopt XIDs? Because they’re indeed innovative. Deterministic encoding, radical elision, progressive trust, and the support of radically private communication are some of the most progressive ideas contained within.

“I don’t need another standard”

I hear you! You’re already committed to a standard, or you say the standards process is too slow so you don’t want to fight through the introduction of something new.

XIDs do not have to be a new standard because they’re a functional proof of concept. Certainly, I invite you to adopt XIDs if they fit your needs. They’re robust, they’re well supported, and we’ll continue to support them in the future. But that’s not the only way to see the advancement of the technological goals such as minimal disclosure and coercion resistance that are exemplified in XIDs.

Even if XIDs themselves are never widely adopted, they would be a success if their holder-centric capabilities become unavoidable requirements in future identity standards. In other words, XIDs demonstrate what future iterations of DID or mDoc could evolve to become, but only if we are willing escape the shackles of legacy and older architectures. If we are willing to do something major, then standards bodies can look toward XIDs for what is possible.

Ultimately, if the only way to ensure self-sovereignty and to protect privacy is to push for wider adoption of XIDs, I’ll do that, but I’d be even happier to see major standards pick up the core features of XIDs, which are also the ideals of our original self-sovereign identity movement that have been left by the wayside.

So why would you, who doesn’t need another standard, adopt XIDs? Because they can be a stepping stone. They’re a proof of concept meant to push their ideals into wider discussion and ultimately wider adoption. For now, adoption of XIDs as an alternative moves us along that path.

Conclusion

I am pushing XIDs because there are historic stakes. Maintaining the self-sovereignty of identity is important because centralized identity repositories can be horribly misused. DIDs were supposed to accomplish that, but they’ve compromised by failing to unequivocally hold the line on the core values of decentralization.

As a result, we need to point out their flaws, offer alternative technologies that can do what they fail to, and use that as the foundation of a new revolution in self-sovereign identity. XIDs (along with several related Blockchain Commons technologies) are my Declaration of Independence from the current DID standard. I invite you to join that declaration so that we can together argue for the true self-sovereignty and true privacy that are missing from today’s DIDs.

Here’s what you can do to support the revolution:

Join the Gordian Developer Community to talk about these technologies. Join the SSI 10th Anniversary Community to talk about the future of self-sovereign identity. Read more about XIDs on our developer pages. Try out the XID Tutorial on GitHub and submit issues for any questions you have.

Maintainers and active contributors: We invite you to propose a mentorship project!

The mentorship program is a structured opportunity to get additional help and resources for your project, guide and groom new talent into active contributors and future maintainers and to grow and hone your own teaching and leadership capabilities.

February 10, 2026 — The Decentralized Identity Foundation (DIF) is pleased to announce that Kyndryl, the world’s largest IT infrastructure services provider, has joined DIF as an Associate Member.  Active participation in the DIF working groups underscores Kyndryl’s commitment to shaping the future of secure, interoperable, and decentralized digital ecosystems.

As enterprises embrace Agentic AI, identity and verifiable trust have become critical enablers for autonomous agents to operate securely and collaboratively. By joining DIF, Kyndryl will help accelerate the development of standards and infrastructure that make this vision possible.

“As our Trusted AI Agents and Creator Assertions Working Groups gain momentum, leaders such as Kyndryl are essential to the development of standards that serve the industry. DIF is designed to bring together organizations who have shared interests but different perspectives. Kyndryl brings expertise in enterprise infrastructure and commitment to decentralized identity means that the standards coming out of DIF are deployable in large-scale implementations,” said Grace Rachmany, Executive Director of DIF. 

Why This Matters: Advancing Trust in Agentic AI: Kyndryl’s Agentic AI Framework envisions a future where autonomous AI agents interact seamlessly across open, cross-domain ecosystems. Through DIF’s Trusted AI Agent Working Group, Kyndryl will contribute to defining standards that enable agents to establish strong trust. The Working Group addresses authentication, authorization, and delegation, allowing industry players to collaborate safely and reliably. Leadership in Decentralized AI Governance: By aligning with DIF and supporting DIF’s lightweight process for developing and releasing international standards, Kyndryl positions itself at the forefront of defining ethical, secure, and scalable AI agent interactions, without being bogged down in bureaucratic processes.  Empowering Enterprise Innovation: This collaboration is coauthoring the playbook for delivering next-generation identity and trust frameworks for enterprises, unlocking new automation and collaboration opportunities.

Sachio Iwamoto, Director and Principal Architect at Kyndryl, writes

“As enterprises accelerate toward AI‑native operating models, they need a trusted foundation for secure autonomy. By advancing interoperable identity standards, runtime guardrails, and end‑to‑end governance, we enable explainable, policy‑aligned multi‑agent collaboration, allowing organizations to innovate confidently, scale faster, and meet regulatory expectations.”

For more information about DIF and its working groups,
visit identity.foundation

Learn More

If you would like to get in touch with us or become a member of the DIF community, please visit our website.

Can't get enough of DIF?
| Follow us on Twitter
| Join us on GitHub
| Subscribe on YouTube
| Read our DIF blog
| Read the archives

Framework Strengthens Secure-by-Default Practices in AI Coding Workflows

Boston, MA – 9 February 2026 – OASIS Open, the global open source and standards consortium, announced that Cisco has donated Project CodeGuard, an AI model-agnostic security coding agent skills framework and ruleset, to the Coalition for Secure AI (CoSAI), an OASIS Open Project. The framework embeds security best practices directly into AI-assisted software development, helping to prevent vulnerabilities introduced by AI coding agents and generating more secure code automatically. 

Addressing AI Coding Security Risks

As AI coding agents rapidly transform software engineering, the speed and efficiency they provide can inadvertently introduce security risks, including skipped input validation, hardcoded secrets, weak cryptography, unsafe functions, and missing authentication or authorization checks. 

Project CodeGuard addresses these challenges across the full development lifecycle: guiding design before code is written, preventing vulnerabilities during code generation, and supporting AI-assisted code review afterward.

“Project CodeGuard represents Cisco’s commitment to advancing security at the scale and speed of AI,” said Anthony Grieco, Chief Security & Trust Officer, Cisco. “While this is a major step forward, we are just getting started. By contributing this framework to CoSAI’s open ecosystem, together, we are building security into AI coding from the start. Making these practices freely available will elevate security across the industry and protect the software that powers our collective world.”

For more details on the donation and technical capabilities, read more in the blog post, “Cisco’s Donation of Project CodeGuard to CoSAI: A New Chapter in Securing AI-Generated Code.”

“Project CodeGuard exemplifies CoSAI’s vision of bringing together industry expertise to solve real-world AI security challenges,” said David LaBianca, CoSAI Co-Chair, Google. “This framework empowers developers with the tools they need to create secure code. Through our open collaboration model, we’ll work with the community to expand these capabilities and drive adoption across the industry, advancing our shared mission of making AI systems more secure and trustworthy.”

Comprehensive Security Coverage

Project CodeGuard provides multi-layered security coverage across several domains: cryptography, input validation, authentication, authorization, access control, supply chain security, cloud and platform security, and data protection. This approach ensures that security considerations are woven throughout the development process.

The framework integrates seamlessly with AI assistants including Cursor, GitHub Copilot, Windsurf, Claude Code, and others, using a unified markdown format that translates easily to integrated development environment (IDE)-specific formats.

Development Through Special Interest Group

The ongoing development and extension of Project CodeGuard will be conducted through a dedicated Special Interest Group (SIG) within CoSAI’s AI Security Risk Governance Workstream. The collaborative structure will enable technical contributors, researchers, and organizations to work together on expanding the framework’s capabilities and driving its adoption across the AI development community.

Get Involved

CoSAI brings together more than 40 industry partners to advance secure AI, share guidance for deployment, and collaborate on AI security research and tools. Its Premier Sponsors, including EY, Google, IBM, Meta, Microsoft, NVIDIA, PayPal, Snyk, Trend Micro, and Zscaler, are leading the way in advancing secure AI initiatives. Technical contributors, researchers, and organizations are welcome to participate in its open source community and support its ongoing work. OASIS welcomes additional sponsorship support from companies involved in this space. Contact join@oasis-open.org for more information.

About CoSAI

The Coalition for Secure AI (CoSAI) is a global, multi-stakeholder initiative dedicated to advancing the security of AI systems. CoSAI brings together experts from industry, government, and academia to develop practical guidance, promote secure-by-design practices, and close critical gaps in AI system defense. Through its workstreams and open collaboration model, CoSAI supports the responsible development and deployment of AI technologies worldwide.

CoSAI operates under OASIS Open, an international standards and open-source consortium. www.coalitionforsecureai.org

About OASIS Open

One of the most respected, nonprofit open source and open standards bodies in the world, OASIS advances the fair, transparent development of open source software and standards through the power of global collaboration and community. OASIS is the home for worldwide standards in AI, emergency management, identity, IoT, cybersecurity, blockchain, privacy, cryptography, cloud computing, urban mobility, and other content technologies. Many OASIS standards go on to be ratified by de jure bodies and referenced in international policies and government procurement. www.oasis-open.org

Media Inquiries: communications@oasis-open.org

The post Cisco Donates Project CodeGuard to Coalition for Secure AI appeared first on OASIS Open.

Asia-Pacific (APAC) is one of the most-attacked regions globally — accounting for 34 per cent of incidents in 2024, with valid-account abuse as the leading entry vector, according to the IBM X-Force 2025 Threat Intelligence Index — making strong identity protection a business imperative. Across business process outsourcing (BPO) operations, manufacturing floors, healthcare environments, and both SMEs and large enterprises, workers rely heavily on continuous access to applications and sensitive digital data, meaning the digital identity of every employee has effectively become the new perimeter.

The Better Identity Coalition has circulated a draft voluntary code of conduct it describes as “rules of the road” for how organizations request and use data from verifiable digital credentials. The effort offers an early framework for limiting overly broad or invasive data requests as verifiable credentials move closer to real-world deployment.

Among sectors vulnerable to AI-assisted fraud attacks, the financial industry is perhaps the ripest. With high-stakes remote transactions occurring at scale, increasingly involving AI agents, there are countless attack surfaces, and potentially massive payoffs.

At the FIDO Alliance’s Identity Policy Forum, a panel led by the Better Identity Coalition unpacks a paper it drafted with the American Bankers Association within the Financial Services Sector Coordinating Commission (FSSCC), focusing on the threat of generative AI to the financial services digital identity system.

A presentation from Chief Privacy Officer for the State of Utah Christopher Bramwell at the FIDO Identity Policy Forum looks at how the state’s unique culture has influenced its leadership on digital identity in the U.S., in the form of its State Endorsed Digital Identity (SEDI) initiative.

The post Webinar Recording: Accelerate Your Healthcare Workforce with Verifiable Credentials appeared first on Velocity.

Passkey champions to develop certification profile as focus turns to digital credentials

At the annual Identity Identity & Policy Forum, it’s a tradition for Andrew Shikiar, CEO of the FIDO Alliance, to reflect on his predictions from the previous year and offer predictions for the coming one. 2025 was a pivotal year for FIDO: passkeys – FIDO’s raison d’etre in recent years – finally became a mainstream authentication method, marking a long-term win for the Alliance.

In his keynote, FIDO Alliance CEO Andrew Shikiar estimates over 4 billion passkeys are now being used to secure sign-ins around the world. “That’s a massive number considering we introduced passkeys in 2022.”

Shikiar’s speech runs through his record on predictions he made at the beginning of 2025, and comes out looking pretty clairvoyant. Major banks have deployed passkeys. “I stood here last year and said 2025 will be the year of passkeys and banking,” Shikiar says. “I was kind of eating my socks on that until around Q4, when all of a sudden basically every major bank in the U.S. passkeys for sign-up.”

As I reflect on last week’s LF Decentralized Trust Member Summit and Maintainer Days, I want to extend a sincere thank you to every member and maintainer who showed up, participated, and contributed. The conversations, collaboration, and momentum over our days together were a powerful reminder of what makes this community so special. This was a week shaped by members who have been building with us for years and strengthened by those who are newer to the community and already leaning in.

Meta shares a novel approach to enabling cross-device passkey authentication for devices with inaccessible displays (like XR devices).

We’re sharing a novel approach to enabling cross-device passkey authentication for devices with inaccessible displays (like XR devices). Our approach bypasses the use of QR codes and enables cross-device authentication without the need for an on-device display, while still complying with all trust and proximity requirements. This approach builds on work done by the FIDO Alliance and we hope it will open the door to bring secure, passwordless authentication to a whole new ecosystem of devices and platforms.

Introduction

Looking back to the beginning of the year, we had ambitious goals for Besu, and we packed a lot into 2025 - including shipping 3 hardforks (2 named hardforks plus BPO1), 15 releases, 811 commits - oh and Ethereum’s 10-Year Anniversary. This post will unpack some of Besu’s 2025 highlights.

Treefort Technologies Prevents Millions in Title Fraud While Making Identity Verification a 5-Minute Task for Canadian Lawyers 

Download this Case Study as a PDF

Fast Facts Organization: Treefort Technologies Sector: Legal Technology / Identity Verification Headquarters: Edmonton, Alberta DIACC Certification: PCTF Verified Person (January 2025) Key Achievement: Detected tens of millions of dollars in potential title fraud The Challenge

Title fraud losses in Canada have exceeded $100 million over three years, with one major insurer reporting a 300%+ increase in fraud claims year-over-year. Sophisticated criminals now create fake identification documents in under 30 seconds using generative AI and digital injection attacks, including forgeries visually impossible to detect.

For Canadian lawyers, the stakes are enormous. They must verify client identities under FINTRAC regulations and Law Society rules, yet regulators cannot endorse specific technologies. Legal professionals faced an impossible choice: trust verification tools without independent validation, or expose their practices and their clients to increasingly sophisticated fraud.

The Solution

Treefort Technologies, founded by commercial lending lawyer Jay Krushell, built Canada’s most comprehensive identity verification platform specifically for legal professionals. What sets Treefort apart is its layered, multi-factor approach: rather than relying on a single verification method, the platform triangulates data across 1,750+ authentication data points from trusted sources.

Pursuing PCTF certification through DIACC gave Treefort independent, third-party validation that its platform meets rigorous standards for privacy, security, and interoperability. The certification process aligned with ISO/IEC standards and involved meticulous evaluation by DIACC-accredited auditors.

As a leader in the industry, Jay Krushell also co-leads the DIACC Adoption Committee and drives the development of the PCTF Legal Professionals Profile, a new auditable criteria that specifically address how digital identity verification technologies comply with Law Society client ID rules. This collaborative work ensures lawyers have objective confirmation when selecting verification technology.

The Results Fraud Prevention: Detected tens of millions of dollars in potential title fraud Speed: Clients complete verification in 5 minutes using their smartphone Certifications: PCTF Verified Person certification (one of only two IDV providers) plus SOC 2 Type II compliance Coverage: Compliant with Law Society Client ID Rules in every province in Canada Strategic Partnership: Stewart Title Canada acquired a majority stake (2021), validating market position Integrations: Available through BC Land Title and Survey Authority (LTSA), Appara, Closer, Prolegis, Quintlink and other leading platforms

“Securing digital identities is our passion, and Treefort’s industry leadership and our PCTF certification are a testament to our unwavering commitment to excellence. In today’s world, where the authenticity of information is routinely challenged, our track record and our certification provide unparalleled confidence.

— Jay Krushell, Chief Legal Officer & Co-Founder, Treefort Technologies

Future Outlook

Treefort continues expanding its platform capabilities, including banking verification features and enhanced fraud risk indicators. As Canada moves toward Open Banking, Treefort is positioned to integrate new data sources that further strengthen identity verification. The company remains committed to working with DIACC on evolving trust framework standards that protect Canadians while enabling innovation.

Ready to Protect Your Practice

Legal professionals across Canada trust Treefort to verify client identities and prevent fraud.With PCTF certification validating their commitment to security and compliance, Treefort offers the confidence you need in today’s high-risk environment.

Visit treeforttech.com to see how 5-minute verification can transform your practice while protecting your clients and reputation.

Collaboration Supports Commitment to Secure, Trustworthy, and Responsible AI Systems

Boston, MA – 3 February 2026 – The Coalition for Secure AI (CoSAI), an OASIS Open Project advancing AI security, announced that Meta has joined the coalition as a Premier Sponsor. With extensive experience developing and deploying AI technologies and a longstanding commitment to open research and collaboration, Meta brings invaluable expertise to CoSAI’s mission of establishing industry-wide AI security standards and best practices. 

The addition of a global AI leader further strengthens CoSAI’s rapidly expanding community of more than 40 partner organizations working together to address emerging security challenges and build secure and trustworthy AI systems. 

“We welcome Meta as a CoSAI Premier Sponsor. Their commitment reflects what the industry increasingly recognizes: AI security is best addressed through open collaboration,” said Omar Santos, CoSAI Project Governing Board (PGB) co-chair, Cisco. “Meta’s deep knowledge in AI development and deployment will strengthen our mission to create open, actionable frameworks that help organizations build secure AI systems.”

“Meta is deeply committed to advancing AI security through collaboration with industry partners to benefit the entire AI ecosystem,” said Scott Bratsman, Meta’s Senior Director of Product Management for Security. “By joining CoSAI, we’re proud to help develop practical security standards to ensure AI systems remain secure at scale.”

Meta joins CoSAI’s distinguished group of Premier Sponsors, including EY, Google, IBM, Microsoft, NVIDIA, PayPal, Snyk, Trend Micro, and Zscaler. Together, these organizations are united in accelerating the development of secure and responsible AI.

Get Involved

CoSAI welcomes technical contributors, researchers, and organizations to participate in its open source community and support its ongoing work. OASIS welcomes additional sponsorship support from companies involved in this space. Contact join@oasis-open.org for more information.

About CoSAI

The Coalition for Secure AI (CoSAI) is a global, multi-stakeholder initiative dedicated to advancing the security of AI systems. CoSAI brings together experts from industry, government, and academia to develop practical guidance, promote secure-by-design practices, and close critical gaps in AI system defense. Through its workstreams and open collaboration model, CoSAI supports the responsible development and deployment of AI technologies worldwide. CoSAI operates under OASIS Open, an international standards and open-source consortium. www.coalitionforsecureai.org

About OASIS Open

One of the most respected, nonprofit open source and open standards bodies in the world, OASIS advances the fair, transparent development of open source software and standards through the power of global collaboration and community. OASIS is the home for worldwide standards in AI, emergency management, identity, IoT, cybersecurity, blockchain, privacy, cryptography, cloud computing, urban mobility, and other content technologies. Many OASIS standards go on to be ratified by de jure bodies and referenced in international policies and government procurement. www.oasis-open.org

Media Inquiries: communications@oasis-open.org

The post Meta Joins Coalition for Secure AI as Premier Sponsor to Advance Industry Security Standards  appeared first on OASIS Open.

In 2025, in light of the US TikTok ban, ISL conducted an investigation into TikTok and the inherent privacy and safety risks in the app. In light of the recent announcement rehoming certain TikTok assets into the mostly (but not entirely) US-backed TikTok USDS Joint Venture LLC, we offer this updated analysis of the overall privacy risks for US citizens who use TikTok.

Understanding the programmatic privacy risks related to TikTok is more complex than just analyzing the TikTok iOS and Android apps. “TikTok” is more than a couple social media apps; it’s a portfolio of products owned and developed by a complicated network of US, Singapore, Chinese, and other entities. TikTok and its related entities have 66 mobile apps available on app stores worldwide and more than 16 on US app stores, including TV app stores (Google, Amazon, Samsung, and LG).

Additionally, our latest research shows that nearly 48,000 mobile apps share data with TikTok via TikTok’s published Software Development Kits (SDKs)[1]. Little has been discussed about the other TikTok apps, the 48,000 app developers’ duties or SDKs in general, vis a vis the Protecting Americans from Foreign Adversary Controlled Application Act.

The case of TikTok also exposes the confusion of complicated multinational corporate structures and issues of parent company access to digital assets. In this case, TikTok maintained several US companies such as ByteDance Inc., TikTok Byte Dance LLC, and TikTok Inc., all registered in California. But ByteDance Ltd. headquartered in China and registered in the Cayman Islands, is understood to be the ultimate parent of all the organizations[2]. According to CrunchBase, ByteDance Ltd. has 58 companies[3].

Now that TikTok’s corporate ownership is “safely” in the hands of a majority US-based owners, we revisit the reality of TikTok privacy risks under ownership of the new TikTok USDS Joint Venture LLC. We find very little has changed, and privacy risk has increased. Most strikingly, Bytedance Ltd. retains 19.9% ownership in the new venture. The new ownership also includes a UAE equity firm (15%) among mostly US-based others, two of which were (and remain?) stakeholders in Bytedance, Ltd. Oracle remains the cloud backend which it already was. Perhaps the most substantive change is that the US government has achieved its own kind of “golden share” of unfettered TikTok user data. In short, it might be the worst of all possible worlds.

Safety Risks of Social Media Platforms

Social media platforms pose several safety risks to users such as privacy risks, misinformation and disinformation risks, and risk of technology addiction. Privacy risk is multifaceted, with concerns about user data privacy (data sharing) as well as the platform’s AI-based translation of personal profiles into [ever smaller] micro-segments used for targeting, recommendations, and other predictive and decision-making functions. The latter behavior isn’t always recognized as a privacy risk, but it is perhaps the larger safety risk: pigeonholing people into undisclosed and unchangeable sensitive categories as designated and used (and shared?) secretly by the system. This risk is compounded by the fact that platform providers fail to disclose the extent to which the system can be manipulated either internally or by third parties to achieve political ends.

What is independently measurable when it comes to privacy risks? Data privacy with particular attention to data flow is readily measurable by independent auditors. Without access to the source code and architecture documents, it is extremely difficult to measure the inner logic of a machine learning system based on observable app and system behaviors.

What follows in this paper is a deep dive into measurable data privacy risks in TikTok apps as observed by the ISL team and an assessment of the overall safety risks

The original privacy concern unique to TikTok was that the Chinese government might have a 1% “golden share” in its parent company, ByteDance Ltd. thus enabling access to US Tiktok user data. But in 2023, TikTok claimed the Chinese government does not have access to it, and that it cannot compel ByteDance Inc. (a US company) to share data. It also denied that any user data was stored in China:

“Myth: Under its 2017 National Intelligence law, the Chinese government can compel ByteDance to share American TikTok user data.

Fact: TikTok Inc., which offers the TikTok app in the United States, is incorporated in California and Delaware, and is subject to U.S. laws and regulations governing privacy and data security. Under Project Texas, all protected U.S. data will be stored exclusively in the U.S. and under the control of the U.S.-led security team. This eliminates the concern that some have shared that TikTok US user data could be subject to Chinese law.

Myth: TikTok stores U.S. user data in China, where multiple Chinese nationals, including possible members of the CCP, have access to it.

Fact: As of June 2022, 100% of U.S. traffic is routed to Oracle and USDS infrastructure in the United States, and today all access to that environment is managed exclusively by TikTok U.S. Data Security, a team led by Americans, in America. We have begun the process of deleting historic protected user data in non-Oracle servers; once that process is complete, it will effectively end all access to protected U.S. user data outside of TikTok USDS except under limited circumstances.”[4]

In our privacy risk assessments of companies, ISL assumes that parent companies do indeed have access to the data of their child companies—just like they have access to other assets of child companies. Thus, parent company ByteDance Ltd. may have access to ByteDance, Inc. [the parent company of TikTok Inc.] and thus TikTok user data. But this remains an open—and larger—question regarding whether parent companies are entitled to access (read? monetize?) the data of the platforms that they own in whole or in part.

The US government, however, also has a record of attempting to gain access to personal data repositories through requests to corporations[5], through data brokers[6], and of course, through direct collection as performed by the NSA’s Prism program, surfaced by Edward Snowden in 2013[7].  The second Trump administration has exhibited an even more overt thirst for amassing and aggregating personal information[8]  and weaponization[9] of it, including Attorney General Pam Bondi’s most recent demand for Minnesota’s voter rolls and welfare data as a condition for removing ICE from the state.[10]

Perhaps an even greater risk of TikTok and other social media platforms is the ungoverned proliferation of misinformation and disinformation that is deployed at scale, which can influence elections and threaten democracy, witness the social media platform X’s role in the 2024 US election.[11] An analysis of the impacts of misinformation and disinformation is beyond the scope of this paper but is mentioned due to its importance.

Privacy Risks in Social Media Platforms Measurable Privacy Risks: How social media platforms collect and share personal information

When ISL assesses the overall privacy risk of an app, we use the traditional impact * likelihood calculation. Impact is based on the sensitivity of the information that an app collects. Likelihood is based on the amount personal information sharing and monetization performed by the app. It’s important to have a baseline understanding of the ways that social media platforms collect and share personal data.

Data Collection

Social media platforms collect data in several ways—note that these methods are used by a wide variety of apps and platforms; these are not unique to social media platforms:

From first party apps: Volunteered by the user while using the app, Observed user behaviors recorded by the app. Through the integration of Software Development Kits (SDKs) provided by the social media platform into third party apps. Through the social media platform’s tracking pixels incorporated on many third-party websites.

Data Collection by First Party Apps

Social media platforms collect extensive personal information by design and therefore build vast longitudinal records of so-called “personally identifiable information” (PII) about people and their social relationships, including family. TikTok (like most social media platforms) collects a great deal of sensitive information including location, unique identifiers for the device and the person, access to camera and photo library, access to microphone, browser history, and more.

The most sensitive information shared in social media platforms is personal location data, which can be obtained by the platform via multiple methods including directly from the device, volunteered by users either by their tagging locations or communicated textually. Precise geolocation is also provided in the metadata of photographs and videos unless it is disabled or removed.[12]

Some of the most sensitive information shared through social media platforms is photographs, and video and audio recordings. The information gleaned from photographs and videos conveys far more personal information than people may realize. Beyond the metadata automatically captured with photos and videos, information in the visual scene can include sufficient detail to indicate location and identify other people. TV shows playing in the background can convey preferences, as can books and magazines. Background photographs convey additional personal relationships and information. AI image recognition tools can automatically catalog all this information, allowing social media platforms to store it in ever deepening knowledge graphs.

But this isn’t the greatest risk: audio and video recording and photographs capture biometric data such as voice recordings. These files are increasingly risky also due to AI-forged voice and video recordings, and photographs.

Given that TikTok is a video sharing platform, one should assume that all video content and its metadata are being analyzed, catalogued, and datafied. Note that this isn’t unique to TikTok; all social media platforms are likely to be doing this.

We were interested to see how TikTok compared to Facebook when it comes to data collection. We used the iOS versions of the two apps to compare the permissions accessed by each app. As can be seen in Appendix B, assuming the Apple Privacy Labels are accurate, Facebook collects significantly more personally connected data, including health information.

Data Collection Through Software Development Kits

Every social media platform leverages the power of mobile app software developer kits (SDKs) to allow people to easily read and write from/to their network from other [non-TikTok] apps. SDKs are modules of code that can be integrated directly into any mobile app. Social media platforms usually have at least three freely available SDKs for app developers to use serving three distinct functions:

Login SDK: Allows people to log into an app using their social media credentials (typically called “federated ID”). From a privacy perspective, this functionality allows the social media platform to collect information about the variety of other apps a person uses. People may not realize how much sensitive information is gleaned from simply knowing the names of the apps—examples such as period tracker apps, dating apps, and other health care apps. Share SDK: Allows people to share to their social media network from a myriad of other apps—not just the social media app. Display Social Media Content SDK: Allows apps to display content from social media platforms directly in their apps. In the case of TikTok, this takes the form of an SDK that allows app developers to embed TikTok videos in their apps.

Since many social media platforms have their own ad networks, two other common SDKs are used to display ads from the social media company’s ad network and track advertising “events” to measure ad efficacy, etc.

It is important to highlight the privacy risk that SDKs have access to any data and permissions that the app has access to; examining the permissions of the apps including these SDKs is for future study.

TikTok: TikTok has all of these kinds of SDKs. According to AppFigures (a mobile analytics service), nearly 48,000 apps include TikTok SDKs. More than 47,500 of these apps are for use in the US (among other many other countries). Little has been mentioned of these 47,500 apps for use in the US. Presumably they were also governed by the US TikTok ban, but there were no reports of these apps disabling TikTok functions.

When we contemplate the privacy risks posed by TikTok, we must also consider that nearly 48,000 other apps are feeding personal information into TikTok servers. TikTok is vast personal data harvesting machine.[13]

Most apps that use the TikTok SDK are Android apps (47.3K) with only 521 iOS apps using it. The apps that include the TikTok SDK have, in total, billions of downloads. The apps are written by developers from all over the world. The apps include education, sports, finance, weather, health and fitness, dating, communication and business apps. 1,755 (3.67%) of the apps are educational apps. Nearly 10,000 of the apps that include the TikTok SDK are for children under the age of 18.[14] 6,560 apps are rated either for “Everyone”, “4+” or “9+”.14

Data Collection Through Tracking Pixels and Cookies

TikTok has 7 tracking pixels[15] designed to be added to third-party websites. Per TikTok developer documentation, their pixels mainly collect data to understand ad performance, but the pixels collect more than just ad data.[16] The following data collected by TikTok tracking pixels are personally identifiable information:

IP address, User agent, Cookies – TikTok has first- and third-party cookies; the latter are on by default, Metadata & button clicks, which, per the documentation, “can also be used to personalize ad campaigns for people on TikTok”, meaning the data is correlated and saved with TikTok user records.

Compared to Facebook which has 6 tracking pixels, TikTok pixels are found much less frequently in third-party sites (Table 1).

Table 1: TikTok and Facebook Trackers

Data Sharing

There are at least four channels for sharing data with and by social media platforms.

From the social media mobile app directly. Compared to other types of apps audited by ISL, social media apps like TikTok are generally less “leaky”, meaning that they mostly share collected personal information from the app with domains controlled by their corporate owners (also known as “first parties”). This is mainly because platforms like Facebook and TikTok have their own ad networks, so they don’t communicate with other adtech and martech platforms directly from the mobile app.

TikTok:  ISL recently took a closer look at the communication in and out of the main TikTok mobile apps (iOS and Android versions). We tested using two profiles: one of an adult, and one of a child. Key questions were:

How much data “leakage” was happening, i.e. how much data was being shared with unexpected third parties? What TikTok or ByteDance servers were involved, and what can we determine about the ownership and location of the servers?

In both test profiles, there was very little data “leakage” to spurious third parties. We observed only two third-party advertising related domains: (1) a cross-site Facebook tracker, and (2) a domain associated with the AppsFlyer SDK. Both of these make sense, as the app integrates Facebook SDKs for login and sharing, and also the AppsFlyer SDK (among others).

The communication was nearly 100% between the app and TikTok owned servers or obvious data processors for TikTok like Akamai. In terms of data sharing from the app, TikTok is very much like Facebook.

There were two TikTok and ByteDance domains in the network traffic, that do appear to be owned by the US based companies. Note that, despite multiple mentions that TikTok uses Oracle, we observed only one domain observed that was owned by Oracle.

Details on the communication to/from the app can be seen in the ISL Safety Labels for the apps:

Android TikTok app: https://appmicroscope.org/app/1729/ iOS TikTok app: https://appmicroscope.org/app/1728/

But Wait, There’s More

People may think that there are only a few TikTok apps available. This is not the case[17]. According to AppFigures, there are 66 apps provided by TikTok or its related entities, worldwide, up from 47 in 2025 [18]. Of those, 32 TikTok apps are available in the US. In the US there are TikTok apps available for Android TV, Amazon, LG TVs and Samsung TVs as well. There are also:

a wallpaper app called “TickTock – TikTok Live Wallpaper” with an estimated 100M downloads worldwide5 a “lifestyle/social” app called Lemon8 – Lifestyle Community with an estimated 10M downloads worldwide5 and a shopping app called “TikTok Shop Seller Center” with an estimated 10M downloads worldwide.

The TV apps present a serious privacy concern as they may collect viewing history; it would be prudent to assume they do. The TikTok for Android TV app has an estimated 10M downloads.

Also of particular concern are two VPN apps, which would have access to all network traffic to and from the phone. Neither appear to be available in the US, and if they were ISL would recommend staying away from them.

See Appendix A for a list of the TikTok apps available in various app stores worldwide.

Via Software Developer Kits (SDKs): As mentioned earlier, SDKs have access to all the data the encompassing app has access to. Since these apps may read data from the social media platform to present to the users of their app, they also have access to the user’s social media content. The apps are bound, however, by the developer agreement terms established by the SDK provider which prohibit such use, as TikTok’s does[19]. From the social media company [servers] to Customer Data Platforms and Identity Resolution Platforms: Social media platforms often share bulk personal data with marketing and advertising platforms called Customer Data Platforms (CDPs) and Identity Resolution Platforms (IDRPs). This is accomplished using the CDP’s or IDRP’s published application programming interfaces (APIs), which communicate server-to-server, not from the mobile app. Customer Data Platforms and Identity Resolution Platforms are platforms designed to ingest and share personal information at scale. ISL has identified over 300 such companies[20] worldwide and continues to research them to determine risks to consumers of this commercial surveillance infrastructure. For instance, nearly 40% of identity resolution platforms are registered data brokers and it’s likely more of them should be registered as data brokers. One of the key objectives of this commercial surveillance infrastructure is to personalize the experience of all “visitors”—i.e. not just existing customers but anyone who visits a website[21].

TikTok: TikTok does indeed have at least one such integration with an identity resolution platform: LiveRamp, one of the largest identity resolution platforms. TikTok likely has other integrations that would be performed by back-end servers.

Through advertising: Since TikTok has its own ad network, it is also capable of receiving personal information directly from the real-time bidstream (RTB).

How Large of a Privacy Risk is TikTok, Used as Intended?

From a commercial surveillance perspective, TikTok may be less risky than Facebook, for example, which has access to and uses much more personal and sensitive information for 3rd party advertising and its own purposes (see Appendix B).

From a government surveillance perspective, there is a non-zero risk that user data was combined across all ByteDance Ltd. properties. There was also a non-zero risk that TikTok user data was accessible by the Chinese Communist Party (CCP). ISL is unable to further quantify the risk based on publicly available information. These risks now apply to the US government.

TikTok in Education & Social Engineering Data Breaches

TikTok is widely used in classrooms in the US and around the world as a teaching and engagement tool. As noted earlier, the TikTok SDK is also integrated into more than 1700 education apps. Teachers find the platform to be a good way to communicate with students, and to inspire creativity[22]. At the time of this writing there were 5.9M TikTok posts tagged #teachersoftiktok, illustrating the level of teacher use of TikTok[23]. TikTok also funded a “Creative Learning Fund” with $50M in 2020.[24]

Social Engineering-Facilitated Data Breaches

Note that the use of TikTok has been connected to at least one school district data breach[25]. Any accessible data on social media platforms can be used in social engineering-based security attacks.

Digital Assets and Corporate Ownership

There are three key questions with respect to corporate ownership of a restructured TikTok: (1) where are the servers located and which country’s data privacy laws apply, (2) will ByteDance Ltd. retain access to the TikTok data/ training set, and (3) how much access do all owners have to the personal data repository?

Corporate Ownership

Corporate ownership—in part or whole—means having access to the assets of the company including access to the digital assets, such as databases of personal information amassed by the company’s products and services.

In 2023 there was considerable confusion over both the corporate ownership of TikTok and the Chinese government’s access to TikTok user data. Sources including TikTok[26] and Poynter[27] explained that ByteDance Ltd., a Cayman Islands registered company based in China, was majority owned (60%) by a worldwide consortium of equity partners, including large at least two named US private equity firms (Susquehanna International Group and General Atlantic); 20% was owned by the founder, Zhan Yiming, a private individual living in China, and 20% was employee owned by TikTok employees around the world. What was less clear, however, was whether the Chinese government owned a 1% “golden share”. TikTok’s explainer9 indicates that the Chinese government did not own a 1% in ByteDance, but in ByteDance subsidiary, Douyin Information Service Co., Ltd. Presumably, Douyin Information Service Co., Ltd was not included in the sale of TikTok to newly formed TikTok USDS Joint Venture LLC and remains with ByteDance Ltd. While the US Digital Services (USDS) is part of the entity name, the US is reported to not have a stake in the venture. It is disturbing that a government agency is named in the new venture. We have every reason to assume that data sharing with the US government was a condition of the sale.

Figure 1 below shows the estimated ownership by country location in 2023 and 2026[28]. Of note, Chinese-based ownership appears unchanged in size, but importantly, in 2023, 20% was owned by Zhang Yiming and now ByteDance Ltd. owns about 20% of the company. The authors are not legal experts but this sustaining partial ByteDance Ltd. ownership leaves open the original concerns about the CCP’s access to US citizens’ data.

The chart makes some assumptions about the distribution of ownership based on publicly available information. We don’t know how much of the 40% of worldwide owners (in 2023) were equity firms based in the US. It is possible that the 2023 US ownership was higher than 40%, possibly even higher than 50%.

Figure 1: Estimated TikTok ownership 2023 and 2026

Digital Assets

Based on our analysis it appears that TikTok is a relatively separate infrastructure, including at least three separate TikTok corporate entities noted earlier, but we can’t be sure that there isn’t a centralized or even decentralized but networked user database.

Cloud Storage

Ostensibly, the original TikTok-related executive order was largely fueled by concern over where user data was stored and who had access to it. Reports vary, but TikTok has been using Akamai, a US company, as a content delivery network for TikTok since about 2020 and possibly as early as 2016. Our research confirms network traffic to Akamai servers.

Oracle began providing secure cloud storage technology to TikTok Global in 2020[29] including a 12.5% stake in TikTok Global. We do not know however if data was shared extraterritorially.

The most important privacy issue here, however, is that Oracle is a registered data broker in states that require such registration, meaning that it monetizes the sale of personal information, including location information. Companies that monetize personal information have an incentive to harvest as much personal information as possible and there is an open class action suit against Oracle’s data collection and selling practices.[30]

Can a data broker be the “trusted” entity to ensure the integrity of vast amounts of sensitive personal information? Perhaps this has never been about the safety and privacy of the data.

Whose data do TikTok owners have access to?

The TikTok sale press release implies that the sale only covers the US market, the “more than 200 million Americans and 7.5 million businesses” that use TikTok[31]. Presumably, the non-US markets’ data and technology assets stay with ByteDance Ltd. Recent TikTok user numbers show Chinese TikTok (called Douyin) users comprise nearly half of the 1.5B monthly TikTok users. https://www.statista.com/statistics/1299807/number-of-monthly-unique-tiktok-users/

Table 2: TikTok Users (Source: Statista[32])

Conclusions

Troves of personal information are risky for consumers in any corporation’s hands. No current regulation prevents this from happening. Additionally, no regulation adequately prevents the commercial trading of personal information. Until these are addressed, consumers and nation states face unreasonable risks of sensitive information such as location data being systematically shared with data brokers and thus, being available for sale to anyone who wants it, including adversary countries. Social media platforms of all kinds should hold a duty of loyalty to the data subject for the personal information they retain, but they currently do not. Therefore, social media platforms present unique risks due to the volume of highly sensitive personally identifiable information they hold.

Is it reasonable to suggest that a US company is a better corporate custodian of a massive trove of personal information? Certainly, ensuring that US citizens’ data stays out of the hands of any foreign government is worthwhile. Whether or not that’s possible in the current reality of hundreds of networked, global commercial surveillance entities is an open question with a likely depressing answer of, “No.” Additionally, the US doesn’t currently have a federal privacy law, and the US-based technology industry continues to operate in a general spirit of lawlessness (e.g. training machine learning models with scraped data).

Is the new ownership a safer configuration for people as both consumers and citizens? No. With nearly 20% ByteDance Ltd. ownership in the joint venture, the new structure fails to eliminate concern over the Chinese government having access to the data of US citizens. Moreover, now a UAE based private equity firm also has ownership (15%)  and access to the assets. It’s unclear precisely how connected to the US government the new venture is, but it seems clear given this administration’s behaviors over the past 12 months that the new joint venture facilitates use of citizen data by the US government. Finally, Oracle, a data broker with a spotty privacy reputation is now the primary authority for data privacy over the personal information of hundreds of millions of US citizens. TikTok has already changed its privacy policy to collect precise (instead of just coarse) location data[33], and to collect “AI interactions”.[34] 

Overall, what has changed with the sale of select TikTok assets to the new TikTok USDS Joint Venture LLC? If the previous ownership by ByteDance Ltd. was truly the reason for fearing CCP access to US TikTok users’ data, that threat remains with ByteDance Ltd. retaining 19.9% ownership in the joint venture. It is hard to not regard this years’ long campaign as anything other than a money, personal data, and power enrichment strategy for select US tech oligarchs and the US government. This administration’s unrestrained thirst for personal data—from DOGE, to Palantir, to Flock—is strong evidence that TikTok data will be used in support of the administration’s militarized “remigration” and government propaganda purposes, further destabilizing the US’s withering democracy.

Appendix A – TikTok Apps Available Worldwide

                                                                           Table 3: TikTok Apps in 2025                                                                         

 

      Table 4: TikTok Apps in 2026

Appendix B TikTok vs. Facebook iOS App Permission B.1  DATA USED TO TRACK YOU

B.2  DATA LINKED TO YOU

B.2   DATA NOT LINKED TO YOU

[1] Data obtained from AppFigures https://appfigures.com/

[2] Laura He, “Wait, is TikTok really Chinese?”, CNN, March 28, 2024, https://www.cnn.com/2024/03/18/tech/tiktok-bytedance-china-ownership-intl-hnk/index.html
Note that TikTok asserts that Bytedance Ltd. is not strictly based in China:
“Myth: TikTok’s parent company, ByteDance Ltd., is Chinese owned.

Fact: TikTok’s parent company ByteDance Ltd. was founded by Chinese entrepreneurs, but today, roughly sixty percent of the company is beneficially owned by global institutional investors such as Carlyle Group, General Atlantic, and Susquehanna International Group. An additional twenty percent of the company is owned by ByteDance employees around the world, including nearly seven thousand Americans. The remaining twenty percent is owned by the company’s founder, who is a private individual and is not part of any state or government entity.”  “Myth vs Facts”, TikTok U.S. Data Security, https://usds.tiktok.com/usds-myths-vs-facts/ , accessed on 2/2/25.

[3] https://www.crunchbase.com/hub/bytedance-portfolio-companies

[4] “Myths vs Facts”, TikTok U.S. Data Security, https://usds.tiktok.com/usds-myths-vs-facts/, accessed on 1/26/26.

[5] https://www.forbes.com/sites/emmawoollacott/2024/08/28/us-government-requests-most-user-data-from-big-tech-firms/

[6] Elizabeth Goitein, “The Government Can’t Seize Your Digital Data. Except by Buying It.” Brennan Center for Justice, April 28, 2021, https://www.brennancenter.org/our-work/analysis-opinion/government-cant-seize-your-digital-data-except-buying-it

[7] Glenn Greenwald and Ewen MacAskill, “NSA Prism program taps into user data of Apple, Google and others”, The Guardian,  June 8, 2013, https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data

[8] https://www.brookings.edu/articles/privacy-under-siege-doges-one-big-beautiful-database/

[9] https://www.404media.co/ice-taps-into-nationwide-ai-enabled-camera-network-data-shows/

[10] https://www.democracynow.org/2026/1/26/headlines/attorney_general_bondi_demands_access_to_minnesotas_voter_rolls_and_welfare_data

[11] Kanishka Singh and Sheila Dang, “Musk and X are epicenter of US election misinformation, experts say”, Reuters November 4, 2024, https://www.reuters.com/world/us/wrong-claims-by-musk-us-election-got-2-billion-views-x-2024-report-says-2024-11-04/

[12] This can and should be disabled. Instructions are readily found through an internet search.

[13] For comparison purposes: more than 414,000 apps include Facebooks four SDKs: 311.7K apps include Facebook Login, 275.5K apps include Facebook Share, 139.9K apps include Facebook Ads. Source: Appfigures, accessed 1/26/26.

[14] Per the app store content rating.

[15] https://www.ghostery.com/whotracksme/search

[16] https://ads.tiktok.com/help/article/tiktok-pixel

[17] Jake Peterson, “All the Apps ByteDance Operates in the US: It’s not just TikTok”, LifeHacker, January 29, 2025. https://lifehacker.com/tech/apps-bytedance-operates-in-united-states

[18] Includes TikTok Ltd., TikTok Pte. Ltd, and Tsingtao TikTok Information Technology Company Limited; AppFigures, accessed on February 2, 2025.

[19] “TikTok Developer Terms of Service”, Last modified March 21, 2024, TikTok, https://www.tiktok.com/legal/page/global/tik-tok-developer-terms-of-service/en

[20] https://internetsafetylabs.org/resources/references/identity-resolution-and-customer-data-platform-companies/

[21] Lisa LeVasseur, “Worldwide Web of Human Surveillance: Identity Resolution and Customer Data Platforms”, Internet Safety Labs, https://internetsafetylabs.org/wp-content/uploads/2024/07/Worldwide-Web-of-Human-Surveillance-Identity-Resolution-and-Customer-Data-Platforms.pdf

[22] Deidre Olsen, “TikTok in the Classroom: The Good, The Bad, and the In-Between”, TEACH Magazine, May/June 2023 Issue, https://teachmag.com/archives/22904  ; “How to Use TikTok to Engage Students in Learning”, Children’s Health Council, https://dev.chconline.org/resourcelibrary/how-to-use-tiktok-to-engage-students-in-learning/

[23] https://www.tiktok.com/tag/teachersoftiktok

[24] https://newsroom.tiktok.com/en-us/investing-to-help-our-community-learn-on-tiktok

[25] Internet Safety Labs, “Another School District Hacked”, Internet Safety Labs, November 16, 2023, https://internetsafetylabs.org/blog/research/another-school-district-hacked/

[26] https://newsroom.tiktok.com/the-truth-about-tiktok?lang=en-AU

[27] https://www.poynter.org/fact-checking/2024/who-owns-tiktok-bytedance-china-ban/

[28] https://www.nytimes.com/2026/01/22/business/media/tiktok-investors-oracle-mgx-silver-lake-bytedance.html#:~:text=What’s%20notable?,to%20comment%20on%20its%20investment.

[29] https://www.oracle.com/news/announcement/oracle-chosen-as-tiktok-secure-cloud-provider-091920/

[30] In 2024, Oracle settled a class action suit alleging that the company “improperly captured, compiled and sold individuals’ online and offline data to third parties without obtaining their consent.”[30] The settlement has been appealed and the case is ongoing.

[31] https://usdsjv.tiktok.com/

[32] https://www.statista.com/statistics/1299807/number-of-monthly-unique-tiktok-users/

[33] Note that the app nutrition label in the Apple store still only notes coarse location data collection.

[34] https://www.wired.com/story/tiktok-new-privacy-policy/

The post TikTok’s Real Privacy Risks appeared first on Internet Safety Labs.

Fraud is evolving faster than ever, with AI-powered scams, deepfake-enabled identity theft, and a surge in account takeovers putting financial institutions on high alert and accountholders at risk. As the most visible safeguard of the past few decades, the humble password is coming under increasing scrutiny.

In a PaymentsJournal podcast, Dr. Adam Lowe, Chief Product and Innovation Officer at CompoSecure and Arculus, and Suzanne Sando, Lead Analyst of Fraud Management at Javelin Strategy & Research, explored the rising fraud challenges facing financial institutions and how some of the latest solutions may be inspired by innovations in retail.

For our 2026 outlook, we picked six trends to better acquaint you with what to expect this year in the payments arena, but then we went a step further in selecting three worthy of a deeper dive. See all four stories below, and a brief explanation of why we focused where we did.

Our senior reporter, Justin Bachman, dug deeper into the AI-driven agentic payments topic to help readers better understand when and how this tech tool really becomes a reality. Spoiler: not in 2026. Still, his story describes the challenges being tackled this year that are likely to lead to bot payments as early as next year.

It’s the letter most consumers dread receiving — the notification that your personal information has been involved in a data breach.

About 80% of respondents to a new survey said they received at least one data breach notice in the prior 12 months, according to the Identity Theft Resource Center.

Nearly 40% of respondents received three to five separate notices over that period. The survey polled 1,040 individuals in November.

Of those who recently received a data breach notice, 88% reported at least one negative consequence, such as increased phishing or other scam attempts, more spam emails or robocalls or an attempted account takeover, the survey found.

It’s not like forgetting the milk at the grocery store. No big deal, just add it to the list for next time. But that kind of oversight in identity management isn’t as simple to fix, and organizations that adopt a solution later may find it becomes an expensive add-on to their security to-do list.

It’s a situation many organizations find themselves in. The Cisco Duo 2025 State of Identity Security reports that 74% of IT leaders admit identity security is often an afterthought in infrastructure planning. As a result, businesses scramble to tack on an identity solution, often too late to assess whether it’s the right fit for their architecture, compliance, and scalability goals. ’Cause unlike the milk, it’s harder to swing back later and grab the right solution.

On December 5, 2025, the digital identity community gathered at Tokyo Port City Takeshiba for the 12th FIDO Tokyo Seminar. Under the theme “Towards a Passwordless World”, the event brought together 300+  industry leaders, government officials, and engineers to discuss the effectiveness of passkeys as a countermeasure against phishing and to explore the future landscape of digital identity.

Global Momentum: Local Leadership Driving Adoption

The seminar kicked off by highlighting the rapid adoption of FIDO standards and the strong commitment shown by the Japanese market.

Andrew Shikiar, CEO & Executive Director of the FIDO Alliance, shared the latest metrics: over 7 billion accounts worldwide are now protected by passkeys, with more than 3 billion passkeys saved by users. Data from the newly introduced “Passkey Index” further demonstrated the technology’s impact, revealing a 93% authentication success rate and a 73% reduction in login times.

In the Japanese market, Koichi Moriyama (NTT DOCOMO), Chair of the FIDO Japan Working Group (FJWG), reported on the growth of the local community as it celebrates its 10th anniversary and 111th monthly meeting. The day also marked a notable announcement: the FIDO Alliance has signed a liaison partnership with the Japan Securities Dealers Association (JSDA). This partnership is expected to accelerate security improvements and FIDO adoption across the entire securities industry.

Policy & Security: From Recommended to Essential

In 2025, Japan’s policy and security strategies are upgrading phishing-resistant authentication from “recommended” to “essential.”

Digital Agency: Masanori Kusunoki addressed the revision of the guidelines for online identity verification in administrative procedures (DS-500 to DS-511). He expressed the view that for Assurance Level 2 or higher, phishing-resistant methods like the My Number Card or passkeys will effectively become mandatory. NPA & FSA: Takahide Sannomiya (National Police Agency) and Motoshi Matsunaga (Financial Services Agency) emphasized the importance of passkeys in countering cyber threats. In the financial sector specifically, policies are advancing to default to phishing-resistant Multi-Factor Authentication (MFA) for critical operations such as logins and fund transfers.

Proven Success & Next Frontier: Account Recovery

A highlight of the seminar was the consensus that passkeys have moved beyond “early adoption” to become mainstream in Japan’s major services.

The “Passkey Index Japan” panel session (Mercari, NTT DOCOMO, KDDI, FIDO Alliance) revealed that passkey authentication usage has exceeded 50% among smartphone users at these three companies. It was disclosed that 50.4% of all monthly active users (MAU) for authentication services are already utilizing passkeys.

This widespread usage, spanning all ages and demographics, suggests that passkeys are a realistic solution that balances convenience with security.

The discussion also focused on “Account Recovery” as one of the key challenges following widespread passkey adoption. Tatsuya Karino (Mercari), Masao Kubo (NTT DOCOMO), and Hideki Sawada (KDDI) emphasized the importance of secure recovery processes utilizing My Number Cards (JPKI) and eKYC, as well as designing for device changes. This is poised to be a cross-industry theme for 2026.

Securities Transformation: Advancing Passkey Deployment

The transformation within the securities industry is noteworthy. Shinobu Hirayama of Rakuten Securities reported that the company completed the rollout of passkey authentication (FIDO2) across all channels in October 2025. According to Hirayama, five securities firms have already implemented FIDO2, with that number expected to rise to seven by the end of the year. He emphasized that passkeys play a central role in building a technology-based “layered defense” against evolving fraud attacks.

Deep Dive into Tech: Platforms & Security

Technical sessions for developers and security experts explored the latest features supporting passkey implementation.

Google Platform Evolution: Eiji Kitamura shared the latest updates based on Credential Manager. Of particular note was the “Restore Credentials API,” which promises to improve the developer experience by enabling seamless sign-ins when users migrate to new devices. Session Protection: In the “All About Passkeys” session (Eiji Kitamura, Kosuke Koiwai, Masaru Kurabayashi), the discussion turned to the risks of “session hijacking” that remain even after passkey adoption. Speakers argued for the necessity of risk-based session protection and new specifications like Device Bound Session Credentials (DBSC) to counter malware-based cookie theft.

Ecosystem & Innovation: Expanding Use Cases

Presentations from sponsor companies demonstrated a mature ecosystem capable of supporting diverse use cases.

Regulated Industries & Finance: Gim Leng Koh (OneSpan) presented a dual-key approach for financial institutions, enabling device health assessment and transaction signing (WYSIWYS). Scale & Performance: Eugene Lee (RaonSecure) introduced their FIDO solution’s high processing performance, supporting over 10 million monthly users. Solving B2B Challenges: Kazuhito Shibata (ISR) addressed the barriers hindering MFA adoption in corporate environments. Device Security in the AI Era: Everett Hiroshi Shiina (Yubico) explained the importance of hardware-attested Single Device Passkeys in the face of rising AI threats. Lifecycle Protection: Takashi Yoshii (Daon) introduced the integration of FIDO authentication with Deepfake detection-enabled eKYC via the IdentityX platform. Customer Engagement: Mitsuharu Nakamura (Twilio) proposed a seamless authentication experience using Twilio Verify, which supports passkeys alongside SMS and TOT

Beyond Authentication: Digital Credentials & Identity

The conversation extended beyond authentication to the entire identity lifecycle.

In a video message, Lee Campbell (Google/FIDO Alliance Digital Credential WG Co-Chair) shared the vision of extending the trust and interoperability established by passkeys to “Digital Credentials,” defining ecosystem standards for wallets and identity verification.

The final panel session, featuring members from the FIDO Alliance, OpenID Foundation, OpenID Foundation Japan, and the Digital Agency, deepened the discussion on managing the entire identity lifecycle—from account creation to recovery.

Looking Forward: Building Japan’s Digital Identity Future

The 12th FIDO Tokyo Seminar served as a testament that passkeys are becoming firmly established as part of Japan’s digital social infrastructure. As we look toward 2026, the FIDO Alliance’s initiatives will continue to expand from authentication to the entire identity lifecycle and into the realm of digital credentials.

We would like to express our sincere gratitude to the sponsor companies who supported this event, as well as to all the speakers and attendees. We look forward to seeing you at our next event!

A hot sauce brand doesn't scale on taste alone. It scales on consistency, traceability, and trust.

Matt Pittaluga, Co-Founder of Hank Sauce, joins hosts Reid Jackson and Liz Sertl to share how a college project became a product sold in more than 5,000 stores. He breaks down the early hustle, the jump into retail, and what it takes to keep quality tight as demand grows.

You'll also hear how Hank Sauce approaches traceability through product codes to track ingredients from batch creation to store shelves.

This episode is a replay of our conversation with Matt, brought back for anyone building, scaling, or supplying food brands. In this episode, you'll learn:

How Hank Sauce scaled its distribution to national retailers

The importance of traceability in ensuring food safety and product quality

Strategies for building networks to expand brand reach

Jump into the conversation: (00:00) Introducing Next Level Supply Chain

(01:34) The Hank Sauce story

(06:38) Grassroots marketing and early sales strategies

(13:34) Scaling up distribution to large retailers

(16:38) The importance of traceability and food safety

(19:51) Building a brand with a limited marketing budget

(23:43) Advice for new entrepreneurs

(31:22) Matt Pittaluga's favorite tech

Connect with GS1 US:

Our website - www.gs1us.org

GS1 US on LinkedIn

Register now for this year's GS1 Connect and get an early bird discount of 10% when you register by March 31 at connect.gs1us.org.

Connect with the guest:

Matt Pittaluga on LinkedIn

Check out Hank Sauce

Collaborative Industry Effort Delivers Identity Management, Supply Chain Integrity, and Protocol Security for AI Agent Deployments

Boston, MA – 27 January 2026 – OASIS Open, the international open source and standards consortium, announced the release of the “Model Context Protocol (MCP) Security” white paper from the Coalition for Secure AI (CoSAI), an OASIS Open Project. This framework equips security professionals and developers to identify, assess, and mitigate risks in MCP-based AI agents, addressing the urgent need for standardized security practices as AI increasingly connects to external tools and services.

Securing the Bridge Between AI and the Real World

MCP, developed by Anthropic, a CoSAI Sponsor, together with a growing open source community, has emerged as a leading protocol for connecting AI agents to external tools, databases, APIs, and services. However, like any integration protocol, MCP deployments face active and evolving threats.

This security framework presents a well-defined taxonomy of nearly forty threats and concrete mitigation strategies across twelve distinct categories, spanning identity and access control, input validation, data protection, network security, supply chain integrity, and operational visibility. The framework distinguishes between traditional security concerns amplified by AI mediation and novel attack vectors unique to LLM-tool interactions, enabling security teams to implement defense-in-depth strategies tailored to their specific deployment patterns.

“As AI moves beyond chat models to agents, gaining the ability to take actions and interact with their environments and the real world through tool calling, the security implications and potential consequences are much more severe,” said Ian Molloy, IBM, and Sarah Novotny, CoSAI’s Workstream 4 Co-Leads. “This framework represents the expertise of CoSAI’s members and contributors who understand that protecting agentic systems requires addressing everything from protocol-level authentication and supply chain integrity to guardrails, systems security and enforcement.”

Collaborative Industry Effort

The MCP Security paper was developed by CoSAI’s Workstream 4: Secure Design Patterns for Agentic Systems, drawing on contributions across CoSAI’s Sponsors and partner organizations, including Premier Sponsors EY, Google, IBM, Meta, Microsoft, NVIDIA, PayPal, Snyk, Trend Micro, and Zscaler. Additional CoSAI AI Security Guidance Publications can be found on GitHub.

Technical contributors, researchers, and organizations are welcome to participate in CoSAI’s open source community and support its ongoing work. OASIS welcomes additional sponsorship support from companies involved in AI security. Contact join@oasis-open.org for more information.

About CoSAI

The Coalition for Secure AI (CoSAI) is a global, multi-stakeholder initiative dedicated to advancing the security of AI systems. CoSAI brings together experts from industry, government, and academia to develop practical guidance, promote secure-by-design practices, and close critical gaps in AI system defense. Through its workstreams and open collaboration model, CoSAI supports the responsible development and deployment of AI technologies worldwide. CoSAI operates under OASIS Open, an international standards and open-source consortium. www.coalitionforsecureai.org

About OASIS Open

One of the most respected, nonprofit open source and open standards bodies in the world, OASIS advances the fair, transparent development of open source software and standards through the power of global collaboration and community. OASIS is the home for worldwide standards in AI, emergency management, identity, IoT, cybersecurity, blockchain, privacy, cryptography, cloud computing, urban mobility, and other content technologies. Many OASIS standards go on to be ratified by de jure bodies and referenced in international policies and government procurement. www.oasis-open.org

Media Inquiries: communications@oasis-open.org

The post Coalition for Secure AI Releases Extensive Taxonomy for Model Context Protocol Security appeared first on OASIS Open.

Play Video

Watch the full recording on YouTube.

For more details, including the slides,  meeting recording and transcript, please see our wiki 2026-01-22 Keith Jansa and Digital Interoperability and Mutual Recognition – Home – Confluence

https://www.linkedin.com/in/keith-jansa-b4b79a22/

The post ToIP EGWG 2026-01-22 Keith Jansa and Digital Interoperability and Mutual Recognition appeared first on Trust Over IP.

Play Video

Watch the full recording on YouTube.

Status: Verification Pending by Presenter

Please note that ToIP used Google NotebookLM to generate the following content and will update the status to “Verified by Presenter” accordingly.

Google NotebookLM Podcast

https://trustoverip.org/wp-content/uploads/OCME_Pays_Creators_60__Gross_Revenue.m4a

Here is a detailed briefing document reviewing the main themes and most important ideas or facts from the provided source, generated by Google’s NotebookLM:

A 42,000% Growth Spurt: 3 Radical Ideas from a New Creator-Governed Ecosystem

When a digital media ecosystem reports 42,000% year-over-year growth in viewership, it’s time to pay attention. The Open Commercial Media Ecosystem (OCME), a non-profit, members-based organization founded in 2024, is demonstrating a powerful new model for digital content. Its success isn’t just about numbers; it’s a direct response to a core industry problem. In a global creator market estimated at $205 billion in 2024, the relationship between creators and platforms remains fundamentally broken. Platforms exercise unilateral control over monetization, content policies, and account access, treating creators as users to be monetized, not partners to be empowered.

OCME proposes a new blueprint built on the principle of creator governance. We sat down with Executive Director Andy Woodruff’s recent deep-dive to extract the three core principles that make this ecosystem not just successful, but potentially revolutionary.

1. Beyond ‘Users’: Why Governing Your Content is the New Power Play

The first and most fundamental concept OCME introduces is the shift from User-Generated Content (UGC) to Creator-Governed Content (CGC). This isn’t just a change in terminology; it’s a fundamental restructuring of the power dynamics.

In the traditional UGC model:

The platform owns your digital identity. The platform controls all policies, which can change at any time without your input. The platform sets revenue rates to benefit its shareholders, not the community.

In OCME’s CGC model:

The user controls their own identity. Users, as voting members, participate in setting policies. Users set revenue rates through democratic processes to benefit stakeholders—the people creating the value.

This transition moves the creator from a passive participant, subject to the whims of an algorithm or corporate policy change, to an active governor of their own digital space. The philosophical foundation for this shift is captured perfectly in the principle of self-sovereign identity:

A person’s identity that is neither dependent on nor subject to any other power or state.

2. Rewriting the Rules of Revenue: Inside a Radically Fair Financial Model

OCME’s second game-changing idea is a financial model designed for maximum transparency and efficiency, ensuring more value flows directly to creators. Three innovations stand out:

Clear Revenue Share: Creators receive 60% of gross revenue. This is a critical distinction. While platforms like YouTube and Spotify offer seemingly comparable rates, they are calculated from net revenue, after the platform has deducted its own costs. OCME’s top-line split is noticeably higher and far more transparent. Drastically Lower Fees: By using USDC stablecoins for global payments, the ecosystem slashes transaction fees from the 2-4% charged by traditional rails like Stripe or PayPal to mere “pennies.” The impact is substantial: for a creator earning $10,000 a month, avoiding those 2-4% fees means keeping an extra $5,000 a year that would otherwise vanish to middlemen. Eliminating ‘Black Box’ Funds: The presentation highlighted a major problem in the record label industry: “black box funds.” This is where an estimated one billion dollars in unclaimed royalties goes each year, money that labels often simply keep because they don’t know who to pay. OCME solves this by cryptographically linking every piece of content to its creator, ensuring that value can always be traced and paid out to its rightful owner.

These innovations are not isolated perks; they form a holistic financial engine. By combining a higher gross revenue share with radically lower transaction costs and guaranteed attribution, OCME ensures that value created by artists is not just recognized, but captured by them.

3. Pragmatism Over Purity: The Counterintuitive Genius of a Unified Ecosystem

In a world trending toward decentralized, interlocking systems, OCME makes a compelling case for a different approach: a single, unified, and hierarchical ecosystem. Instead of building an “ecosystem of ecosystems”—a flat, or “heterarchical,” structure where separate systems require transition layers and bridges—OCME has built one coherent framework containing different content verticals called “colonies” (e.g., music videos, gaming, news).

In an industry often obsessed with pure decentralization, OCME’s choice of a hierarchical model is a pragmatic masterstroke. It makes a deliberate trade-off, sacrificing architectural heterogeneity for a vastly superior creator experience—one identity, one ecosystem, zero friction. A creator joins the ecosystem once, receives one DID (digital identity), and can participate across any colony. Their identity, credentials, and reputation are seamless and portable throughout the entire system, putting the creator’s experience first.

Conclusion: The Future is Governed by Creators

Together, these three takeaways—creator governance, financial transparency, and a unified architecture—present a cohesive vision for a more equitable and efficient creator economy. This is no longer just a theory. With 600 members having already registered over 6,900 pieces of content, OCME has demonstrated a working, scalable model that is attracting creators at an astonishing rate.

The platform has moved beyond simply giving creators a space to upload content; it’s giving them the tools to build and govern their own digital destiny. This raises a final, exciting question: As creators gain more power to shape their own ecosystems, what new forms of collaboration and content will they build that we can’t even imagine today?

For more details, including the slides,  meeting recording and transcript, please see our wiki 2025-12-11 Andy Woodruff and Using SSI to Champion Creator Governed Content

https://www.linkedin.com/in/andrew-woodruff-72b70075/

The post TOIP EGWG 2025-12-11 Andy Woodruff and Using SSI to Champion Creator Governed Content appeared first on Trust Over IP.

Agentic commerce is steadily rewiring how digital transactions occur. Instead of shoppers manually navigating screens, entering credentials and approving each step, intelligent software agents are beginning to select products, optimise pricing and initiate payment on the user’s behalf.

In that environment, the long-maligned guest checkout flow is gaining fresh relevance—not as a stopgap, but as a structurally efficient payment model.

From friction to fluidity: Why passkeys, biometrics, and magic links are poised to end the password era and increase privacy

As cyber threats intensify and user frustration with passwords seemingly grows, enterprises are turning to passwordless authentication for improvement in both security and customer experience. This shift—led by passkeys, biometrics, and magic links—promises not just stronger defenses but simpler, faster, and more imaginative identity journeys.

1Password started as a macOS app, way back in 2006—and you can still feel that influence in its design. Even though the service now works across all major operating systems, the team still leans into a particular approach. This password manager is streamlined and runs smoothly, but users shouldn’t expect to see behind the veil.

1Password allows you to import passwords via CSV from other password managers. If coming from Bitwarden, you can import more securely through an encrypted .json file. 1Password will also support the FIDO Alliance’s Credential Exchange Protocol (CXP) starting in early 2026, which allows secure transfer of passkeys in addition to passwords between apps and services with CXP enabled.

Project Goals and Motivation

The main goal of this mentorship project, Fabric Private Chaincode and CC-Tools for privacy-sensitive applications, was to explore how a confidential digital asset system with programmable escrow can be built on Hyperledger Fabric, without exposing sensitive transaction details.

The post Robin Weninger joins the Board of Directors of Velocity Network Foundation appeared first on Velocity.

Technology Across the Student Lifecycle: Strategy, Process, and Transformation

On January 15, 2026, EdgeCon Winter, hosted in partnership with Princeton University, convened higher education leaders and technology professionals for an intensive exploration of how technology, data analytics, and artificial intelligence are reshaping institutional operations and the student experience. The conference examined the growing impact of technology across every phase of the student lifecycle, from recruitment and enrollment to retention and career outcomes. Through a thought-provoking keynote panel and comprehensive breakout sessions, attendees explored strategic frameworks, practical implementations, and real-world case studies that demonstrated how institutions can leverage technology to enhance educational experiences, improve operational efficiency, and build long-term institutional resilience.

Combating Fraud in the Digital Age

As institutions increasingly face sophisticated fraud attacks in the admissions process, Thomas Edison State University took decisive action to protect their community and maintain institutional integrity. In Protecting Your Institution From Fraudulent Applications with Identity Verification, Christine Carter, Director Graduate Admissions & Recruitment, Enrollment Technology, and Jeff Butera, Lead Analytics Consultant, Voyatek, shared their comprehensive approach to detecting and preventing admission fraud.

The presentation walked attendees through the institution's decision-making process, from recognizing the scale of the problem to selecting and implementing an identity verification solution. Carter and Butera discussed the practical challenges of preparing internal stakeholders and external constituents for new verification processes, as well as the critical support considerations that ensured a successful launch. Attendees gained insight into major considerations for any fraud detection solution, best practices for managing change across departments, and lessons learned that can help other institutions protect themselves from increasingly sophisticated fraud attempts.

Authentic Storytelling for Enrollment and Engagement

Manor College launched an innovative approach to student recruitment and retention through "The Nest," a dynamic podcast showcasing diverse alumni journeys. In From Blue Jays to Bright Futures: Hatching a Podcast for Enrollment & Engagement, Kelly Peiffer, MA, Vice President of Marketing Communications, and Anthony Machcinski, Director of Marketing, Content and Photography, shared the strategic development and behind-the-scenes execution of this storytelling initiative.

The session went beyond theory to offer a practical roadmap for creating impactful audio content. Peiffer and Machcinski covered the podcast's conceptualization, content strategy for identifying compelling alumni stories, production workflow leveraging campus resources and student involvement, and dissemination planning for maximum reach. They also shared key lessons learned, including unexpected challenges and effective solutions, along with preliminary metrics on prospective student engagement and current student feedback. Attendees gained actionable insights into developing storytelling strategies, engaging alumni as advocates, and utilizing podcasting as an innovative communication tool that strengthens recruitment efforts and cultivates lifelong connections with students.

“I appreciate these events and the Edge team that puts them together. They are always welcome opportunities to connect with colleagues and hear about important and innovative work being done across our institutions.”

– Jeff Berliner
Chief Information Officer
Institute for Advanced Study

Understanding the NSP Difference

Network Service Providers and commercial Internet Service Providers may appear similar, but they are fundamentally different in design, governance, and purpose. In Why NSPs Are Not ISPs: Architecture, Intent, and Outcomes, Christopher Henderson, Senior Network Engineer, drew on years of experience designing and operating large-scale enterprise networks to explain these critical distinctions.

Henderson explored how NSPs like EdgeNet are purpose-built to support teaching, research, healthcare, and public mission in ways that traditional ISPs cannot. The session examined NSP architectures that prioritize resilience, predictability, scalability, and long-term institutional outcomes through high-capacity fiber backbones, optical transport, and packet-based services that enable advanced research workflows and large-scale data movement. Attendees gained insight into why these design choices matter from both operational and strategic standpoints, and why understanding the distinction between NSPs and ISPs leads to better decisions about campus connectivity, digital strategy, and future-ready infrastructure.

AI Implementation Roundtable

Artificial intelligence is fundamentally transforming higher education operations and pedagogy, but implementation challenges vary widely across institutions. Implementing AI in Higher Education - A Roundtable brought together technology and academic leaders to explore current applications, emerging challenges, and future directions. Panelists John Bruggeman, Consulting CISO, CBTS; Chris Treib, CIO, Geneva College; Moe Rahman, Associate Vice President/CIO, Community College of Philadelphia; and Patricia Clay, MBA, Associate Vice President and Chief Information Officer, Hudson County Community College, shared diverse perspectives on AI adoption across different institutional contexts.

The roundtable examined how AI is reshaping teaching through personalized instruction and adaptive learning platforms, supporting faculty with analytics that identify learning gaps, and enabling administrators to employ predictive models for improved retention and resource allocation. The discussion highlighted both the opportunities and the complexities of implementing AI at scale, from policy development and training to measuring impact and managing risk. Participants engaged in an open dialogue about preparing students for an increasingly AI-driven world while maintaining the human elements central to higher education.

“It was a great first experience to have with this organization's conference.”

– Michael La Fountaine
Associate Dean
Seton Hall University

From Spend to Strategy: The Value Partnership

As financial pressure and complexity increase across higher education, institutions are reexamining what "value" truly means from their technology partnerships and investments. The keynote panel, From Spend to Strategy: How Institutions and Tech Partners Deliver Measurable Value in Higher Ed, brought together organizational leaders and technology partners to explore how value is created—or lost—across the technology lifecycle.

The discussion examined how expectations around ROI have evolved, what boards and senior leaders look for when assessing technology investments, and how institutional teams and vendors share responsibility for delivering measurable results. Designed for both executives and practitioners, the panel explored organizational and cultural factors that shape outcomes and practical ways front-line managers and staff can influence success. The conversation emphasized that success today is defined not by deployment alone, but by outcomes in student experience, operational capacity, risk reduction, and long-term institutional resilience.

Building AI-Powered Student Support Systems

Meeting students where they are—anytime, anywhere—is a growing challenge for institutions with limited advising resources. In Advancing Artificial Intelligence to Enhance Education and Learning Outcomes, Paul Wang, Director, Chair, and Professor, Morgan State University, introduced iNavigator, an innovative agentic AI application designed to provide 24/7 student advising and support.

The presentation demonstrated how Wang developed this system using Vertex-AI and Google Gemini models to create agents that provide localized departmental resources not available on general generative AI platforms like ChatGPT. Attendees learned how to develop and apply agentic AI models at their institutions using a Retrieval-Augmented Generation (RAG) pipeline to build Small Language Models that address specific departmental, school, or university needs. Wang emphasized that this approach extends beyond higher education to corporate and organizational applications, and generously made the code available on GitHub for free access to all attendees.

Strategic Alignment Before Technology Implementation

Organizations across higher education continually launch complex, high-stakes initiatives, but many fall short of expectations not because of poor execution, but because leadership teams were never fully aligned on why the initiative mattered. In WHY Before HOW: Aligning Strategic Initiatives to What Actually Matters, Dan Miller, AVP EdgeMarket and Solution Strategy, Edge, introduced Business Value Story, an emerging strategy-to-execution alignment approach.

The framework helps organizations define and quantify the business value an initiative must deliver before determining how it will be implemented. Rather than starting with solutions, structures, or technologies, Business Value Story establishes a shared language of business value, translates strategy into specific and measurable business outcomes, and aligns cross-functional leaders around a common definition of success. Using real-world scenarios from higher education, Miller explored how institutions can reduce misalignment, improve decision-making, and accelerate execution across both technical and non-technical strategic efforts.

Conversational AI for Course Discovery

Complex course catalogs and enrollment data can overwhelm students, faculty, and advisors seeking quick answers to scheduling questions. In Ask the Course Catalog: Building a Grounded, Hallucination-Free AI for Course Discovery, Bharathwaj Vijayakumar, AVP Institutional Data & Analytics, and Jaress Loo, Director, Software Development, Rowan University, showcased Section Tally AI, a conversational agent that transforms how users interact with course information.

The presentation demonstrated how student information system data was modeled into a star schema, combining course catalog details, section schedules, enrollment counts, capacity, and instructor metadata into a unified semantic layer. This preparation allows the agent to reliably answer both lookup questions ("Which sections of college composition 1 are still open?") and aggregate questions ("How many courses are full this term in CS department?"). Vijayakumar and Loo explained how they designed the AI layer to remain grounded in data using few-shot prompting, curated examples, and controlled query patterns that prevent hallucinations. The session concluded with lessons learned, adoption strategies, and guidance for institutions seeking to move beyond static catalogs toward reliable, AI-powered course discovery at scale.

Cybersecurity for Everyone

Cyber risk extends far beyond IT departments—faculty, staff, and student-facing offices routinely face phishing, fraud, and increasingly convincing AI-enabled deception. In Cybersecurity Awareness: A Refresher and Best-Practices for Non-Security Personnel, Demetrios Roubos, Ed.D., M.S., CISSP, Information Security Officer, Stockton University, provided practical, university-relevant guidance designed for non-cybersecurity personnel.

This interactive refresher surveyed today's most common threat patterns and simple habits that prevent most incidents. Topics included spotting phishing and strengthening email security, online safety tips for parents and families, recognizing common scams such as elder fraud and fake job offers, detecting AI-generated content and deepfakes, and everyday protective tools like password managers and VPNs. Participants left with actionable checklists, reporting pathways, and a shared baseline of security behaviors that reduce risk across the university community.

“Best ROI of any conference I attend through the year.”

– Scott Huston
Vice President for Information Technology Services & CIO
Stockton University

Scaling Vendor Risk Management with AI

When 75% of Rowan University's VRM student analysts accepted internships with Lockheed Martin, the institution faced a sudden operational challenge. In VRM AI-Driven Compliance Playbooks: Scaling Vendor Risk Reviews with Human-in-the-Loop Assurance, Lou Belsito, Manager, Information Security Risk Management, and Mahmudul Siddiquee, Enterprise Application Architect, Software Development, shared how this challenge inspired the creation of the VRM AI-Driven Compliance Program.

At the heart of this solution is the VRM Unified Compliance Repository, a dynamic catalog of regulations, policies, standards, and procedures. Using AI, the team compares ServiceNow ticket data against this repository to generate customized Due-Diligence Intelligence Playbooks for each technology request. Each playbook includes an initial inherent risk assessment and step-by-step guidance for both student analysts and senior security managers, ensuring consistency and surfacing nuanced requirements often missed in manual workflows. This innovation enabled analysts to work asynchronously without supervision while senior managers could quickly validate outputs, transforming a bottleneck into a streamlined, repeatable process.

“The topics were very relevant. Thank you.”

– Charles Wachira
Sr. Director, Teaching & Learning
Johns Hopkins Carey Business School

Business Intelligence for Student Success

Data transparency and literacy can be catalysts for cultural transformation. In From Insight to Impact: How Business Intelligence Transforms Student Success, Moe Rahman, Associate Vice President/CIO, and Vishal Shah, Dean, Math Science & Health Careers, Community College of Philadelphia, explored their institution's successful data-driven evolution within an academic division.

Building on the high-level architecture and strategic deployment methods presented at EdgeCon Autumn 2025, this session offered a real-world use case showcasing the tangible impact of business intelligence solutions on student success. Rahman and Shah jointly presented how they confronted significant demographic shifts by leveraging data transparency to drive measurable improvements in enrollment and retention through faculty empowerment, robust interdepartmental collaboration, student-centric practices, and a strong culture of accountability. The presentation highlighted the alignment and intersections between academic and technology strategies, demonstrating that sustainable cultural change is achievable when institutions commit to putting student outcomes at the center of every decision.

The Challenge of AI Transparency

As higher education institutions adopt AI for financial aid decisions, scholarship allocation, admissions, and advising, a critical question emerges: Can anyone actually explain how these systems make decisions? In The AI Explainability Problem: Why Transparency Is Harder Than You Think, Erica Attoe, Graduate Fellow, Schaefer Center for Public Policy, University of Baltimore, examined this challenge head-on.

Drawing from systematic analysis of over 5,500 academic articles, Attoe shared emerging consensus from scholarship: 71% of research frames explainability as an enabler of AI adoption, not a barrier. Yet despite this consensus, achieving transparency remains an open question. The presentation provided a plain-language walkthrough of current explainability tools like SHAP and LIME, and emerging approaches like blockchain audit trails. Attoe highlighted what she called the "Alice in Wonderland problem": explainability models themselves require explanation, often just shifting complexity rather than resolving it. Attendees left with a realistic understanding of the explainability landscape, what questions to ask vendors, and why this remains an unsolved problem with real consequences for students.

Transforming Academic Operations

As colleges navigate increasing complexity in scheduling, curriculum management, and student support, building an integrated Academic Operations structure has become essential. In Success by Design: Transforming Academic Operations at MCCC, Adelina Marini, Assistant Director of Academic Operations, and Dr. James H. Whitney III, Associate Provost, Mercer County Community College, explored how their institution strategically combined multiple administrative and academic support units into one cohesive department.

The presentation highlighted how the team leveraged Coursedog to streamline scheduling, improve data accuracy, and enhance cross-departmental collaboration, ultimately reducing barriers for students. Marini and Whitney discussed the development of a unified mission rooted in access, efficiency, and student-centered decision-making, as well as the cultural and structural shifts required to bring diverse units together under a shared purpose. Participants left with practical strategies for designing an Academic Operations model that strengthens institutional effectiveness and meaningfully supports student success.

Thank you VIP Sponsors Thank you Exhibitor Sponsors

Abnormal

Anthology

Blackboard

CBTS

Checkpoint

Coursedog

datto - Vancord

eplus

Form Assembly

Ivy Ocelot Gravyty

NetApp

Nokia

Paloalto

PKA

Purestorage

Ring Central

Sailpoint

SHI

Softdocs

Velocity Tech

Voyatek

Watermark

Thank you Lanyard Sponsor

The post EdgeCon Winter 2026 appeared first on Edge, the Nation's Nonprofit Technology Consortium.

The post Glen Cathey is re-elected to third term on the Board of Directors of Velocity Network Foundation appeared first on Velocity.

As passkeys move rapidly from a promising new technology to the clear industry standard for simple and secure authentication, the passkey ecosystem continues to evolve. Read about six new capabilities implementers should know about.

Read the Article

Corporate Overview

MIXI, Inc. (hereafter MIXI) is one of Japan’s leading internet companies, best known for its popular mobile game MONSTER STRIKE, among other entertainment services, with tens of millions of users. The company has also expanded into sports and lifestyle businesses, providing services that enrich the daily lives of a broad range of generations.

The company’s MIXI ID serves as a common account platform enabling users to access multiple services seamlessly. In recent years, it has also been adopted by flagship titles, continuing to grow its user base.

The Business Challenge

From the outset, MIXI ID pursued a passwordless approach, adopting an email-based one-time password (OTP) method. However, this proved insufficient against the rising threat of real-time phishing attacks, while the flow of opening an email app, retrieving a code, and entering it was cumbersome for users. For services that involve payment functions in particular, there was a strong need for a mechanism that could deliver both high authentication strength and excellent user experience.

Internally, the company also faced the challenge of balancing enhanced security with operational efficiency, while accommodating shared PC usage and continuously evolving OS environments.

Decision to deploy Passkeys

To address these challenges, MIXI introduced FIDO2-compliant passkey authentication to MIXI ID in 2024. Leveraging the WebAuthn API offered by web applications and browsers, users can now log in smoothly and password-free using the biometric authentication built into their smartphones and PCs.

In addition, passkey authentication was made mandatory for administrative tools in the payment system, enabling stronger security operations without reliance on passwords.

MIXI also advanced its internal enterprise security environment by adopting YubiOn Portal, provided by SoftGiken (a FIDO Alliance member), together with YubiKey from Yubico (a FIDO Alliance board member). This strengthened physical security for shared PCs and logon authentication, creating a unified, cloud-managed two-factor authentication environment for both Windows and macOS. As a result, MIXI achieved both stronger authentication for shared terminal logons and greater operational efficiency.

Why FIDO was chosen

While the company also utilizes Apple and Google social logins, there were clear reasons for adopting FIDO authentication as one of its primary methods:

Trust in security and interoperability based on international standards Smooth and practical user experience enabled by platform-provided Passkey Autofill Strong security with biometrics combined with the convenience of passwordless login Impact of adoption

Currently, more than 25% of MIXI ID users have registered a passkey, and adoption is steadily expanding. Helpdesk enquiries caused by issues with OTPs —such as “delays/resending of authentication codes” and “input errors”—have decreased, helping to reduce support costs.

For users, the experience of being able to log in safely and quickly is spreading, further reinforcing trust in MIXI’s authentication infrastructure.

Within the enterprise environment, the introduction of YubiOn Portal enabled a shift from ledger-based authentication management to cloud-based management, ensuring real-time visibility into the latest authentication status. It also supports Windows Remote Desktop usage and has been highly praised by employees.

Overcoming Implementation Challenges

In some early deployments at other companies, confusing error messages such as “Passkey not found” created user difficulties. MIXI avoided this issue by timing its rollout to coincide with the point at which Passkey Autofill had become sufficiently mature across major OS platforms, successfully preventing user confusion.

The adoption of YubiOn Portal required detailed policy settings, but thanks to extensive documentation and f lexible configuration features, the IT team was able to implement and operate the system smoothly.

Looking ahead

MIXI expects passkey authentication to become widely adopted across services and evolve from its current optional status into a primary authentication method. The company intends to expand its use across more service areas, contributing to the realization of a passwordless society.

Finally, Ryo Ito of MIXI, who shared insights for this case study, commented:

“FIDO authentication delivers strong phishing resistance and high security, but there are still challenges such as account recovery from environments where passkeys are unavailable. It’s important to correctly recognize these issues and refer to the FIDO Alliance’s published design and implementation guidelines and checklists when adopting FIDO authentication.

As passkey authentication becomes more widespread, we are already seeing its positive impact with MIXI ID. FIDO/Passkeys are a rare technology that can simultaneously provide excellent UX and robust security at low cost. Going forward, we look forward to the evolution of the ecosystem to support an even wider variety of use cases.”

Read the Case Study

We are happy to announce a new support program to help small businesses and organisations streamline and strengthen their compliance with evolving EU data regulations.  Through a new collaboration with […]

January 2026

DIF Website | DIF Mailing Lists | Meeting Recording Archive

Table of contents Decentralized Identity Foundation News Working Group Updates Special Interest Group Updates User Group Updates Upcoming Events Get involved! Join DIF 🚀 Decentralized Identity Foundation News

Are you in APAC? For the first quarter of 2026, DIF's new Executive Director, Grace Rachmany, will be in the Singapore area. It's an opportunity for us at DIF to get to know (and possible add) members in this part of the world. Grace is actively looking to meet our members and attend events in the area, so please reach out. Of special interest: content people (think Bollywood and KPOP) and Agentic AI, as well as anyone using DIDcomm.

Membership: Goodbye Office Hours, Hello Hot Takes!

The DIF Office Hours have trailed off, with no attendees having questions for the staff. You may be thinking: "but I still want the chance to meet new cool members of DIF!" We've got you covered. Starting in February, we will be introducing a series where we'll combine updates from the field with networking. This month SC members will be participating in MOSIP Connect and in DID Unconference Africa, and reporting back to us in the following format: 10 minutes from 2 participants on their takeaways from the conference, 10 minutes of back-and forth (hopefully they don't agree on everything), and then half an hour for you to share your hot takes.

February 17, 9 am UTC: MOSIP Hot Takes with Markus & Juan. Live call: find it on the DIF Calendar. March: DID Unconference Africa Hot Takes with Eric & Gideon (Time to be announced in the February newsletter!) 🛠️ Working Group Updates

Browse our working groups here

Creator Assertions Working Group

CAWG crowned 2025 with the approval of the CAWG Identity Assertation specification v1.2, which received Steering Committee approval. The WG also drafted a User Experience Guidance document which was approved in its most recent meeting. Trust Registries are an upcoming topic of discussion, with Darrell O'Donnell scheduled to present Ayra's Trust Registry Query Protocol (TRQP) in the coming weeks. The TOIP group exploring interoperability of digital identity containers is disbanding, and has offered to see if CAWG would be interested in adopting their X.509 - Verifiable Credentials Interoperability Draft specification.In the coming weeks, three additional taskforce workstreams will be launching for General Purpose VCs, ACDC VLEIs and Relationship Matrix VLEIs.

👉 Learn more and get involved

Hospitality and Travel Working Group

The Hospitality and Travel Working Group will be issuing a survey of different types of hospitality, travel, and entertainment providers to understand their identity needs. The data will be collected using Google surveys under the DIF domain with a DIF working group email. The 2FA requirements on Google made everyone involved wish that Google would implement more decentralized authentication protocols for multi-user accounts.

The WG is working on an article for Phocuswright, and a schema that is planned for draft review by February 1. The WG has been engaging in deeper discussions on details of the schema given the complexity and variation in the kinds of information they expect to collect.
👉 Learn more and get involved

Trusted AI Agents Working Group

The Trusted AI Agents Working Group is launching a Delegatable Authorization Task Force, and have begun by creating a content outline to define the output of a report that will be created by the Task Force. Quite a bit of analysis, prior art, and academic work has already been collected by members of the WG and the document will get a jumpstart based on collating those free-form conversations into a grounding overview. More hands-on work prototyping the targeted use-cases is also starting to get underway, using existing protocols and frameworks.

👉 Learn more and get involved

DID Methods Working Group

The DID Methods Working Group meeting focused on reviewing the status of various DID methods and their progress through the recommendation process. Currently, 11 DID methods are at different stages of approval, but only 2 are in active review, so other DID method champions are welcome to schedule "deep dives" and parallelize the review. On slow weeks, time is balanced between issue review (on the process itself) and the open PRs for active-review methods under onboing participation.

👉 Learn more and get involved

Identifiers and Discovery Working Group

The Identifiers and Discovery Working Group enjoyed the holidays.

👉 Learn more and get involved

🪪 Claims & Credentials Working Group

The Claims and Credentials WG has been taking a deep-dive into creating a "dogfooding" implementation, issuing DIF membership credentials. The group is considering the FPP approach and the Verifiable Community approach. The incoming ED clarified that the working groups should be the authorities on active membership credentials, rather than centralizing power through the centralized authority of the ED, who doesn't have a real sense of how to assess active contributors. The group also discussed concerns expressed by international participants around going to conferences in the United States, due to evolving entry requirements.

👉 Learn more and get involved

Applied Crypto Working Group

The BBS+ Work Item of the Applied Crypto WG discussed the progress of an advanced, yet little-known method called did:webplus, which is being finalized to incorporate both Blake and SHA-3 keys and signatures (on verified updates). The current draft RFC for BBS+ signatures at CFRG WG at IETF, has been reviewed and discussed by the WG chairs.

👉 Learn more and get involved

DIDComm User Group

The DIDComm User Group hosted a presentation by Entidad CTO Jorge Flores, demoing a working implmentation of DIDcomm for a decentralized fintech platform, using DIDcomm for group chat and private messaging between their web and mobile Unmio clients. DIF is actively looking for more DIDcomm implementations we can demonstrate to show the viability of DIDcomm and it's place in the wider landscape of international standards, so please reach out to the chairs if you have a demoable project at any stage of development.

👉 Learn more and get involved

If you are interested in participating in any of the Working Groups highlighted above, or any of DIF's other Working Groups, please click join DIF.

🌎 DIF Special Interest Group Updates

With the holidays this was a slow month. We'll update on the SIGs in February. Browse our special interest groups here

DIF Hospitality & Travel SIG DIF China SIG

👉 Learn more and get involved

APAC/ASEAN Discussion Group

👉 Learn more and get involved

DIF Africa SIG

👉 Learn more and get involved

DIF Japan SIG

👉 Learn more and get involved

DIF Korea SIG

👉 Learn more and get involved

📖 DIF User Group Updates
DIDComm User Group

👉 Learn more and get involved

Veramo User Group

👉 Learn more and get involved

📢 Upcoming Events

Will you be attending any upcoming Identity events? Let us know so other DIF members can find you!

MOSIP Connect 11-13 February, 2026 (Morocco)

Two day agenda and one-day unconference for the MOSIP community. Expect to see Steering Committee member Markus Sabadello (DanubeTech) and DIF staffer Juan Caballero participating on-stage at the Conference, as well as in the daylong Unconference facilitated by DIF member Kaliya Young. February 17th Markus and Juan will be giving their Hot Takes on MOSIP. See the DIF calendar for details.

DID Unconference Africa 24-26 February, 2026 (South Africa)

DID:UNCONF AFRICA brings together local and international innovators, leaders, and activists to reshape the future of digital identity. This event fosters innovation, collaboration, and interoperability, making a significant impact on the inclusive development of digital identity in Africa. For the second year running, DIF will be sponsoring the event. Expect to see Steering Committee Member and CAWG Co-chair Eric Scouten in attendance. Eric and Africa SIG Chair Gideon Lobard will be giving us their Hot Takes in March. Watch the February newsletter and DIF calendar for exact time and date.

ITB Berlin, 3-5 March, 2026 (Berlin)

DIF Member Alex Bainbridge (Autoura) will be speaking about identity at the world's largest travel conference.

IETF 125 Shenzhen, 14-20 March, 2026 (Shenzhen)

Our new Executive Director, Grace Rachmany, will be attending IETF125 this year in APAC.

Internet Identity Workshop IIWXLII #42

📅 April 28–30, 2026
📍 Mountain View, CA
Registration and details

Agentic Internet Workshop #2

📅 May 1, 2026
📍 Mountain View, CA
Learn more

Identiverse 2026

📅 June 15–18, 2026
📍 Las Vegas, NV
Conference details

Identity Week Europe 2026

📅 June 9–10, 2026
📍 Amsterdam
Event information

Call for Co-organizers: GDC 2026

The 2026 Global Digital Collaboration Conference has been announced for September 1-2, 2026, in Geneva. Entities who wish to participate as co-organizers to co-create the agenda can apply here.

Authenticate Conference 2026

📅 October 19–21, 2026
📍 Carlsbad, CA
Details coming soon

🗓️ ️DIF Members

📻 DIF Labs Co-Chair Daniel Thompson-Yvetot gave a great overview of the new EU Cyber Resilience Act and how much of a burden it is or isn't for various types of software manufacturers on an episode of the Open Source Security podcast.

👉Are you a DIF member with news to share? Email us at communication@identity.foundation with details.

🆔 Join DIF!

If you would like to get in touch with us or become a member of the DIF community, please visit our website. DIF membership is free for individuals and companies with up to 1000 employees.

To get updates about DIF, follow our channels:

Follow us on Twitter/X

Join us on GitHub

Subscribe on YouTube

🔍

Read the DIF blog

1. What is the mission and vision of Dabadu.ai?

Digital identity will transform the global economy by enabling instant verification, reducing friction, strengthening fraud prevention, and supporting cross-border trust. In Canada, this transformation is particularly important given the country’s leadership in privacy protection, interoperability, and standards-based frameworks.

Dabadu embeds digital identity directly into dealership and lender workflows rather than treating it as a separate step. Our ID Verification and TrustShield services operate within the sales and finance process, helping ensure every transaction meets lender-grade compliance requirements while safeguarding consumer data. By integrating identity, compliance, and workflow automation, we help automotive organizations reduce risk, eliminate manual verification, and scale digital operations with confidence.

2. Why is trustworthy digital identity critical for existing and emerging markets?

Trustworthy digital identity is a cornerstone of any digital economy. It enables organizations to confidently verify who they are interacting with, reduces fraud, and builds consumer confidence in digital transactions.

In industries like automotive retail and financing, where high-value transactions, sensitive personal data, and regulatory obligations intersect identity assurance is not optional. Without trusted digital identity, digital transformation cannot scale safely or sustainably. At Dabadu, we view identity as foundational infrastructure: the connective layer that enables secure, compliant, and efficient digital experiences across the entire customer journey.

3. How will digital identity transform the Canadian and global economy? How does your organization address challenges associated with this transformation?

Digital identity will transform the global economy by enabling instant verification, reducing friction, strengthening fraud prevention, and supporting cross-border trust. In Canada, this transformation is particularly important given the country’s leadership in privacy protection, interoperability, and standards-based frameworks.

Dabadu embeds digital identity directly into dealership and lender workflows rather than treating it as a separate step. Our ID Verification and TrustShield services operate within the sales and finance process, helping ensure every transaction meets lender-grade compliance requirements while safeguarding consumer data. By integrating identity, compliance, and workflow automation, we help automotive organizations reduce risk, eliminate manual verification, and scale digital operations with confidence.

4. What role does Canada have to play as a leader in this space?

Canada is uniquely positioned to lead globally in digital trust by demonstrating how innovation can coexist with strong privacy protections, transparency, and user control. Through initiatives like the Pan-Canadian Trust Framework and the leadership of DIACC, Canada is establishing a practical, interoperable model for digital identity.

As a Canadian company, Dabadu is committed to advancing this leadership by translating these principles into real-world industry adoption. We embed trust, privacy, and compliance directly into automotive workflows, ensuring that digital identity is not theoretical but operational, measurable, and impactful.

5. Why did your organization join the DIACC?

We joined DIACC because we share a common vision: a Canada where digital interactions are secure, privacy-preserving, and trusted by design. DIACC’s collaborative approach bringing together government, industry, and innovators is essential to building a resilient digital identity ecosystem.

For Dabadu, membership represents both a responsibility and an opportunity: to align our technology with nationally recognized trust frameworks, to contribute industry insight from the automotive sector, and to help accelerate adoption of trusted digital identity across high-impact commercial use cases.

6. What else should we know about your organization?

Dabadu.ai is an automotive technology ecosystem that unifies CRM, digital retailing, identity verification, and lender connectivity within a single platform. By reducing reliance on fragmented systems, Dabadu enables dealerships and lenders to operate from a shared, trusted source of data from lead intake and identity assurance through credit submission and funding.

Our platform is designed to ensure that every step of the customer journey is secure, compliant, and data-driven. With built-in identity verification, fraud prevention, and lender integrations, Dabadu is helping modernize automotive retail through a privacy-first, trust-centric approach. As a DIACC member, we are proud to contribute to Canada’s leadership in practical, interoperable digital identity adoption.

Quote from Pulkit Arora, Founder & CEO, Dabadu.ai

“You can’t build trust on disconnected systems. We built Dabadu to unify identity, compliance, and credit into a single trusted automotive ecosystem, one that works for businesses, lenders, and consumers alike.”

The post Mark Baglia joins the Board of Directors of Velocity Network Foundation appeared first on Velocity.

We all know the importance of empowering people with their data. And the benefits that come from that. That’s why we support the MyData organisation, declaration and principles. We also […]

As we move into 2026, one thing stands out about the year that just closed. 2025 was the year when we could no longer pretend that good principles alone would […]

The post Joan Beets joins the Board of Directors of Velocity Network Foundation appeared first on Velocity.

The Passwordless Imperative

For decades, passwords have been the default mechanism for securing digital access. They are deeply embedded in enterprise systems and workflows, yet they were never designed to withstand today’s threat landscape.

Passwords are easy to steal, easy to reuse, and costly to manage at scale. Despite years of awareness training and layered defenses, credential-based attacks remain one of the most common causes of security breaches. At the same time, password resets continue to consume a disproportionate share of IT support resources, slowing productivity across the organization.

With their fiddly and indirect nature, one-time passwords (OTPs) are a curse of modern life. They’re a security risk and outdated. Frustrated, a maker has built a physical security key that’s compliant with FIDO2.

Bitwarden’s latest round of product updates reads less like a feature dump and more like a quiet assertion that identity security is finally maturing into something operational, measurable, and—crucially—fixable. Long positioned as an open, zero-knowledge alternative in the password manager market, Bitwarden is now pushing beyond storage and toward decision-making: seeing credential risk clearly, prioritizing it intelligently, and nudging humans toward action without turning security into another productivity tax. That shift matters. Credential abuse remains the front door for most breaches, yet remediation still drags, stalled by poor visibility and employee friction. Bitwarden Access Intelligence, now generally available, tackles that gap head-on by mapping weak, reused, or exposed credentials directly to business-critical applications, then guiding users through the correct update flows. Nine days to fix a known credential issue is an eternity in attacker time; collapsing that window is less glamorous than AI SOC slogans, but far more consequential. Even at the individual level, vault health alerts and password coaching quietly reinforce better hygiene where it actually happens—inside browsers and apps—addressing the stubborn reality that awareness alone doesn’t stop reuse, especially among younger users who already know the risks but still fall back on convenience. We’ve all been there, honestly.

The post Kymberly Lavigne-Hinkley joins the Board of Directors of Velocity Network Foundation appeared first on Velocity.

Once again, great minds at Signal strike at the heart of impending catastrophic collapse of privacy.

I love this talk from the 39th Chaos Communication Congress (December 2025) by Meredith Whittaker and Udbhav Tiwari so much. Here are my favorite things:

It highlights the “down the stack” progression of unavoidable surveillance functionality into OS and hardware. The closer to the metal, the greater the data purview and potential risk. Meaning, surveillance at the hardware layer is able to surveil all users that use the device, as well as all of the things those users do on the machine. This is why governance needs to apply different duties onto different types of digital products and components. I also really like how Whittaker dives into what it is to be an “agent”, and agentic AI’s insatiable need for context. If the task scope is narrow, the context is narrow, but in the world of “robot butlers”, as Whittaker calls them, the context is broad, thus requiring “everything about me” in order to perform a wide variety of tasks. Herein lies the need for unfettered surveillance. It’s staggering that we might consider ceding “everything about me” to commercial tech makers who have <checks notes> never acted in a trustworthy fashion and never will so long as digital product safety remains unregulated. Capitalism favors the manufacturer and exploits natural resources and humans, as both customers and laborers. We could and perhaps should rename “AI” to “amplified intensity” of digital product safety risks to humans, because it does so with alarming alacrity. In my Enigma talk last year, I described it as pouring gasoline on a privacy dumpster fire. This CCC talk concretizes just a few of the risks, with a special focus on the even more amplifying risk effect of the Model Context Protocol (MCP)—i.e. the lingua franca (or maybe more accurately, lingua francas[1]) for AI agents to talk to each other. I’m reminded of that old Faberge Organics shampoo commercial. What could possibly go wrong with unending autonomous communication between unknown third parties?

They highlight prompt injection attacks, noting that MCP “standardizes the exfiltration path for attackers.” Nifty.

Whittaker clarifies the difference between deterministic software and probabilistic software, demonstrated in her explanation of the “The Mathematics of Failure”. When each step in a technology process chain behaves at even 95% accuracy, the down-stream 30-step outcome result is not 95% overall accuracy but a horrifying 21.4% likelihood of success (remember multiplying fractions?). Nearly every agentic task that will be created so we can enjoy our “robot butlers” will have at least thirty steps. Who on earth would back a product with such a poor accuracy outlook? Which leads us to the overinvestment/AI-hype situation we find ourselves in. With trillions upon trillions of dollars being invested into this technology (because apparently we’re too feeble to actually do Things; or we’re so amazing that our time needs to be spent on perfuming the world with our own special brand of greatness, pick your poison), there is literally no break-even point on the horizon. Once again, the Amplifying Intensity and impact of AI: too big to fail on steroids. They emphasize that there is not an obvious root fix, but they offer three “band-aids”: Stop reckless deployment. (I cannot believe we’re still in the move fast and break things epoch. Capitalism knows no shame.) Privacy by default. They phrase it as inverting the permission model from opt-out to opt-in [to surveillance]. Unfortunately, we have reified opt-out in law (CPRA, I’m looking at you). They’re right, of course. At Internet Safety Labs (ISL) we have made privacy by default a core principle for a digital product to be regarded as “safe”. Transparency. In the talk, they’re mainly focused on transparency of agent behavior, and once again, of course that’s necessary. Heck, our entire mission is built on the premise that transparency drives safer technology and manufacturer accountability. But I have two concerns about this particular transparency: (1) we know quite a lot about transparency at ISL (given our production of safety labels https://appmicroscope.org), and it seems that we might be careening inexorably towards a transparency deluge, the likes of which will make current privacy policies seem like, well, AI generated summaries. (2) Transparency isn’t going to be overly helpful in a world of unbounded, probabilistically behaving software agents.

When it comes to software: Complexity + Time + Probabilistic Behavior = Increasingly unknowable, unpredictable, chaos

We heard Facebook engineers admit five years ago that data flow was already unknowable for them—it was deterministic, but it wasn’t a closed system, ergo, unpredictable.

Which isn’t to say these band-aids aren’t valuable. They are. And there are other things we could do if we were serious about privacy, such as ban the selling or sharing for consideration of personally identifiable information. A person can dream.

Meanwhile, I count the world lucky to have people like Meredith and Udbhav calling out “AI” truths in a powerful, accurate, and highly understandable way.

[1] Francae? Plural. Because there is no world where a single one wins out. I hope.

The post AI Agent, AI Spy – Signal Talk from the 39th Chaos Communication Congress appeared first on Internet Safety Labs.

The post Colin Strasburg joins the Board of Directors of Velocity Network Foundation appeared first on Velocity.

In this episode, Reid Jackson and Liz Sertl sit down with Bob Czechowicz and Nick Latwis from the GS1 US Innovation Team. They discuss the most promising trends, the challenges businesses face when navigating new tech, and the critical role of pilots in testing the viability of these innovations. Gain actionable insights into how companies can successfully experiment with new technologies and drive meaningful change in their supply chains.

In this episode, you'll learn:

Key emerging technologies in supply chains

How to use AI as a creative partner for innovation

The indicators teams use to decide when a pilot is ready to scale

Things to listen for: (00:00) Introducing Next Level Supply Chain (02:54) Emerging technologies in the next three to five years (06:48) Using data to decide which trends matter (16:00) How to design and conduct a pilot test (19:52) Determining market readiness for new technology (27:38) Nick & Bob's favorite tech

Connect with GS1 US: Our website - www.gs1us.orgGS1 US on LinkedIn Register now for this year's GS1 Connect and get an early bird discount of 10% when you register by March 31 at connect.gs1us.org.

Connect with the guests: Nick Latwis on LinkedInBob Czechowicz on LinkedIn

What happened at Blockchain Commons in 2025? It turned out to be a very busy year, with us advancing several totally new technologies, as well as continuing on with some of our biggest ongoing priorities.

Following is the year in review!

You may also wish to view our 2026 Technology Overview, which briefly describes 21 of our technologies and reference apps:

Community Support

As we wrote in 2024, our goal is “the creation of open, interoperable, secure & compassionate digital infrastructure”, but we can’t do that on our own.

That’s why Gordian Developer meetings are an important part of our regular schedule. They offer us the opportunity to talk with the community, discover its priorities, and adjust our own work to fit those needs.

We’re even more thrilled when community members begin actively supporting and expanding our technologies, and we saw a lot of that in 2025. That community work included Typescript libraries for our full stack, a UR Playground, and a full IDE for Blockchain Commons. Thanks, folks, we love working with you!

For more, see our Meetings developer page and subscribe to our Gordian Developer announcements, either through our mailing list or Signal group.

ZeWIF

Early in the year, we also became involved with a totally new community: the Zcash developers community. Based on a Zcash Community Grant, we designed and developed ZeWIF, an interchange format for Zcash wallets.

This sort of interoperability is very important to Blockchain Commons, because it ensures the independence of users and the openness of the ecosystem, and those are both Gordian Principles.

But, we were particularly thrilled by our work with ZeWIF because it allowed us to work with a new digital-asset ecosystem. Traditionally, Blockchain Commons has been focused on Bitcoin, but we’re well aware that there are lots of other digital assets that could make good use of our specifications, and so we were happy to begin this expansion of our work.

The idea of supporting other digital-asset ecosystems has already continued into 2026, when our first Gordian Developer meeting of the year included discussion of how to expand Known Values to better support assets other than Bitcoin. (We’re also hoping to continue work with the Zcash community, which we met while working on ZeWIF, to help them integrate other Blockchain Commons specifications.)

For more, see our ZeWIF developer page.

FROST

Our biggest and most important work of the year was probably with FROST, a threshold signing system built on Schnorr signatures.

This year, we moved our FROST work from its supportive role of 2023-2024, which saw our hosting a variety of FROST meetings, to a more hands-on approach, which allowed us to produce some capstone work on the topic, including software expansions, demos, and a whole (short) course.

That work focused on ZF FROST, a FROST library and CLI created by the Zcash community. We wanted to show its general applicability, which we did in a number of ways.

First, we held a pair of meetings to demonstrate those wider capabilities. We showed that it can be used for more than just Zcash by using it to sign Bitcoin transactions (meeting links). Then, we showed how signing can be done using one of our new technologies, Hubert, even when a reliable network doesn’t exist (meeting links).

We also put together a short course that introduces FROST and demonstrates how it works with hands-on examples: it’s called “Learning FROST from the Command Line” and is a parallel to our (out-of-date but popular) “Learning Bitcoin from the Command Line” course.

Finally, we built a number of tools to support ZF FROST and its various capabilities, all of which are documented in the “Learning FROST” course. That includes a standalone app, the frost-verify tool, which can verify FROST signatures (as long as everything matches the format used by ZF FROST).

Thank you as ever to HRF, who has supported all of our FROST work. We hope we’ve been able to create a strong library of work to help people understand and utilize FROST.

For more see our FROST developer page, which has links to that library of work.

Gordian Clubs

Onward to new technologies, which we hope will allow Blockchain Commons to continue its innovation into 2026 and beyond …

The first tech that Blockchain Commons premiered in 2026 was the Gordian Club, which is an autonomous cryptographic object (ACO). That means it’s self-contained, with access determined by mathematical means. The protected and self-contained ACO envelope is then a carrier of information, whether that be identity details, a credential, news, or information about a gathering.

Because it’s autonomous, the Gordian Club doesn’t require infrastructure. If the ‘net is down due to a disaster, or if you are being censored, you can still use a Gordian Club to transmit information. And that’s really the point: to preserve agency when infrastructure fails.

We’ve written a Musings on Gordian Clubs, released a CLI and a Rust library, and demoed how it worked at our October Gordian meeting.

For more see our Gordian Clubs developer page.

Hubert

So how do you transmit a Club (or other data) when there’s no reliable infrastructure? There are lots of solutions. You could use Bluetooth. You could give someone an NFC token or a thumb drive. You could even publish a QR code in a newspaper. But we often need solutions that allow much faster back and forth and that can be automated. That’s where our next technological advance of 2026 comes in: Hubert, the Dead-Drop Hub.

Hubert takes advantage of existing distributed storage systems (BitTorrent, IPFS), combined with Gordian Envelope features including GSTP, to allow secure and private communication that can’t be censored or spied upon by a centralized server.

We’ve produced a CLI for using Hubert (demo) as well as a CLI specifically for conducting FROST ceremonies with Hubert (demo). Check out our BCR research paper for more on the system!

For more, see our Hubert developer page.

Provenance Marks

Provenance Marks are a concept that Blockchain Commons Lead Researcher Wolf McNally has been playing with for a few years, but brought to Blockchain Commons at the start of 2025.

A provenance mark is a forward-commitment hash chain, which means that each mark uses a cryptographic hash to commit to the next publication that will bear that provenance mark. When the key corresponding to the hash is used in that next publication, you know that it is the authentic and authorized next link in the chain. This is all done without a blockchain or other external reference, ensuring the independence of the publication.

Provenance marks are useful because they can prove the authenticity of a sequence of works. You want to know art is all by a specific artist? That writings or newsletters are all from a specific creator or group? A providence mark can verify that, providing truth in a world of AI and deepfakes.

Provenance marks can also be used with Gordian Clubs. Clubs have a mechanism allowing for updates of their information over time. Provenance marks tell you that the updates were from the original author (or some designated party).

We’ve produced a CLI for provenance marks and gave a presentation. Also see our research paper.

For more, see our provenance mark developer page.

XID

We actually introduced XIDs in December 2024, but we were able to better feature the new technology in 2025. A XID is, quite simply, an “extensible identifier”. It’s a specific format for documenting a stable decentralized identifier that can be self-sovereign.

We felt there was a need for XIDs in part because of the failure of the self-sovereign identity community but also because we wanted to offer the foundation for a decentralized digital identity that had redaction capabilities. That comes courtesy of Gordian Envelope. You can fill a XID Document with identity information, but then you can chose who gets to see specific details by using Envelope’s elision capabilities

We demoed XIDs last year, just before we released our research paper. This year, we added considerable XID functionality to our envelope-cli tool. Just type “envelope xid -h” for a list of options. We’ve also been working on and off on a XID Quickstart, which includes overviews of much of our technology and tutorials for XID, but it’s still in process. (Fundamentally, we haven’t been able to give it much priority due to the lack of a sponsor for XIDs. If you think XIDs might be a great fit for your company, talk to us about a partnership that would allow us to prioritize the work!)

For more see our XID developer page.

Revisiting SSI

Finally, Blockchain Commons kicked off a new initiative at the end of 2025, one that represented a long-term interest: Revisiting SSI.

We’ve been involved with self-sovereign identity (SSI) from the start. Christopher Allen choose and popularized the term in his 2016 article, “The Path to Self-Sovereign Identity”, then he shepherded its growth through his Rebooting the Web of Trust workshops.

Blockchain Commons has never had a sponsor to support our self-sovereign identity work, but we’ve nonetheless increasingly dabbled in it in recent years. Besides our work with XIDs, Christopher also gave interviews to SSI Podcast and HackerNoon last year and presented to Switzerland on Swiss e-ID and at TabConf 7. A lot of that included advocacy for better self-sovereign identity, which also led to Blockchain Commons signing the No Phone Home initiative. Finally, Christopher wrote some related Musings last year, on Fair Witnessing, on topics related to GDC25, and on the anchors for preserving sovereignty and autonomy that we suggested to Switzerland.

Our new Revisiting SSI project will be even more expansive than all of that 2025 work. The goal is to look at the principles that Christopher laid out in his 2016 article, and to see what’s worked, what hasn’t, and how we can redefine them to best evolve SSI over the next decade. The first meetings were held on December 2 & 9, and we’re continuing that work through 2026, which is the 10th anniversary of SSI.

For more see the Revisiting SSI website.

What’s Next?

We can’t imagine that we’ll have nearly as much new technology in 2026: though we laid solid foundations for our newest initiatives last year, now we need to help engineers turn them into reality! (If you’re interested in any of our new techs, please let us know.)

Beyond that, we have a number of other topics that we expect to continue into the new year:

The heart of our Revisiting SSI workshopping will occur from January through April, leading up to the 10th anniversary on April 26. Afterward, we hope to generate some papers, much as was done at Christopher’s Rebooting the Web of Trust workshops. The XID Quickstart will likely finally get done this year, complete with tutorials and an introductory look at all of Blockchain Commons’ core concepts. We’re considering an update of the Developer Web Pages to try and bring some order to the rather large set of specifications we now have. (We did that a few years ago, but the ordering we choose at the time hasn’t stood up to the introduction of new technologies.)

And there will definitely be new stuff too, as we talk with the community and seek out new grant opportunities.

Unfortunately, Blockchain Commons is currently running in the red due to a loss of patrons during the crypto-winter. We’re always seeking sponsors, but even more, we’d love to work with you if you are considering adopting Blockchain Commons specifications. Talk to us if you’re interested!

Gordian Developer Meetings (2025) Post-Quantum (March): Interoperability (May): Provenance Marks (June): FROST-CLI (August): Gordian Clubs (October): Exodus Protocols (November): FROST & Hubert (December): ZeWIF Meetings (Early 2025) Meeting #1 (January): Zmigrate Demo (February): Meeting #3 (March): Meeting #4 (April): Revisiting SSI Meetings (Late 2025) Kickoff #1 (December): Kickoff #2 (December):

Edge Names Christopher R. Markham President and CEO Following Nationwide Search

NEWARK, NEW JERSEY, January 13, 2026 – Edge, a leading member-owned nonprofit provider of high-performance optical fiber networking and advanced technology solutions, announced today that Christopher R. Markham, Ph.D. (c), has been selected to serve as President and Chief Executive Officer, effective immediately.

Markham has served as Interim President and CEO since October 1, 2025, following the retirement of Samuel Conn, Ph.D. His selection follows a comprehensive nationwide search conducted by Edge’s Board of Trustees to identify a leader capable of advancing the organization’s mission while building on its strong foundation of innovation and member service.

On Thursday, January 8, the Chair of Edge’s Board of Trustees, Dr. Stephen Rose, formally notified Markham that the Board had reached unanimous agreement to confirm his leadership as President and Chief Executive Officer. The decision reflects the Board’s confidence in Markham’s strategic direction, operational leadership, and stewardship of the organization during a period of transition and growth.

“I am deeply grateful to President Rose, the Executive Committee, and the full Board of Trustees for the trust they have placed in me,” said Markham. “Edge is a mission-driven organization with a strong legacy and an even stronger future. I approach this role with humility, a deep sense of responsibility, and a commitment to thoughtful stewardship in service of our members, our community, and the long-term health of the network.”

Markham brings more than 25 years of executive leadership experience across higher education, research networks, government, and the private sector. Since joining Edge in 2018, and previously serving as Executive Vice President of Operations and Chief Economic Development Officer, he has played a central role in advancing Edge’s evolution into one of the nation’s most respected and expansive research and education networks.

Working in close collaboration with Edge’s leadership team, Markham has led and supported the team's expansion of multi-state GigaPOP connectivity, anchored at Princeton University and Rutgers University, with critical hubs in Philadelphia and Manhattan. These investments have strengthened high-performance research networking for R1 universities, medical centers, and federal research partners, while positioning Edge as a nationally trusted leader in digital infrastructure.

Markham’s career reflects a consistent focus on aligning advanced technology with institutional research priorities, economic development, and mission-driven outcomes. He emphasizes comprehensive operational strategy, financial stewardship, digital transformation, and infrastructure modernization—capabilities essential to supporting Edge’s diverse and growing membership.

A scholar and educator, Markham has been actively engaged in academically rigorous, peer-reviewed research dissemination since 2013, with a focus on economic policy, technology, and institutional transformation. He is currently completing his doctoral dissertation titled “Policy Sequencing in the Age of Artificial Intelligence: How GPT Diffusion Shapes the Timing of Redistributive Interventions.” He has also served as an adjunct professor of economics, teaching at institutions ranging from community colleges to research universities.

From 2000 to 2021, Markham served in both the U.S. Army Active Duty and Reserve components, progressing from an enlisted technology engineer to a commissioned officer in military intelligence and battalion signal units. Over two decades of service, he led multi-state operations encompassing fiscal planning, logistics, and organizational readiness. This experience shaped a mission-oriented, resilient, and collaborative leadership style that continues to inform his executive approach.

Outside of his professional responsibilities, Markham takes great pride in his family and often emphasizes that nothing is more important to him than leaving a meaningful legacy, creating lasting impact, and being fully present in the lives of his two sons. That same sense of long-term responsibility and stewardship informs his leadership at Edge.

About Edge

Edge is a member-owned, nonprofit provider of high-performance optical fiber networking and internetworking, Internet2 access, and a broad portfolio of best-in-class technology solutions, including cybersecurity, educational technologies, cloud computing, and professional managed services. Edge serves colleges and universities, K–12 school districts, government entities, healthcare networks, and nonprofit organizations nationwide. Guided by a common-good mission, Edge empowers its members through affordable, reliable, and purpose-built digital infrastructure that enables innovation and digital transformation.

The post Edge Names Christopher R. Markham President and CEO Following Nationwide Search appeared first on Edge, the Nation's Nonprofit Technology Consortium.

No regulation to make organizations respect personal privacy will work.

We’ve had cookie laws since the ’00s, the GDPR since the ’10s, and the CCPA since 2020. None of them has worked.

All those regulations are aimed at reducing the power of organizations to violate personal privacy. None is to empower people. That’s why, under those regulations, all we can do is agree to the terms organizations provide. We have no independent agency.  All we have is what they promise, and their promises aren’t worth the pixels they’re printed on.

The only way we will get privacy is with contracts, which are laws that two parties make for themselves.

And the only way to make contracts work, at scale, is if we are the ones proffering those terms as first parties, and organizations agree to them as second parties. This flips the script on business-as-usual online.

By the old script, privacy is a grace of corporate obedience to selections in cookie notices, many of which provide no choice at all. There is “Accept,” and that’s it. In that case, all you’re accepting is a corporate privacy policy, which is typically just a fig leaf over the company’s hard-on for personal data.

Regardless of what you do with a cookie notice, chances are the company still tracks you like a marked animal.  See here and here. You also have no easy of auditing compliance, because you keep no record of your “choices.” And we have that system because the incentives are worse than misaligned: they are completely broken.

See, if you are a typical website, you get paid for allowing third parties to harvest visitors’ personal data and use it to aim personalized advertising at their eyeballs. This is morally wrong on its face, but easily rationalized because it pays.

In the natural world, a store would never plant tracking beacons on every shopper, or require those shoppers to “choose” privacy protections by stripping naked and then selecting the purposes to which their personal tracking beacons will be put. Shoppers would avoid that store like the plague,

However, on the Net and the Web, we haven’t yet invented privacy, just as we hadn’t in the natural world before we invented clothing and shelter. So, on the Net and the Web, we are still naked as fish. As a result, a plague of near-ubiquitous surveillance has been raging online for decades. It is nearly impossible to avoid getting infected.

Most of that surveillance is for the $742 Billion surveillance-fed fecosystem* called adtech. And the only way we can obsolesce it is with a business ecosystem that works for everyone: customers and companies alike, and together.

We can do that now, with MyTerms.

MyTerms is the nickname for IEEE P7012 Standard for Machine Readable Personal Privacy Terms, which will be published next week after eight years in the works. (I chair the working group.)

It describes a protocol in the diplomatic sense: a way to reach and record agreements. Here is a diagram that shows how it works:

It is also the ultimate product of ProjectVRM, which began in 2006 with a mission: to prove that free customers are more valuable than captive ones—to companies, to markets, and to themselves. It was to ProjectVRM’s nonprofit spinoff, Customer Commons, that the IEEE came in 2017 with the challenge to create the MyTerms standard.

Of course, every agreement needs to be good for both sides. Right now we have five draft agreements for that. SD-BASE says “Service Delivery only.” This one requires that the site or service provide the visitor only what the visitor came for, and not to share personal data with third parties. This will make the site or service more inviting. (Customer Commons also plans to offer a trustmark to sites and services that sign MyTerms Agreements.) Lots of other mutually respectful agreements can also be built on top of SD-BASE: agreements that respect personal agency as well as privacy.

Other initial MyTerms agreements cover data portability, intentcasting, data-for-good, and AI training.

MyTerms will foster businesses and business methods that the surveillance fecosystem prevents. We describe how that will work, and some of the businesses MyTerms will create and improve, in The Cluetrain Will Run from Customers to Companies.

Of course, we need to develop tools and services for making that cluetrain run.  Please tell us what you’ve got or plan.

The place to list those is in a new section of our Developments page. We also need to re-write and condense our privacy manifesto, and welcome help with both.

We also need to thank our many teams over the past two decades for jobs well done, even if many of those jobs didn’t go anywhere, mostly because they were too early.

Now is the time, because the world is fed up with surveillance—and it is easier than ever to develop tools and services using AI.

MyTerms will be announced on 28 January at this event in the Imperial Business School and online. Please come.

*The word fecosystem is apropos, kinda like Cory Doctorow’s ensittification. Spread both words.

In previous years, Blockchain Commons has won grants from the Human Rights Foundation (HRF) to support our internship program and our work on FROST. We were delighted to win another grant in 2026 to support a large-scale revamp of Learning Bitcoin from the Command Line.

Learning Bitcoin from the Command Line is one of Blockchain Commons’ oldest initiatives, predating the formation of the organization. The foundational work on the project was supported by Blockstream, where Christopher Allen was working as Principal Architect at the time. The earliest parts of Learning Bitcoin from the Command Line simply showed how to get Bitcoin installed and running on your local machine, an idea that we’ve returned to a few times, in our Bitcoin Standup Scripts (which are also being updated, making them fully usable again) and Gordian Server.

However, Learning Bitcoin from the Command Line quickly grew from that foundation to become a full course on Bitcoin, explaining how it worked, and demonstrating all of its intricacies. The command-line part of the course, which largely focused on bitcoin-cli, offered hands-on examples so that a learner could follow along, increasing the impact of the learning. The ultimate goal of this expanded course was to help bring new developers into the Bitcoin ecosystem.

We’ve been very proud of the course over the years because of its obvious impact. Hundreds of forks and thusands of stars on GitHub told us that the course had gained traction. But it was really when we started to meet developers (including some of our interns) who had gotten into Bitcoin programming due to the course that we knew that our work had been successful. We’d accomplished our goal, but a bigger challenge lay ahead …

The problem was that Bitcoin was constantly evolving. Each new release of Bitcoin Core, of which there tend to be a few a year, offered new features, deprecated old features, or brought in whole new paradigms that had been decided upon by the Bitcoin community. That meant that the course was constantly being outdated. Shortly after we moved the course over to Blockchain Commons under lead tech writer Shannon Appelcline, we released a full 2.0 edition. Then, with the support of interns, we released an updated 2.1 edition in 2021, followed by translations into Portuguese and Spanish later in the year.

Since 2021, Bitcoin has incorporated major updates such as Signet, Taproot, and descriptor wallets, while Segwit (just coming into wider usage when we last wrote) has become the default address type. Learning Bitcoin was not updated for these advancements because our patrons were interested in other work, from Animated QRs to post-quantum cryptography. The course remained a terrific resource, but slowly grew more out of date.

That’s why we’re so thrilled by HRF’s 2026 grant. It gives us the opportunity to bring one of Blockchain Commons’ most prestigious projects up to date. We’re planning it as a year-long effort (intermingled with our other work). Our TODO details all the work: we’re going to be updating to major new features, rechecking all of the code, and then (as time allows) improving the pedagogy with some new visual learning. If you want to follow along with the work, you can find it in the lbtcftcl-v3.0 branch (but be aware, it’s literally a work in progress!).

Updating Learning Bitcoin from the Command Line is an exciting project, and we hope the course will once more be a gateway to bring new Bitcoin developers into our ecosystem when it’s done. We thank HRF for the opportunity!

In today’s digital-first world, passwords are no longer enough. As phishing attacks and credential theft increase, enterprises require a secure, scalable and user-friendly method for authenticating users. That’s where the FIDO Alliance — a global consortium shaping the future of passwordless authentication — comes in.

In 2025, Japan accelerated passkey adoption in response to evolving security challenges. Following a rise in unauthorized access incidents across the financial sector, regulators emphasized that “ID/password-only authentication and even email/SMS one-time passwords are not sufficient” and that stronger authentication methods like passkeys should be prioritized for high-risk financial actions.

Can you remember all your passwords off the top of your head? If so, you probably have too few of them – or, heaven forbid, only one that you use everywhere. But that problem could become a thing of the past in 2026.

Passwords are a cybersecurity nightmare, with hackers trading stolen sign-in credentials on illicit markets every day. That’s because the overwhelming majority of passwords are too hackable, according to an analysis by Verizon, with just 3 per cent complex enough to withstand hackers.

The post Kelly Hoyland joins the Board of Directors of Velocity Network Foundation appeared first on Velocity.

The Engine Room is currently seeking an Associate for Engagement and Support in Latin America. This role will help us to strengthen and expand  our ability to provide context-appropriate tech and data support to partners in the region as well as collaborate with our broader team on South-to-South initiatives.

The post Join our team! We’re looking for an Associate for Engagement and Support in Latin America [CLOSED] appeared first on The Engine Room.

1. What is the mission and vision of Dealertrack?

To make identity verification simple, trusted, and built into every automotive deal.
In partnership with Interac Corp. and Equifax Canada, our vision is a seamless dealer workflow with no added complexity.

2. Why is trustworthy digital identity critical for existing and emerging markets?

Because high-value transactions require confidence in who you’re dealing with. Verified identity protects dealers and consumers while keeping deals moving efficiently.

3. How will digital identity transform the Canadian and global economy? How does your organization address challenges associated with this transformation?

Digital trust works best when it’s integrated, not layered on. Dealertrack Canada combines Equifax’s identity orchestration with Interac® document verification to deliver a trusted, real-time ID verification, built directly into dealer-to-lender workflows.

4. What role does Canada have to play as a leader in this space?

Canada can lead by proving that secure identity doesn’t have to be complex.
Practical, connected solutions will drive adoption across regulated industries. By aligning industry, regulators, and technology providers, Canada can set a global standard for trusted digital identity.

5. Why did your organization join the DIACC?

To help advance shared standards for embedded digital identity. We believe trust scales fastest when identity solutions work across systems – not in silos.

6. What else should we know about your organization?

Dealertrack Canada’s goal is to make a meaningful impact on the industry’s effort to mitigate fraud. Together, we connect better, protect smarter, and perform stronger.

A webinar on mobile driver’s licenses (mDLs), presented by the National Cybersecurity Center of Excellence (NCCoE) at the National Institute of Standards and Technology (NIST), introduces new resources to help financial institutions implement support for mDLs.

Off the top, hosts Bill Fisher and Ryan Galuzzo of NIST provide a walk-through of NCCoE’s mDL privacy risk assessment, to help parties gauge what’s at stake in implementing mDLs. Its data flow diagram, an “abbreviated version of the NIST Privacy Risk Assessment Methodology”  written from the perspective of a financial institution, includes five questions that cover goals, potential problems and potential solutions.

Telegram has introduced support for passkeys in its latest update, marking a significant shift away from SMS-based login systems in favor of modern, phishing-resistant authentication methods.

The move to support passkeys brings Telegram in line with a growing number of platforms embracing the FIDO2 standard, a cryptographic login method backed by the FIDO Alliance and major industry players including Apple, Google, and Microsoft. With passkeys, Telegram users can now authenticate into their accounts using biometric data like Face ID or fingerprints, or a device PIN, instead of waiting for SMS codes that may be delayed or intercepted.

Counting Google, Amazon, and Microsoft among its early adopters, the new standard will provide organizations with more visibility and control over external applications. Here’s how it works.

The FIDO (Fast IDentity Online) Alliance has announced a new initiative designed to accelerate the adoption of verifiable digital credentials and identity wallets. Its undertaking hopes to let technology organisations build a trust-based ecosystem for digital identities, helping move the industry beyond the fragmented and sometimes incompatible solutions currently prevalent. Its initiative will provide a framework for best practice.

The initiative arrives at a time when governments and large businesses worldwide are focused on providing (and increasingly, insisting on) digital identities, such as the increased momentum behind the European Digital Identity Wallet, which will be required to do business online by EU and EU-trading businesses next year. The need for secure and interoperable digital credentials is apparent, therefore, driven by a need for greater convenience, better security, and the ability to access services (especially public sector providers) and verify identity online.

“The FIDO Alliance united the industry to solve the password problem, and the world is now embracing the simplicity and security of passkeys – with billions of accounts now benefiting from this significant shift in user authentication,” said Andrew Shikiar, CEO of FIDO Alliance.

By FIDO Alliance’s Andrew Shikar

The password is dying. If not in theory, certainly in practice. After years of technical development and cross-platform alignment, passkeys have reached a state of real-world maturity. The user experience is seamless. The infrastructure is robust. Compliance is no longer a barrier. And, most importantly, passkeys are working at scale for both consumers and the companies serving them.

This notice actually appeared on the front door of my house for a while.

As with the notice above, notice & consent online is worse than a fail. It’s absurd.  But it helps to have sources that explain how ceremonies promising privacy online will always fail when those running the ceremonies are also incentivised to violate their privacy commitments (or not to make them in the first place). I’m including coverage of adjacent and dependent topics (e.g. adtech and CRM/CX).  Of course, this is all toward setting the stage for MyTerms. Feel free to add your own.

A list of scholarly (or simply serious) sources:

Automated Large-Scale Analysis of Cookie Notice Compliance Why Johnny Can’t Opt Out: A Usability Evaluation of Tools to Limit Online Behavioral Advertising Do Not Track Initiatives: Regaining the Lost User Control Usability and Enforceability of Global Privacy Control Websites’ Global Privacy Control Compliance at Scale and Over Time
SoK: Advances and Open Problems in Web Tracking
Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe’s Transparency and Consent Framework Can I Opt Out Yet? GDPR and the Global Illusion of Cookie Control
Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence
Cookie Disclaimers: Dark Patterns and Lack of Transparency Analyzing Cookies Compliance with the GDPR
Automating Cookie Consent and GDPR Violation Detection Navigating Cookie Consent Violations Across the Globe
Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy? Why Johnny Can’t Opt Out (popular summaries and related work) A Fait Accompli? An Empirical Study into the Absence of Consent to Third-Party Tracking in Android Apps To Track or “Do Not Track”: Advancing Transparency and Individual Control in Online Behavioral Advertising
Active Consent Transparency Violation Fine Counter

Don Marti’s writings:

surveillance pricing in the news Targeted Advertising Considered Harmful
Perfectly targeted advertising would be perfectly worthless
Can privacy tech save advertising?
Don’t punch the monkey. Embrace the Badger.
A fresh start for advertising and the web?
5 five-minute steps up
Interest dashboard?
Who’s taking all the online ad money? (it’s not me)
Surveillance marketing meets sales norms
Unpacking privacy
Adversariality and web ads
We’re All Gun Nuts Now, So We Had Better Get Good At It
Newspaper dollars, Facebook dimes

Iain Henderson’s writings:

The ‘My’ Protocol Stack MyTerms and the Great Online Privacy Re-boot MyTerms as an Independence Movement MyTerms is for our Children Ten Ways in Which People Benefit from Data Portability We need a new approach to Data Portability for it to work at the scale required for Growth
We All Need a Personal Private Digital Space of Our Own
An Emerging Framework for Personal Fiduciary Agents
How many AI Agents will we each have? and why…
“Of course, it’s all about the data” (…and where do I find the Magical Data Quality Fairy?)
Putting that R back in practice – “MeRM”?
Addressing Two of the Web’s Fundamental Problems with IEEE7012 and FedID
My Terms Overview from IIW 40
Iain Henderson – The Personal Data Eco-System
The Case for Personal Information Empowerment – The Rise of the Personal Data Store (Mydex white paper)

My own writings:

People vs. Adtech (which includes many of the items below) Let’s use the “No Track” button we already have How adtech, not ad blocking, breaks the social contract Wanted: Online Pubs Doing Real (and therefore GDPR-compliant) Advertising Toward no longer running naked through the digital world We’ve seen this movie before How the cookie poisoned the Web Apple vs (or plus) Adtech, Part I A Cure for Corporate Addiction to Personal Data Are you in charge of what you buy, or is it vice versa? Freedom vs. Tracking A Way to Peace in the Adblock War Why #NoStalking is a good deal for publishers Why personal agency matters more than personal data The Wurst of the Web Personal scale Time for THEM to agree to OUR terms Choosing Your Terms Solutions: Choose Your Agreement and #NoStalking #NoStalking (P2B1) agreement MyTerms agreements overview A Way off the Ranch Help Us Cure Online Publishing of Its Addiction to Personal Data Cookies That Go the Other Way Privacy Is Still Personal Advertising 3.0 A Brand Advertising Restoration Project Privacy is personal. Let’s start there. The Data Bubble Beyond the Web The real waste is adtech — but waste isn’t a strong enough word How True Advertising Can Save Journalism From Drowning in a Sea of Content MyTerms (has many listings)

Also Terms and Conditions May Apply, a 2013 documentary by Cullen Hobeck.

Executive Summary: After years of experimentation, business leaders are entering 2026 with a clear mandate: make AI investments pay off, but do it in a way that stakeholders can trust. In enterprise settings, artificial intelligence is no longer a speculative pilot project; it’s a business-critical asset whose success or failure hinges on trust, transparency, and accountability.

Recent industry analyses show a striking gap between AI ambition and actual returns — only 14% of CFOs report measurable ROI from AI to date, even though 66% expect significant impact within two years. This optimism comes with a sobering realization: without verifiability and integrity at every level, AI projects risk underdelivering or even backfiring. An MIT study reveals that up to 95% of firms investing in AI have yet to see tangible returns, often because of hidden flaws, opaque models, or poor data foundations. In response, companies are pivoting from hype to hard results — “after years of pilots, firms are shifting focus to monetization” in AI initiatives.

Share of S&P 500 companies disclosing AI-related risks, 2023 vs. 2025. In 2025, 72% of S&P 500 warned investors about material AI risks (up from just 12% in 2023), reflecting growing concerns about AI’s impact on security, fairness, and reputation (full study).

The result is a strategic shift: trustworthy AI infrastructure is becoming a business advantage rather than a compliance burden.

This article outlines five key AI trends for 2026, each mapped to a layer of the I-DIKW framework (Integrity, Data, Information, Knowledge, Wisdom). These trends show how aligning AI efforts with integrity at every level enables organizations to unlock ROI amid regulatory scrutiny and competitive pressure.

In traditional systems, the DIKW pyramid (Data → Information → Knowledge → Wisdom) was linear and siloed. OriginTrail reshapes this entirely. By merging blockchain, knowledge graphs, and AI agents, it transforms DIKW into a networked, self-reinforcing trust flywheel, adding Integrity as the foundational layer, evolving into the I-DIKW model. Trend 1: Integrity Layer — Trustworthy AI Infrastructure by Design

Integrity is the foundation of the I-DIKW framework: it’s about building AI systems that are trustworthy and verifiable from the ground up. In 2026, leading firms will treat AI integrity (security, ethics, and transparency) as a first-class requirement. This means baking in cryptographic provenance, audit trails, and robust governance controls into AI platforms. For example, new architectures use immutable provenance chains and digital signatures to ensure every AI input and output can be traced and verified. Such measures give executives and regulators high confidence in the integrity of AI outputs.

The business payoff is significant: integrity by design reduces the risk of AI failures, bias incidents, or data leaks that can derail ROI. Companies that invested early in trust infrastructure are finding their AI projects scale faster and face fewer roadblocks from compliance or public concern. Conversely, a lack of integrity can be a deal-breaker. Case in point: the government of Switzerland rejected a prominent AI platform (Palantir) after finding it posed “unacceptable risks” to data security and sovereignty. Swiss evaluators concluded the system couldn’t guarantee full control or transparency, raising alarms about dependence on a foreign black-box solution.

The lesson for CIOs and CEOs is clear: if an AI system can’t prove its integrity and accountability, savvy clients (and regulators) will walk away. In 2026, trustworthy AI by design will be a strategic imperative, enabling organizations to deploy AI confidently and at scale, turning trust into a competitive advantage rather than a cost.

Trend 2: Data Layer — Sovereign Data and Quality Foundations

Moving up the hierarchy, Data is the raw material for AI — and its quality and governance determine whether AI initiatives thrive or falter. It’s well known that garbage in leads to garbage out, yet many organizations still underestimate how data issues sabotage AI ROI. Executives may invest millions in AI tools, only to find that the tools can’t deliver value because the underlying data is incomplete, biased, or untrustworthy. A recent survey of CFOs found that poor data trust is the single greatest inhibitor of AI success — 35% of finance chiefs cite lack of trusted data as the top barrier to AI ROI. It’s no wonder only 14% have seen meaningful AI value so far.

Data sovereignty is a particularly hot issue. Companies and governments alike want assurance that critical data remains under their control. This is driving a trend toward “sovereign AI” solutions — those that allow data to be kept locally or in trusted environments, rather than forcing lock-in to a vendor’s cloud. Europe’s upcoming regulations emphasize data localization and digital sovereignty, reinforcing this shift. The stakes became evident when Switzerland’s defense authorities rejected Palantir’s AI software after a risk assessment warned it could leave Swiss data vulnerable to U.S. jurisdiction. In the evaluators’ words, “No foreign software should compromise our ability to control and protect sensitive national information.”

For businesses, the takeaway is that control over data = trust. In 2026, leading enterprises will choose AI platforms that offer transparent data handling, open standards, and interoperability so they aren’t handcuffed to a single provider. By building sovereign data ecosystems — for instance, using decentralized data networks — organizations ensure data integrity and privacy, which in turn unlocks AI value. When your data is high-quality, compliant, and under clear ownership, AI initiatives can progress without the hidden friction that often stalls pilots. In short, trusted data is the fuel for AI ROI.

Trend 3: Information Layer — Explainable and Verifiable AI Insights

Turning raw data into actionable Information is the next layer — and in 2026, the key word is “explainable”. As AI systems generate reports, recommendations, and content, organizations are realizing that if the people using that information don’t trust it, the AI investment is wasted. Thus, a major trend is the adoption of explainable AI (XAI) and verifiable AI outputs. Business leaders want AI that not only does the analysis but can show its work — revealing the logic, source data, or confidence behind an output.

This trend is fueled by both internal needs (e.g. a manager trusting an AI-generated forecast) and external pressure. Regulators are stepping in: the EU’s AI Act, for example, includes transparency obligations requiring that users be informed when they interact with AI or encounter AI-generated content. Draft European guidelines even call for marking and labeling AI-generated media to curb misinformation. Likewise, in the U.S., authorities have encouraged AI developers to implement watermarking for synthetic content. The message is clear — 2026 is the year when “black box” AI won’t cut it in many business applications.

Companies are responding by building trust layers around AI information. One approach is integrating cryptographic provenance: for instance, embedding invisible signatures in AI-generated content or logs that allow anyone to verify where it came from and whether it’s been altered. Another approach is to leverage verifiable credentials for information sources, ensuring that data feeding AI models (or experts providing oversight) is authenticated and reputable. Forward-looking firms are also deploying AI explainability tools — from simple model scorecards that highlight key factors in an AI decision, to advanced techniques that trace an AI recommendation back to the supporting facts.

A practical example is in financial services: banks deploying AI credit scoring are using explainable models and audit trails so that each loan decision can be explained to a regulator or customer, building trust and avoiding compliance roadblocks. In the realm of generative AI, companies are pairing large language models with knowledge bases and fact-checking mechanisms to prevent hallucinations from reaching end-users. In essence, information generated by AI is becoming self-documenting and self-verifying. By making AI’s information outputs transparent, explainable, and traceable, businesses not only mitigate risk but also encourage greater adoption — employees and customers are far more likely to use AI-driven insights when they can trust the why behind the answer. The result is faster decision cycles and more impactful AI use, directly boosting ROI.

Trend 4: Knowledge Layer — Decentralized Knowledge Networks and Collaboration

The Knowledge layer elevates information into shared organizational intelligence. In 2026, a standout trend will be the rise of decentralized and verifiable knowledge networks as the backbone of AI-powered enterprises. Organizations have learned that AI projects in isolation often hit a wall — the real value emerges when insights are captured, linked, and reused across the company (and even with partners). To enable this, companies are turning to knowledge graphs and collaborative AI platforms that break down silos. Crucially, these knowledge systems are being built with trust and verification in mind. Every contribution to a modern enterprise knowledge graph can be accompanied by metadata: who added this insight, from what source, and with what evidence?

A powerful enabler here is the convergence of blockchain (decentralization) and AI. By combining blockchains’ distributed trust with AI-driven knowledge graphs, organizations create shared knowledge ecosystems that no single party solely controls — yet everyone can trust. For example, in supply chain and manufacturing, partners are beginning to contribute to decentralized knowledge graphs in which data on product quality and provenance are cryptographically signed at each step.

One notable case: Switzerland’s national rail company (SBB) uses a decentralized knowledge graph for real-time traceability of equipment data, ensuring all stakeholders see a single source of truth with integrity. In such networks, verifiable credentials play a role too — only authorized contributors (with digital credentials) can add or modify knowledge, preventing bad data from polluting the system. The benefit to ROI is clear: when knowledge is integrated and trusted, AI can draw on a much richer context to solve problems, and organizations avoid the costly mistakes of inconsistent information.

Moreover, a decentralized approach reduces vendor lock-in and increases resilience — knowledge isn’t trapped in one platform, it’s part of a federated infrastructure the company owns. Leaders are also finding that trusted knowledge sharing accelerates innovation: teams reuse each other’s AI-derived insights instead of reinventing the wheel. As Dr. Robert Metcalfe (inventor of Ethernet) observed, knowledge graphs can “improve the fidelity of artificial intelligence” by grounding AI in verified facts. In 2026, companies that master this knowledge layer — creating a living, vetted memory for the organization — will reap compounding returns from each new AI deployment, as each project makes the next one smarter and faster.

Trend 5: Wisdom Layer — AI Governance and Strategic Alignment for Sustainable ROI

At the top of the I-DIKW stack is Wisdom — the ability to make prudent, big-picture decisions. For enterprises, this translates to strong AI governance and strategic alignment at the leadership level. The trend for 2026 is that AI is no longer just the domain of IT departments or innovation labs; it’s a C-suite and boardroom priority to ensure AI is used wisely, ethically, and in line with the company’s goals. One telling sign: nearly 61% of CEOs say they are under increasing pressure to show returns on AI investments than a year ago. This pressure is forcing a new alignment between tech teams and business leaders. We see the emergence of Chief AI Officers and cross-functional AI steering committees to govern AI initiatives with a balance of innovation and risk management. In practice, companies are establishing AI governance frameworks — formal policies and oversight processes to supervise AI model development, deployment, and performance.

According to recent research, about 69% of large firms report having advanced AI risk governance in place, though many others are still catching up. In 2026, closing this governance gap will be crucial. Effective AI governance ensures that there is “wisdom” in how AI is applied: systems are tested for fairness, AI-driven decisions are subject to human review when needed, and AI strategies align with business values and compliance requirements.

This strategic alignment of AI yields tangible ROI by preventing missteps and unlocking faster adoption. Companies with mature governance can deploy AI in customer-facing processes or critical operations with confidence that they won’t run afoul of regulations or ethics scandals. In contrast, firms that push AI without guardrails often face costly setbacks — whether it’s a PR crisis over biased AI results or a regulator halting a project.

Moreover, organizations are starting to augment their internal governance with collaborative, cross-industry safety nets. For instance, Umanitek has introduced a decentralized “Guardian” agent to coordinate AI safety across platforms. Guardian can fingerprint and cross-check content against a shared knowledge graph of known illicit or deceptive media, blocking harmful deepfakes or flagged materials in real time. Crucially, this approach preserves privacy and data ownership for all participants: each contributor’s data stays private while the agent exchanges trust signals via a permissioned decentralized network . By leveraging such cross-industry trust infrastructure, enterprises effectively extend their AI governance beyond their own walls, aligning multiple AI agents and stakeholders to uphold common integrity standards. This kind of collaborative safeguard strengthens the wisdom layer by ensuring that as AI systems interact across the web, they do so under a unified, verifiable set of ethical guardrails.

Trust, once again, is a differentiator at the wisdom level. A reputation for trustworthy AI can become a selling point: for example, enterprise clients may choose a software provider not just for its AI features, but because it can prove those features are fair and compliant. We’re effectively seeing trust as a brand asset. Internally, strong governance also brings the wisdom of knowing where AI truly adds value. Leading organizations have learned to “lead with the problem, not with AI”, ensuring that each AI project is tied to a clear business outcome (revenue growth, cost reduction, customer experience) rather than AI for AI’s sake. This focus on value alignment is paying off. In fact, research on AI leaders (the Fortune 50 “AIQ” companies) shows they excel not by spending the most, but by integrating AI deeply into strategy and operations to drive measurable results.

Looking at the competitive landscape, those who invest in wisdom-layer capabilities, like company-wide AI literacy, scenario planning for AI risks, and continuous training to fill AI skill gaps, are pulling ahead. CFOs note that strengthening “the systems, data, and talent” around AI is key to turning AI’s promise into performance.

That is wisdom in action: recognizing that ROI comes not just from technology, but from enabling people and processes to harness that technology effectively. As regulatory regimes (from the EU AI Act to industry-specific AI guidelines) come into effect, having a solid governance foundation will mean fewer disruptions and fines and more freedom to innovate.

In sum, the Wisdom trend for 2026 is about treating AI not as a magic black box, but as a strategic enterprise capability that must be nurtured, overseen, and aligned with human judgment. Businesses that do so will find that trust breeds agility — they can push the envelope on AI usage because they have the wisdom to manage the risks. That translates directly into higher ROI and sustained competitive advantage.

Conclusion: Trust-Powered AI as the Blueprint for Leadership

As we head into 2026, one theme resonates across all five layers of I-DIKW: trust is the through-line that turns AI from a gamble into a solid investment. By strengthening Integrity (the technical and ethical bedrock), mastering Data quality and sovereignty, insisting on Information transparency, cultivating verifiable Knowledge networks, and enforcing wise Governance at the top, organizations create a virtuous cycle. Each layer reinforces the others — trustworthy data leads to more reliable AI information, which feeds organizational knowledge, enabling wiser decisions, which in turn guide further data strategy, and so on. Companies that embrace this holistic approach are positioning themselves as leaders in the AI economy. They are better prepared for tightening regulations and rising customer expectations, turning those into opportunities rather than obstacles. Not least, they are demonstrating to investors and boards that AI dollars are well spent: projects don’t stall in pilot purgatory, but scale with confidence because the infrastructure of trust is in place.

In a business climate where 61% of CEOs feel the heat to prove AI is delivering value, aligning with the I-DIKW framework provides a clear roadmap. It ensures that AI efforts are built on integrity and purpose at every step, rather than chased as shiny objects. The experience of firms at the forefront underscores this: those who treated trust as a core principle of their AI strategy are now reaping tangible returns — whether through increased automation efficiencies, new revenue streams from AI-driven products, or stronger customer loyalty thanks to ethically sound AI practices. On the other hand, organizations that neglected these layers are encountering what one might call “AI growing pains,” from data compliance headaches to lackluster ROI, and even public backlash.

The strategic reflection for executives is this: AI leadership in 2026 will belong to those who marry innovation with verification. By investing in trustworthy infrastructure — be it cryptographic provenance for data, explainability modules for AI, or robust governance councils — you not only de-risk your AI investments, but you amplify their reward. Trust is more than a compliance checkbox; it’s a performance multiplier. In the coming AI-driven economy, build trust, and the ROI will follow.

5 Trends to drive the AI ROI in 2026: Trust is Capital was originally published in OriginTrail on Medium, where people are continuing the conversation by highlighting and responding to this story.

What is your best friend’s personal brand? How about your spouse’s?

Those questions came to mind as I read through The Death of Merchandising in an Online World, by  Dana Blankenhorn, who is reliably wise. In that post, Dana correctly observes that brand value is declining as merchandising shifts from stores to online services, and to influencers who are also stores.

I think there’s also something else going on at the same time: the shift in media from real advertising to the online equivalent of junk mail, which is what you see with nearly every ad you encounter on your browsers and apps. To marketers, browsers and apps are boxes for junk mail, which at its most ideal is personalized by surveillance.  As I put it in Separating Advertising’s Wheat and Chaff, ” Madison Avenue fell asleep, direct response marketing ate its brain, and it woke up as an alien replica of itself.”

I wrote that a decade ago. With AI today, that alien replica is the real thing. Madison Avenue is now AM radio, with a whip antenna and tail fins.

Brand advertising worked best when “the media” were mostly print and broadcast. Sources of both were so few that they all fit on a newsstand and the dials of radios and TVs. To operate a source of either, you needed a printing plant or transmitting towers. Publishers and broadcasters are still around, but now their goods are mostly distributed over the Internet and consumed through glowing rectangles. And they’re competing in a world where the abundance of other sources of content is incalculably vast. In that world, the only places you can still reliably create and maintain brands is by sponsoring live events. Especially sports. That’s why I know fifteen minutes will save me fifteen percent with Geico, even though Geico stopped saying that years ago. I also know that you only pay for what you need with Liberty Mutual. And I’ll never get the Shaefer Beer jingle out of my mind.

On the whole, however, branding has finished running the same course as the broadcasting it paid for.

It helps to remember that the words brand and branding were borrowed from ranching. They applied especially well when people had few choices of media, and few if any ways to avoid ads meant to burn the names of companies and products onto mental hides.

What we really (or at least should) mean by brand today is reputation. How a business obtains that in our still-new Digital Age (now with AI!) is an open question.

I believe the answer will come from the natural world, where markets have been working far longer than we’ve had digital media, broadcasting, or print. It was in the natural world that two very different people—one an athiest and the other a pastor—separately explained to me, not long after The Cluetrain Manifesto came out, that markets are not just about transactions and (as Cluetrain insisted) conversations. They are about relationships.

Marketing prevents those. Or shortcuts them. Especially as it continues to devolve into funnels at the bottom end of which are transactions alone, or entrapment in a company’s “loyalty” system.

The Internet and the Web were both designed to support maximum agency and independence for every entity using them. We can have far better markets and marketing if demand and supply both work with maximized agency, and scale in ways that are good for both. That’s the idea behind market intelligence that flows both ways.

Making and maintaining those kinds of relationships will be VRM+CRM, What those together will make are wholes that exceed the sum of either part.

Abstract: Software security has always been a race between complexity and clarity. The Vulnerability Exploitability eXchange (VEX) aims to bring clarity to that race. It’s a structured, machine-readable way for software producers to tell the world whether a vulnerability truly affects their products. That clarity has the potential to cut through noise, eliminate false positives, and reduce the human toil involved in vulnerability management. But for now, adoption remains inconsistent and uncertain. This report collects the stories and insights of leading players in the software industry—Amazon, Anchore, Aquasec, Chainguard, Cisco, Debian, Ericsson, Freexian, Google, Microsoft, Red Hat, and OpenSUSE. Together, they form a mosaic of progress, frustration, and hope. What follows is not a technical manual. It’s an honest account of how VEX is evolving, what’s holding it back, and how we can build a future where vulnerability data empowers security teams instead of overwhelming them.

Introduction

Every day, a security team receives a list of vulnerabilities that looks terrifying. Most of those entries will turn out to be harmless. The challenge is that no one knows which ones matter without a lot of digging. VEX was created to make that process faster and smarter. The Vulnerability Exploitability eXchange is a framework for software producers to publish clear, structured statements about which vulnerabilities do and do not apply to their products. It’s a way to replace endless guesswork with precise, verifiable data.

And yet, the reality today is that VEX feels more like a promise than a practice. Across the industry, there’s agreement on what VEX could be, but less on how to get there. Formats like CSAF, OpenVEX and CycloneDX offer different visions for VEX documents. SPDX, specifically the 3.0 specification, takes a relationship-based approach. While it can function as a standalone document, its architecture is designed to encode vulnerability relationships directly into the broader software supply chain graph, capable of ingesting and mapping information from other formats like CSAF or OpenVEX. While organizations wrestle with tooling, policy, and regulation, the VEX Industry Collaboration Working Group brought together experts from across the ecosystem to compare notes and chart a shared path forward.

Methodology

This paper draws from months of structured interviews and discussions with major software producers, open-source maintainers, and vulnerability management vendors. We listened, compared, and synthesized their experiences into a unified view of VEX adoption. We focused on five big questions:

What motivates companies to adopt VEX? Which formats are being used, and why? How are VEX documents distributed and trusted? What tools exist—and what’s missing? How are regulations shaping these decisions?

These conversations were complemented by a comparison of popular existing standards (such as CSAF, OpenVEX, and CycloneDX), as well as regulatory frameworks like the EU Cyber Resilience Act and the U.S. Executive Order on Software Supply Chain Security.

Note: The insights in this paper largely reflect the perspectives of the enterprise and vendor interviewees listed in the acknowledgments. While valuable, this does not represent an exhaustive audit of all VEX implementations or the wider open-source ecosystem.

Current State of VEX Why Companies Care

VEX adoption is slowly gathering momentum, pulled forward by regulation, customer expectations, and a simple desire to reduce noise.

Reducing False Positives: Microsoft reports that common vulnerabilities in libraries like curl generate hundreds of unnecessary support tickets. VEX could stop those calls before they happen. Enabling Automation at Scale: With nearly 40,000 new CVEs published annually, communication about vulnerabilities along complex software supply chains can only be handled through automation. Machine-readable VEX is essential for this. Meeting Compliance Requirements: The EU’s Cyber Resilience Act makes effective vulnerability handling a legal requirement for anyone doing business in Europe, and CSAF-based VEX will be a key enabler for efficient compliance. Customer Pressure: Enterprises are asking for VEX data. Cisco now requires it from suppliers through its contractual terms. Who’s Doing What Established Implementers: Red Hat, OpenSUSE, and Microsoft are ahead, publishing CSAF VEX documents and building infrastructure to manage them. Emerging Players: Cisco exposes VEX through APIs and is transitioning to CSAF exports. OpenVEX Ecosystem: Chainguard maintains an OpenVEX feed for its secured libraries. The Go toolchain, Kubescape, and Edgebit have integrated OpenVEX for native data generation and reachability analysis. Investigating Participants: Amazon and Debian are experimenting, learning, and planning for broader adoption. Standardization Drivers: Companies like Microsoft, Cisco, and Ericsson are actively evolving the CSAF VEX standard within OASIS to address current and future use cases. The Four Flavors of VEX

Currently, four primary formats exist for implementing VEX, each with distinct characteristics:

CSAF (Common Security Advisory Framework): A comprehensive standard used heavily by major vendors and aligned with regulatory requirements (like the EU CRA). It is powerful and expressive but can be complex to generate and validate without specialized tooling. OpenVEX: Designed for simplicity, interoperability, and integration into open-source workflows. It supports cryptographic attestation (via in-toto) and is supported by tools like the Go toolchain and Docker. It prioritizes “boring” reliability and ease of use over complex advisory features. CycloneDX: A bill-of-materials (SBOM) standard that includes VEX capabilities. While it allows for standalone vulnerability reports, its unique value proposition is embedding vulnerability status directly within the SBOM. However, this can create challenges when SBOM generation lifecycles (build-time artifacts) differ from VEX lifecycles (continuous security updates). SPDX (Software Package Data Exchange): The SPDX 3.0 specification includes a full VEX implementation. It is designed to be fully compatible with the CISA VEX “spec of specs,” capable of round-tripping data to and from other formats. Challenges and Gaps

The following challenges reflect the specific pain points identified by our interviewees, particularly those focused on enterprise CSAF implementations.

Discovery and Distribution

Finding the right VEX document is harder than it should be. There’s no common lookup system, and trust is uneven. Today, every organization distributes VEX differently: some through APIs, others through static repositories or experimental hubs. Functionally, VEX sits between SBOMs (or attestations) and vulnerability database information. While VEX and SBOMs share the same method of referencing software components, the shape of their distribution problems is not the same. Unlike static build artifacts, VEX documents require frequent and dynamic updates, creating a unique hurdle for automation.

Verification and Trust

Verifying the source of a VEX document remains a complex problem for many implementers. While standards like OpenVEX were designed with attestation in mind (e.g., in-toto predicates), widespread industry consensus on a shared standard for signing and verifying all VEX formats is still evolving. Beyond the mechanics of verification, there is the added difficulty of defining the policy itself—determining whose VEX statement to trust (e.g., the software vendor, a distro maintainer, or a third-party scanner). For many enterprise consumers, trust is currently based on where the file is hosted rather than cryptographic proof, which limits the utility of aggregated hubs.

Tooling Maturity

The maturity of tooling remains a significant variable in the ecosystem. Our research specifically highlighted challenges regarding CSAF: while the format is powerful, its tooling can be complex for many users. Some official checkers were reported to miss logical errors, and smaller companies often struggle with the custom development required to manage the documents effectively. This gap has forced adopters like OpenSUSE and Debian to build their own internal tools rather than relying on standard implementations. Conversely, OpenVEX has prioritized a “tooling-first” approach, resulting in stable generation and validation libraries in major ecosystems like Go, which lowers the barrier to entry for smaller teams, even if it lacks the full expressive powers of CSAF.

Mismatched Lifecycles

A VEX document changes whenever new vulnerability status information appears. An SBOM, typically, is a snapshot of build artifacts. While VEX best practices suggest keeping these lifecycles distinct to avoid confusion, theory and practice often diverge. Formats like CycloneDX and SPDX allow for embedding VEX information directly within an SBOM (e.g., via CycloneDX VDR or BOV profiles and SPDX Security profile). This approach has valid use cases—such as providing a summary of known vulnerability status at the exact moment of a software release—but our research suggests adoption is limited. Documentation for these specific CycloneDX use cases is often scarce, and the data model for handling complex vulnerability status statements within the SBOM is perceived by some as less mature than standalone VEX implementations.

Software Identifier Confusion

Every ecosystem has its own way of naming things (PURLs, CPEs, hashes). Without shared conventions and trusted authorities to map these identifiers, automation breaks down. This is a fundamental metadata problem that affects VEX but is not inherent to the VEX format itself.

Education and Incentives

Most open-source maintainers don’t see a reason to publish VEX statements. Some vendors treat VEX as a premium feature, not a baseline responsibility. Adoption isn’t just a technical challenge; it’s cultural.

Role Clarity

VEX should describe exploitability, not serve as a policy tool for ignoring issues. Blurring those lines makes it harder to trust the data.

Recommendations Build a Common Distribution System

The community should fund and design a VEX Discovery and Distribution Protocol. This could be hosted under OpenSSF, enabling anyone to discover, verify (via digital signatures or OCI-based attestation), and use trusted VEX data in a consistent way. This effort should leverage existing contributions, such as the potential donation of the Aqua VEX Hub or existing OpenVEX archives, to accelerate the creation of a neutral, federated index.

Invest in Better Tools

Product teams have made it clear: they cannot adopt these standards without friction-free integration. Regardless of the specific format, the ecosystem urgently needs robust, maintained libraries to generate VEX documents. Bridging the gap between policy requirements and engineering reality requires meeting developers where they are, with reliable tooling in languages like Go, Python and Java.

Align on Standards Without Excluding Others

Enterprises should consider CSAF as the target standard for high-fidelity production due to its expressiveness and regulatory alignment. However, the industry must acknowledge the implementation friction reported by product teams. We should support CSAF adoption where necessary without invalidating the use of lighter-weight formats that effectively serve engineering needs.

Clarify VEX’s Purpose

The industry should agree on what VEX is—and what it isn’t. That means clear definitions of exploitability reporting, fix availability, lifecycle status (EOL), and legal considerations. A shared guide or reference paper could help bring this clarity.

Fix the Identifier Problem

Projects like OpenSSF GUAC can lead the way by defining shared identifier-matching libraries that unify PURLs, CPEs, and hashes. Reliable identifiers are the foundation of reliable automation.

Strengthen Cross-Industry Collaboration

The OpenVEX SIG under OpenSSF currently serves as a home for this collaboration. However, driving generic VEX improvements across the ecosystem may require a shift in structure or branding. To effectively signal a format-neutral mission, the industry needs a forum explicitly dedicated to the broader VEX interoperability–focusing on transport and discovery protocols–rather than operating under a specific specification’s banner.

Lead by Doing

The fastest way to make VEX real is to use it.

Large vendors should start publishing VEX for their own products. Consumers should ask vendors for VEX data. Open-source maintainers should engage with the community to find the tools and support you need. Future Directions

The next chapter of VEX will be written not in standards bodies but in the build systems, scanners, and repositories that people use every day.

CSAF 2.1 Adoption: In the coming year, we should focus on implementing the CSAF 2.1 specification to leverage its flexible identifiers and integration with modern scoring systems like Exploit Prediction Scoring Systems (EPSS), ensuring these features translate into actual risk reduction. Federated Discovery: OCI registries and projects like Aquasec’s VEX Hub point toward a future of distributed but trusted VEX sharing. Integration with CI/CD: The industry objective should be to normalize VEX generation within standard release pipelines. We should move beyond isolated success stories to a state where automated VEX production is a default capability in major build systems, independent of the specific format used. Regulatory Momentum: The Cyber Resilience Act and similar efforts will turn VEX from a “nice to have” into a key enabler for compliance. Acknowledgements

This work is the result of many conversations, generous expertise, and the steady patience of people who care deeply about making software safer for everyone. The authors extend our sincere thanks to the individuals who contributed their time, insight, critiques, and lived experience. Their perspectives shaped this paper in ways both visible and quiet.

Authors (listed alphabetically): Aubrey Olandt (Red Hat), Brandon Lum (Google), Charl de Nysschen (Google), Christoph Plutte (Ericsson), Georg Kunz (Ericsson), Jonathan Douglas (Microsoft), Jautau “Jay” White (Microsoft), Martin Prpič (Red Hat), Rao Lakkakula (Microsoft)

Contributors (listed alphabetically): Adolfo Garcia Veytia (Carabiner Systems), Alex Goodman (Anchore), Brad Bock (Chainguard), Dario Ciccarone (Cisco), Itay Shakury (Aquasec), James Fuller (Red Hat), Jens Reimann (Red Hat), Johannes Segitz (OpenSUSE), Lisa Olson (Microsoft), Lucas Kanashiro (Freexian), Marcus Meissner (OpenSUSE), Omar Santos (Cisco), Philippe Deslauriers (Chainguard), Rex Pan (Google), Samuel Henrique (Debian), Santiago Ruano Rincón (Freexian), Suresh Goacher (Amazon), Teppei Fukuda (Aquasec), Thomas Schmidt (German BSI), Yousef Alowayed (Google).

The post Signal in the Noise: An Industry-Wide Perspective on the State of VEX appeared first on OASIS Open.

Kia ora,

What a year! As 2025 draws to a close, we want to extend our heartfelt thank you to every member of the Digital Identity NZ community, our government partners, industry supporters, and especially our hosts Air New Zealand and friends at IATA who helped us celebrate all we’ve achieved together last week in Tāmaki Makaurau. 

Your mahi has powered real momentum — from trusted frameworks and inclusive working groups to practical progress in credentialing use cases across both public and private sectors. This collective effort is what’s driving Aotearoa towards a future where digital identity enabled by verifiable attestations isn’t just a concept, but a tool people use every day with confidence.

Thanks to everyone who joined us for our Annual Meeting on 4 December. The presentation is available here, including an introduction to our new Executive Council.

Highlights from the past month

Government app & digital wallet progress
The Government Chief Digital Officer and Department of Internal Affairs have been advancing a new all-of-government app that will securely host digital credentials — signalling a major step toward seamless digital interaction with public services. Initial functionality and user research are underway, with staged rollout expected into 2026. Learn more at Digital.govt.nz

Infinite possibilities for credentials
This year saw ongoing trust framework work, partners preparing real world credential solutions, and momentum building ahead of broad ecosystem adoption. With updated Digital Identity Services Trust Framework rules and expanding credential support, the foundation for digital transformation is a work in progress as highlighted by community feedback to the recent research released by the DIA.

From a Te Ao Māori perspective, digital credential ecosystems must be built on trust, choice, and genuine Māori governance. Without co-design, respect for data sovereignty, and alignment with tikanga Māori, digital identity risks reinforcing exclusion rather than enabling rangatiratanga.

— Dr Karaitiana Taiuru, Māori data and digital governance specialist

Partnerships that matter
We celebrated with industry peers and honoured collaboration across sectors at our end-of-year event on 11 December — particularly with Air New Zealand and the International Air Transport Association (IATA), underscoring the global importance of digital identity standards and interoperability. 

Thank you to all our speakers — especially Janelle Riki-Waaka, who MC’ed the event with grace, warmth, and a deep sense of manaakitanga.

We were indeed fortunate to hear from Dr Samir Saran who highlighted the business case for digital public infrastructure from a Digital India perspective, including accelerated GDP and asset value growth (from 7 to 17% per annum). Samir also shared the progress of the Gates Foundation backed Modular Open Source Identity Platform (MOSIP) — an open-source foundational digital identity platform. The MOSIP centralised identity has been adopted by 160 million global citizens outside India, demonstrating the export potential of our open and decentralised approach to trust infrastructure.

Government digital leadership & future structure
The public service continues its digital transformation with structural evolution under the Public Service Commission, including integration of Government Chief Digital Officer functions into a new Government Digital Delivery Agency — all designed to deliver smarter, simpler services for all New Zealanders. Learn more here.

Looking ahead — the year of the credential (2026)

2026 is shaping up to be a defining year. With foundational work complete and adoption readiness accelerating, we’ll be turning plans into real, everyday experiences — from digital driver licences to secure wallets and beyond. Your continued engagement, innovation, and leadership will be vital.

Take a break, recharge & return ready

As calendars turn and we head into the holidays, we hope you find time to rest, reconnect, and recharge with whānau and friends. Come back refreshed — because 2026 is going to be our most exciting year yet.

Ngā mihi nui — thank you for your partnership, your passion, and your vision for an open, trusted digital future for Aotearoa.

Meri Kirihimete!

Andy Higgs
Executive Director
Digital Identity NZ

Read the full news here: Meri Kirihimete me te Tau Hou Hari

SUBSCRIBE FOR MORE

The post Meri Kirihimete me te Tau Hou Hari appeared first on Digital Identity New Zealand.

December 2025

DIF Website | DIF Mailing Lists | Meeting Recording Archive

Table of contents

1. Decentralized Identity Foundation News; 2. Working Group Updates; 3. Special Interest Group Updates; 4. User Group Updates; 5. Announcements; 6. Community Events; 7. Get involved! Join DIF

🏛️ Decentralized Identity Foundation News From the Executive Director

This is my final DIF newsletter as Executive Director, and I want to take a moment to reflect on what this community accomplished over the course of 2025.

This year marked a shift in how DIF showed up in the digital identity ecosystem. Across multiple working groups, we increasingly focused on clarifying, validating, and applying identity infrastructure in contexts where people, organizations, devices, and -- increasingly -- AI systems intersect. That focus showed up in different ways: requirements for fine-grained, revocable delegation; secure messaging in constrained environments; greater rigor around DID methods and their operational properties; and domain-focused work in content authenticity and travel, where identity systems must operate under demanding constraints.

What mattered most to me was the shared commitment across our groups to deployability without giving up on principles. Privacy, user control, and interoperability stayed central to our technical decisions, even when tradeoffs were involved. That balance is difficult to maintain, and this community approached it thoughtfully and with care.

This year also highlighted the importance of principled technical voices in broader identity discussions. Through efforts such as the No Phone Home campaign, DIF helped surface concrete privacy and architectural concerns in emerging digital identity systems, contributing a technical perspective that aligned with the work of organizations such as the ACLU and EFF. Our role was helping ensure that questions of user control, data minimization, and unintended centralization remain part of the conversation.

I’m deeply grateful to the Steering Committee, Technical Steering Committee, group chairs, spec editors, implementers, and contributors who made this work possible, often quietly and without fanfare. DIF is in a stronger and more focused place than when I started, with a clearer sense of where it can lead and where it can add the most value.

As I pass leadership to Grace, I’m excited for what comes next and grateful for the trust you’ve placed in me over the years. I’ll be cheering DIF on from the sidelines.

Welcoming Grace Rachmany as DIF's New Executive Director

We're thrilled to announce that Grace Rachmany has joined the Decentralized Identity Foundation as our new Executive Director.

Grace brings deep experience in decentralized governance and community building, with a track record of helping technical ecosystems clarify their purpose and make impact. She joins DIF at a moment when governments, enterprises, and identity visionaries are all making different bets on the future of digital identity. Grace’s ability to navigate that complexity, while keeping communities aligned around shared principles, makes her a strong fit for this next chapter.

Please join us in welcoming Grace to the DIF community. You can connect with her on LinkedIn or reach out via the DIF Slack workspace.

🛠️ Working Group Updates

Browse our working groups here.

Below are highlights from November 2025 working group activity.

Trusted AI Agents Working Group

In November, the Trusted AI Agents Working Group continued refining the Agentic Authority Use Cases work item, with discussions centered on how authority, delegation, and accountability can be expressed when agents act on behalf of people or organizations.

Recent conversations focused on concrete scenarios — exploring how agents might authenticate, present credentials, and operate within clearly scoped boundaries. The group also discussed where existing DID and VC building blocks are sufficient, and where new patterns may be needed to support agent-to-agent interactions without eroding human control.

👉 Learn more and get involved

Hospitality & Travel Working Group

November meetings in the Hospitality & Travel WG focused on traveler profile schemas and the operational realities of deploying them across different regions and systems.

The group continued work on structured, consent-driven profiles — covering preferences, accessibility needs, and multilingual considerations — while examining how these profiles can be used by both human-facing systems and AI-assisted services.

👉 Learn more and get involved

Identifiers and Discovery Working Group

In November, the Identifiers and Discovery WG continued advancing the DID Traits work item, focusing on how traits can help implementers and relying parties reason about DID method properties in a consistent way.

👉 Learn more and get involved

DID Methods Working Group

In a recent email, Chair Jonathan Rayback reminded the group of its significant accomplishments this year:

Drafted a charter for the DID Methods Working Group at W3C Defined the DIF Recommended DID Method process Formally recommended the first DID method

The formal review period for did:webplus began on 3 December 2025. Community review during the current evaluation period is strongly encouraged.

👉 Learn more and get involved

DIDComm Working Group

November discussions in the DIDComm WG focused on practical deployment considerations, including routing models, mediation, and interoperability challenges observed in real deployments.

👉 Learn more and get involved

Creator Assertions Working Group

In November, the Creator Assertions Working Group continued work on content authenticity and provenance, including how assertions may be consumed by automated systems and agents in the future. The CAWG group reached WG approval status for two of its specs, which are nearing DIF Ratified status.

👉 Learn more and get involved

🌎 Special Interest Group Updates

Browse our special interest groups here.

Hospitality & Travel SIG

In November, the Hospitality & Travel SIG continued to serve as a forum for cross-industry knowledge sharing, reinforcing themes such as multilingual traveler profiles and accessibility considerations.

👉 Learn more and get involved

📖 User Group Updates DIDComm User Group

In November, the DIDComm User Group continued its focus on practical implementation experience, sharing lessons from deployments and interoperability testing.

👉 Learn more and get involved

📢 Announcements Year-End Meeting Schedule

Many DIF working groups adjust their schedules in late December and early January. Please check your group’s calendar and mailing list for details.

Call for Participation: Early 2026 Work Items Trusted AI Agents WG: additional agent-related use cases Claims & Credentials WG: continued community schema work Identifiers and Discovery WG: DID Traits implementation and testing 🗓️ Community Events Internet Identity Workshop IIWXLII #42

📅 April 28–30, 2026
📍 Mountain View, CA
Registration and details

Agentic Internet Workshop #2

📅 May 1, 2026
📍 Mountain View, CA
Learn more

Identiverse 2026

📅 June 15–18, 2026
📍 Las Vegas, NV
Conference details

Identity Week Europe 2026

📅 June 9–10, 2026
📍 Amsterdam
Event information

Authenticate Conference 2026

📅 October 19–21, 2026
📍 Carlsbad, CA
Details coming soon

🚀 Get involved! Join DIF

The Decentralized Identity Foundation is a community-driven organization. Join a working group, contribute to open source, attend events, or become a member to help shape the future of decentralized identity.

Visit identity.foundation/join to learn more.

Ten years ago today, the Linux Foundation launched its first blockchain-related project, the Hyperledger Project, a collaborative effort to “advance popular blockchain technology.” At the time, blockchain was largely viewed in the enterprise as an experimental technology. It was  promising in theory, but unproven at scale, raising questions about security, performance, governance, and regulatory fit. It was often also conflated with cryptocurrency, which many institutions associated with volatility, regulatory uncertainty, and speculative use cases. 

Resilience isn't just for small startups—it's vital for businesses of all sizes.

In this episode, Jonathan Biddle, author of Supply Chain for Startups, joins Reid Jackson to discuss how companies can build resilient supply chains using key metrics and smart strategies. Jonathan explains how early decisions about structure, visibility, and supplier engagement can set you up for long-term success.

This conversation offers a clear view of what it takes to build supply chain operations that can adapt as the business grows.

In this episode, you'll learn:

How process mapping uncovers weak points that limit supply chain stability

Why consistent supplier communication strengthens visibility and reduces risk

The early operational signals that indicate it's time to upgrade systems

Things to listen for: (00:00) Introducing Next Level Supply Chain (04:07) Building resilience for early-stage supply chains (06:37) Why supplier insight matters for managing risk (09:41) Daily and weekly habits that improve operations (14:36) Signals that current processes are no longer scalable (20:06) Tools that support growing operations (25:11) How AI can help small supply chain teams (30:21) Jonathan's favorite tech

Connect with GS1 US: Our website - www.gs1us.orgGS1 US on LinkedIn

This episode is brought to you by:

Aarongraphics and Wholechain

If you're interested in becoming or working with a GS1 US solution partner, please connect with us on LinkedIn or on our website.

Connect with the guests: Jonathan Biddle on LinkedInCheck out Jonathan's book, Supply Chain for Startups

The FIDO Alliance is tightening how relying parties evaluate passkeys and other FIDO authenticators, rolling out new versions of its Metadata Service (MDS) and a streamlined Convenience Metadata Service aimed at making it easier to separate trustworthy authenticators from outdated or non-compliant devices. The update is pitched as a way to raise assurance levels for passkey deployments without sacrificing user experience across mobile and desktop platforms.

The FIDO Alliance is leveling up. Several announcements show the passwordless-focused organization evolving, as it expands beyond its initial push for passkeys to engage with the wider identity ecosystem.

After dropping hints on the Biometric Update Podcast, the FIDO Alliance today announced the launch of a new digital credentials initiative, to be carried out by a new Digital Credentials Working Group (DCWG). The company’s announcement calls it an expansion of the FIDO Alliance’s mission to accelerate the adoption of verifiable digital credentials and identity wallets. Work will focus on three foundational workstreams: wallet certification, specification development and usability and relying party enablement.

Whether you’re logging into your bank, health insurance, or even your email, most services today do not live by passwords alone. Now commonplace, multifactor authentication (MFA) requires users to enter a second or third proof of identity. However, not all forms of MFA are created equal, and the one-time passwords orgs send to your phone have holes so big you could drive a truck through them.

December 12, 2025

DIACC welcomes Canada and the European Union’s commitment to collaborate on digital credentials and trust services, formalized through the December 8 memorandum of understanding. International alignment matters deeply—for Canadian economic competitiveness, for secure cross-border transactions, and for ensuring our citizens can participate fully in the global digital economy.

This announcement comes after more than a decade of DIACC advocacy for precisely this kind of strategic partnership. The urgent question now is how quickly this international momentum can catalyze the domestic coordination needed to put economic growth and Canadian competitiveness at the centre, while ensuring privacy and security are foundational to design. 

Canadians and their businesses need interoperable digital public and private infrastructure working for them at home now. Every day of delay costs our economy opportunity, competitiveness, and the trust dividend that secure, privacy-respecting verification systems deliver.

Domestic Coordination Enables International Opportunity

Mutual Recognition at Home
Canadians must experience mutual recognition across our own borders with urgency. A business credential recognized in Ontario must work in British Columbia. A professional verification issued in Quebec must be valid for Alberta workers. A digital credential from Nova Scotia must enable service access in Saskatchewan.

Quebec’s recent adoption of Bill 82 demonstrates provincial leadership in digital identity legislation. British Columbia’s Connected Services initiative, built on the Service Card, demonstrates jurisdictional innovation in action. These achievements are significant, and they underscore the urgent need for interprovincial mutual recognition that respects jurisdictional sovereignty while enabling seamless digital trust across Canada.

Economic Imperative Spans All Sectors
Digital credentials must work seamlessly across both public and private sectors, respecting both jurisdictional authority and market needs. Canadian businesses, especially small and medium enterprises, need trusted digital verification capabilities that reduce friction, prevent fraud, and enable growth regardless of which jurisdiction issues or validates credentials.

Implementation must explicitly address how banking, telecommunications, healthcare, professional credentialing, and supply chain sectors can participate. These are multi-jurisdictional challenges requiring coordinated solutions, not top-down mandates.

Federal Collaboration
The federal government has specific authorities in international trade, border management, federal services, and specific regulatory domains. Within this scope, federal action matters enormously, particularly in negotiating mutual recognition agreements that open international markets for Canadian credentials and businesses.

Equally important: the federal government can convene, facilitate, and invest in tools that enable coordination without dictating implementation. The DIACC’s public and private sector Pan-Canadian Trust Framework offers exactly this approach—a consensus-based framework that provinces, territories, Indigenous governments, and private sector participants can adopt voluntarily now while maintaining their respective authorities.

What Canadians and Their Businesses Need Now

For international alignment to deliver tangible benefits, Canada’s jurisdictions and sectors must demonstrate:

Interprovincial and sectoral interoperability commitments that make credentials portable across Canadian borders Multi-stakeholder governance models where provinces, territories, Indigenous governments, industry sectors, and federal authorities coordinate as partners, not hierarchies Standards adoption that leverages existing frameworks like the PCTF to reduce regulatory fragmentation while respecting jurisdictional sovereignty Economic impact focus showing how mutual recognition, domestic and international, creates opportunities for Canadian businesses, workers, and communities Transparency and concrete implementation timelines with clear accountability distributed across appropriate authorities Impactful Progress Happens Through Coordination

Since 2012, DIACC has advocated for a digital trust infrastructure that prioritizes economic growth and respects Canada’s federal structure while enabling seamless verification capabilities across jurisdictions and sectors. Progress is happening: Quebec’s new legislation, BC’s service transformation, Ontario’s legal sector achievements with 700,000+ digital verifications, and growing private sector adoption all demonstrate momentum.

What’s needed now is coordination mechanisms that connect these provincial initiatives, enable interprovincial recognition, align with Indigenous data sovereignty principles, and position Canadian credentials for international mutual recognition. The federal government’s international agreements, like this MOU, create valuable opportunities. Domestic coordination makes those opportunities accessible to Canadians everywhere.

This MOU represents progress toward international alignment. The more complex work remains: achieving the domestic interoperability that makes international mutual recognition practically valuable. Every jurisdiction has a role. Every sector has expertise to contribute. Every delay in coordination represents lost economic opportunity and continued inefficiency across both government and commercial services.

Canada has world-class expertise, proven frameworks like the PCTF, provincial leadership in implementation, and strong private-sector innovation in digital trust services. We have the components needed for success. What we need is a sustained, coordinated commitment across jurisdictions and sectors to make these components interoperable and to ensure all Canadians and businesses can benefit.

DIACC stands ready to support coordination, as Canada’s longest-standing, largest, and most diverse forum focused solely on digital trust and verification. We will continue to contribute through our expertise, our membership ecosystem spanning public and private sectors across all regions, and our commitment to advancing digital trust that serves Canadians in all aspects of their lives—public, private, and economic.

Joni Brennan
President, DIACC

Dr. Forough Ghahramani Delivers Talk Dedicated to Empowering Research and Education through Advanced & Emerging Technologies at “New Horizons for AI and Data Science Symposium” at Rutgers University

NEWARK, NEW JERSEY, December 08, 2025  – Rutgers University convened Rutgers University academic leaders, members from industry and government  on December 8, 2025, for "New Horizons for AI and Data Science," a comprehensive symposium exploring the future of artificial intelligence and data science innovation at the university. The event, held at Express Newark on the Rutgers-Newark campus, showcased four key Rutgers University Roadmap Initiatives: the Center for Biomedical Informatics and Health Artificial Intelligence (BMIHAI) at Rutgers Health, the Rutgers Artificial Intelligence and Data Science (RAD) Collaboratory at Rutgers-New Brunswick, the Institute for Data, Research, and Innovation Sciences (IDRIS) at Rutgers-Newark, and Prevention Science at Rutgers-Camden.

Dr. Forough Ghahramani, Assistant Vice President for Research, Innovation, and Sponsored Programs for Edge and Vice President for Technology at the New Jersey Big Data Alliance, was an invited speaker for the Stakeholder talk titled "Empowering Research and Education through Advanced & Emerging Technologies: A New Jersey Perspective."

"I was delighted to be invited to present at this important symposium and share insights on the growing momentum around advanced technologies, including AI, quantum computing, high-performance computing, and the national resources that are broadening participation in these transformative technologies."

– Dr. Forough Ghahramani
Assistant Vice President for Research, Innovation, and Sponsored Programs
Edge

"I was delighted to be invited to present at this important symposium and share insights on the growing momentum around advanced technologies, including AI, quantum computing, high-performance computing, and the national resources that are broadening participation in these transformative technologies," said Dr. Ghahramani. Dr. Ghahramani emphasized the important role of organizations such as Edge, New Jersey Big Data Alliance, and NJ AI Hub in facilitating collaborations and shared infrastructure to support cutting-edge research and education initiatives across New Jersey.

The day-long event featured United States Senator Andy Kim who delivered an inspiring speech focused on Building the Einstein Corridor in New Jersey. Multiple panel discussions explored ing Rutgers' AI and data science ecosystem innovation strategy. Thank you to Dr. Stephen K. Burley, Director of the Rutgers Artificial Intelligence and Data Science (RAD) Collaboratory and President of the New Jersey Big Data Alliance, Dr. Fay Cobb Payton, Executive Director of the Institute of Data Research and Innovation Science (IDRIS), and  Dr. Leslie Lenert, Director of the Center for Biomedical Informatics and Health Artificial Intelligence (BMIHAI), who served as event organizers and hosts.

Provosts and research leaders from Rutgers-Camden, Rutgers-Newark, Rutgers-New Brunswick, and Rutgers Health participated in roundtable discussions examining opportunities for cross-campus synergies and collective impact. The symposium also featured a panel of postdoctoral fellows and Ph.D. candidates showcasing emerging research talent across the university.

The breakout session brought together community stakeholders to address critical questions about building a robust AI and data science ecosystem, including infrastructure needs, sustainability, and the role of interdisciplinary collaboration.

The Roadmaps to Collective Academic Excellence initiative is supported jointly by the Office of the Executive Vice President for Academic Affairs and by the four Rutgers Chancellors.

About Edge

Edge is a member-owned, nonprofit provider of high-performance optical fiber networking and internetworking, Internet2, and a vast array of best-in-class technology solutions for cybersecurity, educational technologies, cloud computing, and professional managed services. Edge's membership spans across the nation, serving colleges and universities, K-12 school districts, government entities, hospital networks, and nonprofit business entities. Edge's common good mission ensures success by empowering members for digital transformation with affordable, reliable, and thought-leading purpose-built advanced connectivity, technologies, and services.

For more information, visit www.njedge.net.

The post Dr. Forough Ghahramani Delivers Talk Dedicated to Empowering Research and Education through Advanced & Emerging Technologies at “New Horizons for AI and Data Science Symposium” at Rutgers University appeared first on Edge, the Nation's Nonprofit Technology Consortium.

2025 marked a turning point: digital trust moved from concept to operational reality. Three developments proved DIACC’s value as a neutral convener: 1. Scalable Evidence

Canada’s legal sector processed 700,000+ client IDV transactions, proving digital trust works at enterprise scale in highly regulated environments. This isn’t pilot data – it’s production, and it’s positioned Canada as a global early adopter.

2. Certification Maturity

Treefort and FCT achieved PCTF Verified Person certification. Outlier became Canada’s first DIACC-accredited auditor, expanding ecosystem capacity. The PCTF Legal Professionals Profile transformed practices into auditable standards.

3. Policy Influence

We submitted comprehensive Federal Budget recommendations, shaped AI Strategy consultations, and influenced Canada-EU Digital Trade discussions. Quebec’s Bill 82 and BC’s Connected Services initiative demonstrate provincial leadership aligned with DIACC principles.

The Urgency is Clear

AI-generated fraud and misinformation threaten economic stability. DIACC’s work has never been more critical. Our new Canadian Digital Trust Adoption Dashboard provides unprecedented transparency into provincial programs. Our partnership with the SIROS Foundation positions Canada to leverage credentials for cross-border labour mobility.

These accomplishments were possible through your expertise, dedication, and collaborative spirit. As we look ahead, the gap between leading jurisdictions and emerging markets creates pathways for growth. The global identity verification market is growing at a 16.7% CAGR.

Canadian providers are positioned to capture this opportunity—if we maintain momentum.

Download the report here.

DIACC-Annual-Impact-Report-2025

On December 2nd, 2025, the digital identity community gathered in Taipei for the FIDO Taipei Seminar 2025. Under the theme “Welcome to Passkey World,” the event brought together around 300 CISOs, business leaders, government officials, and identity architects to discuss the accelerating global shift away from passwords and the rapid adoption of phishing-resistant authentication across the Asia-Pacific region.

Setting the Stage: Global Momentum, Local Leadership

The seminar kicked off with a strong message on the state of the industry. Karen Chang, Chair of the FIDO Taiwan Regional Engagement Forum, and Andrew Shikiar, CEO & Executive Director of the FIDO Alliance, opened the day by framing the global success of passkeys.

Andrew Shikiar shared updated metrics on the global adoption of FIDO standards—noting that billions of user accounts are now secured by passkeys—while emphasizing that the technology has moved from “early adoption” to “mainstream deployment.” Karen Chang highlighted the region’s critical role in this ecosystem, detailing how local industries and government bodies are integrating these standards to build a more resilient digital infrastructure.

Keynote: AI, Identity, and Digital Trust

No technology conversation in 2025 is complete without addressing Artificial Intelligence. Dr. Yennun Huang, Distinguished Research Fellow at Academia Sinica and former Minister of Digital Affairs, delivered a compelling keynote titled “AI, Identity, and Digital Trust.”

Dr. Huang bridged the gap between policy and technology, warning that as AI tools reshape the threat landscape, traditional authentication methods are becoming obsolete. He argued that phishing-resistant authentication is no longer just a security feature but a foundational requirement for establishing trust in the AI era.

From the Trenches: Deployments, Strategies, and Future Tech

The sessions then shifted focus to execution, featuring a chronological lineup of industry leaders sharing insights on platforms, deployments, and certification.

Google: The Google team, represented by Niharika Arora and Eiji Kitamura, demonstrated the latest platform enhancements designed to smooth the implementation path for developers.

Keypasco: As the Host Sponsor of the event, Hsin-Yi Lin, General Manager, spoke on “The Passkey Era: Embrace Passwordless Transformation,” offering a roadmap for enterprises to embrace passwordless transformation without disrupting existing workflows.

Mercari: Naohisa Ichihara, CISO of Mercari, provided a view into the e-commerce sector, explaining how FIDO standards are helping the platform reduce fraud rates while keeping checkout flows seamless.

OneSpan: Koh Gim Leng explored “Augmenting Passkey for Different Use Cases,” discussing how to tailor authentication experiences to fit diverse security requirements and user behaviors.

FIME: James Daniels highlighted the “Value of FIDO Certification,” emphasizing how rigorous testing and certification are essential for ensuring global interoperability and trust in authentication products.

HID: Edwardcher Monreal presented “The Passkey Playbook,” outlining a phased approach that allows organizations to transition from legacy credentials to passkeys at a pace that suits their infrastructure.

TikTok: Yan Cao, Engineering Leader at TikTok, shared a fascinating case study on rolling out passkeys to hundreds of millions of users globally, proving that robust security does not have to come at the expense of user experience.

Jmem Technology: Shifting the focus to hardware, John Chang discussed “Building Secure Chips for the Quantum Era,” highlighting the intersection of Post-Quantum Cryptography (PQC) and trusted edge AIoT integration.

Innovation at the Edge: IoT and Zero Trust

The seminar concluded its technical tracks by exploring how authentication standards are securing the Internet of Things (IoT) and edge computing.

A standout moment was the presentation by Simon Trac Do, CEO & Founder of VinCSS. He introduced a “creative combination” of FIDO authentication and FIDO Device Onboard (FDO) standards, demonstrating how fusing these technologies creates a comprehensive Zero Trust Network Access (ZTNA) solution that secures both user identity and device integrity in the IoT era.

Meanwhile, Doris Liu from ASRock Industrial shifted the focus to the hardware foundation of intelligent systems. In her session on pioneering secure Edge AI, she outlined how ASRock is leveraging FDO deployment to build trusted devices, offering a robust, one-stop solution for the burgeoning Edge AI market.

Panel Discussion: The Road Ahead

The day concluded with a dynamic panel discussion moderated by Megan Shamas, CMO of the FIDO Alliance. Panelists, including Koichi Moriyama (NTT DOCOMO, FIDO Executive Council Member, FJWG Chair), Paul Liu (Keypasco), Jiunn-Shiow Lin (Ministry of Digital Affairs), Da-Yu Kao (National Chengchi University), and Niharika Arora (FIDO India Working Group Chair), explored the future of identity.

The conversation reinforced a clear consensus: the standards are mature, the technology is ready, and the focus must now shift to optimizing usability and broadening adoption across all sectors.

Looking Forward

The FIDO Taipei Seminar 2025 was a testament to the strength and collaboration of the APAC identity community. As we move into 2026, the partnership between government, industry, and standards bodies will be the key to finally eliminating the password for good.

A special acknowledgment goes to our Host Sponsor, Keypasco, and other sponsors for their generous support in making this event possible, as well as to all our speakers and attendees. We look forward to seeing you at our next event!

1. What is the mission and vision of EEZE?

Mission:
EEZE is dedicated to helping the automotive industry prevent and deter fraud and identity theft, protecting dealerships, lenders, and their valued customers.

Vision:
Our vision is to create a trusted automotive ecosystem where secure, worry-free transactions are the standard, empowering businesses and consumers alike.

2. Why is trustworthy digital identity critical for existing and emerging markets?

Digital trust and identity verification are critical because identity fraud is becoming increasingly sophisticated and pervasive. Criminals are now leveraging state-of-the-art technologies, including AI, deepfakes, and automated bots, to manipulate personal data, create synthetic identities, and bypass traditional security measures. In both existing and emerging markets, this threatens consumers, businesses, and financial institutions by facilitating fraud, financial loss, and erosion of trust. Robust digital identity verification is essential to ensure that individuals and organizations can transact securely, prevent fraud, and maintain confidence in the digital economy. Moreover, Verification platforms should give consumers clear control and trust over how their data is shared and stored.

3. How will digital identity transform the Canadian and global economy? How does your organization address challenges associated with this transformation?

Digital trust and identity verification are transforming the Canadian and global economy by enabling secure, transparent transactions and reducing fraud. In an ever-evolving world, where fraudsters have access to the latest AI and sophisticated technologies, it is critical to have the right checks and balances. Organizations like EEZE must continuously adapt to emerging threats, ensuring robust verification and protection for consumers, dealers, and lenders alike

EEZE tackles this by continuously enhancing our system with additional layers of identity verification, validating individuals, vehicles, and transactions to protect consumers, dealers, and lenders from fraud and identity theft. Customers using EEZE have clear control over how their data is shared and stored. By building trust into every transaction, we help create a safer, more efficient digital economy.

4. What role does Canada have to play as a leader in this space?

Canada can lead in digital trust and identity verification by setting high standards for security, privacy, and innovation. By supporting organizations like EEZE and promoting robust verification practices, Canada can reduce fraud, build global confidence in digital transactions, and serve as a model for secure digital identity solutions worldwide.

5. Why did your organization join the DIACC?

EEZE joined DIACC because a governing organization like DIACC provides a platform for collaboration across the industry. By bringing together vendors, competitors, and stakeholders as a collective braintrust, together with DIACC, it will foster the development of innovative solutions that enhance security, strengthen digital trust, and combat fraud on an industry-wide scale.

6. What else should we know about your organization?

EEZE is a hyper-focused, customizable platform tailored for the automotive industry. We envision a solution where all vendors in this space can collaborate to stay ahead of identity theft and fraud by securely sharing information through a centralized “Citadel.” This is a project we aim to launch in late 2026, and we believe DIACC and its members could greatly benefit from participating.

In November we took part in Passkeys Week, an industry-wide campaign to accelerate the adoption of passkeys and encourage developers to build passkey support into their apps, websites, and authentication products.

Throughout the week, we released early selections of talks and presentations from our flagship Authenticate 2025 event, shared resources, highlighted passkey success stories from industry leaders, and hosted a live AMA webinar.

In case you missed any of the action on social media, we’ve rounded up everything we shared to help promote the work of those leading the way with passkey deployments and to support everyone on their passkey journey.

Early Access: Authenticate 2025 Presentations

We released early access to select presentations from Authenticate 2025, our flagship conference held in October. These presentations showcase how leading organizations are deploying passkeys at scale and achieving measurable results. These talks are all available to watch on our YouTube channel.

Apple: Ricky Mondello shared insights on how to “Get the Most out of Passkeys.” Google: Chirag Desai and Rohey Livine discussed “The Future of the User Account Lifecycle.” TikTok: Cherise Cen, Patrick Liao, and Yingran Xu presented on “Shipping passkeys for hundreds of millions” and shared what they learned during the process. Roblox: Yuki Bian and Dylan Siegler gave a fascinating look at “Bringing passkeys to all ages,” addressing deployment across a younger demographic. Uber: Ryan O’Laughlin discussed “Realizing the Full Potential of Passkeys at Uber.” PayPal: Mahendar Madhavan, Mohit Ganotra, and Walmik Deshpande shared “Learnings and best practices” from their deployment. DocuSign: Yuheng Huang and Dina Zheng presented on “Modernizing Authentication with True Passwordless.” Dashlane: We released two sessions from Dashlane. First, Tina Zhuo spoke on “Leveling up phishing resistance” using passkeys, confidential computing, and AI. Second, Rew Islam gave a talk titled “What’s wrong with passkeys?”

Success Stories

We also shone a spotlight on companies that have made progress on their Passkey Pledge – a call to action for organizations to accelerate passkey adoption. Here are just a few of the success stories we shared:

Atlancube: The pledge accelerated their certification timelines, helping them prepare to launch a certified hardware security key. Dashlane: Integrated FIDO2 security keys to replace the master password with a hardware-backed secret. First Credit Union: After rolling out passkeys to their 60,000+ members, 54.5% of all authentications now use passkeys. Glide Identity: Achieved FIDO certification for new products to serve organizations seeking interoperable solutions. HYPR: Deployed passkeys at scale to Fortune 500 enterprises, including two of the four largest US banks. LY Corporation: Improved passkey sign-in rates to 41% and reduced SMS transmission costs by replacing OTPs. NTT DOCOMO: Confident of increasing passkey usage by 10% this year by refining user messaging on enrollment pages. Secfense: Enabled passkey sign-ins across banking and insurance sectors without modifying legacy applications. Thales: Extensively promoted the benefits of passwordless to customers through workshops and webinars.

You can read more about these success stories on our website. It’s not too late to take the Pledge, you can find out more here.

Resources

Throughout the week, we pointed to key resources to help those implementing passkeys, including:

Design Guidelines: For consumer use cases, visit PasskeyCentral.org to access the FIDO Alliance Design Guidelines. Developer Hub: For technical resources brought to you by the W3C WebAuthn Community Adoption Group and FIDO Alliance, visit passkeys.dev. UX Research: Read our blog, “Beyond the Protocol,” co-authored by Patryk Les (Yubico) and Philip Corriveau (RSA), which highlights the human-centered shift defining the future of workforce security.

New Data

We shared new research from our Passkey Index, a confidential survey of nine FIDO Alliance member organizations—Amazon, Google, LY Corporation, Mercari Inc., Microsoft, NTT DOCOMO, PayPal, Target, and TikTok—that have deployed passkeys for 1 to 3 years on eight utilization and performance areas. It shows the adoption and business impact of passkeys from leading service providers. The data reveals that:

93% of accounts are now eligible for passkeys. 36% of accounts are enrolled with a passkey. 26% of all sign-ins now leverage passkeys. Read the full Index here.

We also highlighted Dashlane’s new report, which offers a one-of-a-kind look at the apps leading the move to passwordless across consumer and enterprise environments globally. You can read the report here.

The Passkeys AMA

To wrap up the educational aspect of the week, we hosted a live, interactive Ask Us Anything (AMA) session. With speakers from Dashlane, FIDO Alliance, Google, and Okta, this webinar was the perfect chance to bring questions about passkey implementation, UX, security, standards, and ecosystem adoption directly to the experts shaping the industry. If you missed the live session, you can still watch it here.

Enterprise passkey adoption has reached a tipping point. According to new data from HID and the FIDO Alliance, two-thirds of executives believe that passkey deployment is a high or critical priority, and 87% have either successfully deployed or are currently deploying passkeys.

The challenge? Often, it’s the very first step. 

Today’s Alpha Launch marks the first live deployment of Energy Web’s Verified Compute Cloud (VCC) on Energy Web X, leveraging the blockchain platform’s advanced capabilities, including the newly introduced EWX liquid staking. This integral solution enables EWT holders, participating as stakers and/or VCC compute node operators, to be compensated for serving sustainability markets via protocol-level VCC solution service fees. The first commercial VCC pilot on EWX facilitates a decentralised, multiparty validation of public Sustainable Aviation Fuel Certificate (SAFc) data on the SAFc Registry which can be tracked in the explorer.

Liquid staking is one of the key enablers of this digital service, allowing EWT holders to stake their tokens without removing them from circulation. They deposit EWT into a pooled nominator and receive stEWT, a liquid representation of their stake. This stEWT can simultaneously contribute to EWX network security and be re-staked to back the accountability requirements of a VCC solution. Importantly, pooling removes the barrier for smaller actors who do not have the capacity or do not wish to manage infrastructure to engage in on-chain network activity. Moreover, any received rewards are automatically restaked, increasing the stEWT:EWT exchange rate over time without minting new tokens (exchange-rate changes reflect protocol mechanics and service-fee distribution, not guaranteed growth or financial return). This simplifies the staking process for users, removes the need to manage delegations and restake rewards while compounding utility, safeguarding network security and avoiding excessive concentration of stake. Slashing is an important part of this process as it prevents malperformance.

Verified Compute Cloud EWX Pilot Application in Partnership with SAFc Registry

Verified Compute Cloud is Energy Web’s innovative off‑chain business logic computation service with on-chain finality, supporting verification, automation and auditability for sustainable, mission-critical enterprise solutions.The VCC Alpha Launch introduces the first live Verified Compute Cloud pilot on the EWX network, conducted in partnership with the SAFc Registry. The SAFc Registry, founded by three clean tech organisations, the Rocky Mountain Institute, the Environmental Defense Fund and SABA, has been operated by Energy Web since its launch at the December 2023 COP28 climate conference in Dubai. With the VCC model innovation introduced in December 2025, the SAFc Registry principle workflows will be continuously audited, embedding data input and process outcome authenticity. EWX network participants engaged in this VCC solution delivery will validate public SAFc Registry data for each retired (officially issued) certificate.

In this process, independent distributed nodes (VCC operators) verify emissions-reduction calculations, check whether certificates were previously claimed, and corroborate whether each retirement meets SAFc classification rules on beneficiary type, claim year, and production and blending dates. Energy Web’s VCC service solidifies confidence in the integrity and accuracy of each SAFc retirement, delivering a higher-quality and more reliable level of oversight than is possible with today’s largely manual, scope and time-restrictive audit processes. For EWX network stakers, this pilot represents the first opportunity to deploy stEWT to support a live Verified Compute Cloud solution. By staking into the SAFc Verified Compute Cloud solution group, participating EWT holders contribute directly to securing an important sustainability process validation. SAFc VCC Solution payment (service fees) is routed on-chain to compensate performant EWX network participants based on their operational and staking contributions, with payments executed in stablecoin (USDC) pursuant to a solution compensation contract over the three-month technical alpha launch period. VCC service fees are expected to increase gradually throughout the period, as more certificates are purchased on the SAFc platform, increasing the total available compensation pool. Service fees will also be variable, since the number of certificates purchased via SAFc Registry varies from month-to-month. No specific level of compensation is guaranteed, with relevant parameters adjusting based on participation levels, network performance and any future upgrades or modifications related to network operations. Any received USDC-denominated service fees can be held by users in their wallet on the EWX network, or transferred to Polkadot Asset Hub via wallet providers (such as SubWallet), or via extrinsic calls through Polkadot.JS for any further action or exchange.

How EWT Holders Can Prepare and Participate

Through the ecosystem of applications on EWX, users will be able to participate in the SAFc Verified Compute Cloud solution by acquiring (or moving their tokens to EWX), liquid staking and then committing their stEWT to the relevant Verified Compute Cloud Solution Group (VCG). The first step is to ensure a sufficient EWT token holding on EWX, and based on current mechanics a minimum of 3,500 stEWT is required to subscribe to the Alpha Launch VCC SAFc solution group. If EWT holders store tokens on the legacy Energy Web Chain, or have already bridged tokens to Ethereum, they can use the Energy Web Bridge interface and this guide to move these to EWX. Next, participants should liquid stake their EWT tokens on EWX, through the EWX Staking interface using this guide, receiving stEWT in return. Finally, the EWX Marketplace interface can be used to select the SAFc solution group, complete the KYC process and contribute stEWT to complete the subscription process. Guides for completing the KYC process and subscribing to solution groups can be found here.

During the initial phase of the SAFc VCC pilot, staking contributions will be open to any KYC-ed user, while the VCC computation service operation shall be limited to a vetted set of operators. At the discretion of the SAFc registry governance as a VCC client, VCC operation may be expanded to include a broader segment of the community as the pilot progresses. This phased approach allows the community to begin participating immediately through staking, while ensuring that node operations scale efficiently as Verified Compute expands.

VCC Service Slashing Mechanics

The VCC solution technical alpha launch applies an initial, conservative slashing configuration for Verified Compute Cloud operators, designed to enforce baseline performance and protocol compliance while allowing greater operational tolerance during this first production validation phase. The operational objective of this phase is to collect real-world performance data and validate end-to-end workflows under live conditions. Accordingly, slashing thresholds are intentionally set at higher tolerance levels than those expected under standard operating conditions. As an additional protection measure, any slashed funds are temporarily routed to a multisignature-controlled holding address for review and may be returned where slashing is determined to be unwarranted under the applicable VCC protocol.

The causes for slashing fall into two categories: Operational Penalty and performance penalties. Operational Penalty are triggered based on an outcome of a disputed or failed voting round (the cycle in which operators submit their verification results on-chain). The penalty renders orchestrated attacks and malicious behaviour economically unviable, while protecting the reliability of outcomes of applications leveraging Verified Compute Cloud. Operational Penalty would only occur under extreme and rare circumstances, but must remain sufficiently strong to achieve the aforementioned objectives. Performance penalties monitor each VCC operator’s individual performance in a voting round, penalising those that fall far below the agreement performance thresholds. These penalties ensure a minimum quality of service from each operator.

Energy Web X On-Chain Service Scaling

The SAFc VCC Solution Alpha Launch brings together the core components of the 2025 Energy Web platform upgrade into a single operational workflow for the first time.

Verified Compute enables verification, automation and auditability for sustainable, mission-critical enterprise solutions; Liquid Staking (stEWT) expands participation and unlocks new on-chain utility; Energy Web Bridge provides multichain mobility and broader ecosystem reach; The SAFc Pilot demonstrates these capabilities in a real, commercial application context and delivers immediate value to management and users of the SAFc Registry.

Together, these components form the foundation of a decentralised digital infrastructure designed for high-integrity climate and energy applications. They enable continuous validation, transparent audit trails and automated rule compliance, all of which are essential for markets such as renewable energy tracking, sustainable fuel certification, supply chain emissions accounting and grid operations. This launch marks the beginning of a new phase for Energy Web X, where staking, compute and real-world decarbonisation workflows operate together to deliver trust, automation and transparency at scale.

Alpha Launch: Liquid Staking and Verified Compute Cloud on Energy Web X was originally published in Energy Web on Medium, where people are continuing the conversation by highlighting and responding to this story.

The FIDO Alliance has released a major update to its Metadata Service (MDS) that is intended to improve how relying parties vet passkey and FIDO authenticator devices, with a particular focus on compliance, security assurance, and user experience. In a news post announcing the changes, FIDO describes the new MDS v3.1 and v3.1.1 releases, along with a new Convenience Metadata Service, as a critical step in supporting the continued evolution of the FIDO ecosystem.

New Standards Strengthen Trusted Data Exchange Across Government and Enterprise Applications

Boston, MA – 9 December 2025 – OASIS Open, the international open source and standards consortium, announced the approval of two new OASIS Standards: NIEM Model Version 6.0 and NIEM Naming and Design Rules (NDR) Version 6.0. These standards represent a transformative evolution for NIEMOpen that, for over two decades, has enabled the effective and efficient sharing of critical data in the justice, public safety, emergency and disaster management, intelligence, and homeland security sectors. 

NIEM Model v6.0 introduces a modern, flexible architecture that positions the framework to serve the evolving needs of public and private organizations, featuring a format-agnostic framework supporting XML, JSON, and RDF. NIEM Naming and Design Rules (NDR) v6.0 provides the normative specifications for creating data models, namespaces, schemas, and messages that conform to the NIEM framework, defining enforceable rules for naming conventions, documentation, structural integrity, and conformance targets that enable seamless integration with diverse enterprise architectures and applications.

“These standards mark a pivotal moment in NIEMOpen’s evolution,” said Paul Wormeli, Chair of the NIEMOpen Project Governing Board (PGB). “While we celebrate the hundreds of conformant information exchanges already built on NIEMOpen, NIEM Model v6.0 and NIEM NDR v6.0 represent our commitment to expanding the framework’s reach across new domains and supporting trustworthy AI through standardized, interoperable data.”

NIEMOpen 6.0: Next-Generation Interoperability 

Through its revolutionary Common Model Format (CMF) approach, the releases debut powerful new tools including an enhanced API 2.0 and CMF Tool command-line utility, enabling developers to seamlessly translate between data formats. By integrating knowledge graph support, data is AI-ready while maintaining the semantic consistency and interoperability that have defined NIEM for more than 20 years.

A Legacy of Industry Impact and Collaboration

NIEMOpen, which became an OASIS Open Project in October 2022, originated as the National Information Exchange Model (NIEM) in the wake of the September 11, 2001 attacks to address the urgent need for improved information sharing between agencies. Formally launched in April 2005 by the CIOs of the U.S. Department of Homeland Security and Department of Justice, NIEM has evolved into a globally adopted standard used across all 50 U.S. states, numerous federal agencies, and organizations worldwide.

Premier Sponsors supporting NIEMOpen include the Joint Staff JS-J6 Command, Control, Communication, & Computers/Cyber; the US Department of Homeland Security Science and Technology; and the US FBI Criminal Justice Information Systems (CJIS) Division. Additional sponsors include All Purpose Networks, Georgia Tech Research Institute, IJIS Institute, Office of Data Governance and Analytics (ODGA) – Commonwealth of Virginia, Senzing, and the US National Association for Justice Information Systems (NAJIS).

Technical contributors, researchers, and organizations are welcome to participate in its open source community and support its ongoing work. OASIS welcomes additional sponsorship support from companies involved in this space. Contact join@oasis-open.org for more information.

Support for NIEMOpen 

FBI Criminal Justice Information Systems (CJIS) Division
“The FBI is dedicated to streamlining data exchange within the law enforcement and criminal justice systems. By utilizing the National Information Exchange Model (NIEM) and Information Exchange Package Documents (IEPDs), we adopt common vocabulary and standardized processes—reducing costs and development time. This approach promotes consistency across essential data exchanges, enabling us to share pertinent information swiftly and securely, which supports our efforts to crush violent crime and protect the homeland.”
– Timothy A. Ferguson, assistant director of the FBI’s Criminal Justice Information Services Division

Georgia Tech Research Institute
“Georgia Tech Research Institute has played a key role in NIEM since its inception over 20 years ago–providing support to its technical architecture and tooling to assisting data modelers and implementors from across all levels of government. We are developing new open source tools that work with NIEM v6.0 (and all previous versions) as well as online training. GTRI stands ready to help the community leverage v6.0 and advance NIEM’s evolution to meet the growing demands of information sharing.”
– John Wandelt, Georgia Tech Research Institute

Senzing
“Senzing is proud to be a sponsor of NIEMOpen and has worked with the ecosystem and its expanded support for JSON to provide world-class entity resolution for public sector projects.”
– Jeff Butcher, Chief Architect, Senzing

Additional Information
NIEMOpen GitHub Repository

About NIEMOpen

NIEMOpen is a community collaborative between federal, state, local, tribal, and territorial government agencies and the private sector. NIEMOpen includes the data model with over 20,000 harmonized data elements, the naming and design rules for extending the model to include new data elements, the methodology for creating information exchange specifications, the tools created to automate the process of specifying information exchanges, and the online training to use the tools in the data model for information sharing. All of these elements of the framework are available at no cost on the NIEMOpen website. NIEMOpen operates under OASIS Open, an international standards and open-source consortium. https://niemopen.org/

About OASIS Open

One of the most respected, nonprofit open source and open standards bodies in the world, OASIS advances the fair, transparent development of open source software and standards through the power of global collaboration and community. OASIS is the home for worldwide standards in AI, emergency management, identity, IoT, cybersecurity, blockchain, privacy, cryptography, cloud computing, urban mobility, and other content technologies. Many OASIS standards go on to be ratified by de jure bodies and referenced in international policies and government procurement. www.oasis-open.org

Media Inquiries
communications@oasis-open.org

The post OASIS Approves Two NIEMOpen Standards to Advance AI-Ready Data Interoperability appeared first on OASIS Open.

MyTerms will give strength to the Internet’s fabric of human connections, through agentic agreements between people and the organizations that serve them.

The Internet is peer-to-peer, by design. It supports agreements between equals, for the good of both. On that equality a massive amount of new and better dealings can be built, on stronger foundations of mutual agency and respect.

MyTerms are contracts, which are binding mutual agreements between parties. They replace consents, which are corporate protections to which individuals can only acquiesce. Consents give individuals no record of having agreed to anything and cannot be audited or enforced. They are also annoying for both individuals and companies, with massive amounts of operational and cognitive overhead. In most cases they also don’t obey the settings people make.

With MyTerms, individuals, operating as first parties, proffer a contract they choose from a limited list posted on a public website by a neutral nonprofit organization. The company, as the second party, can choose to agree to that contract or an alternate specified by the individual from the same list. Both sign the agreement electronically and keep matching records that can be audited later if need be. If the company declines to agree, the individual can keep a record of that choice, which they are free to share.

This process is described in a new standard from the IEEE called P7012, which is due for publication in January 2026. Its nickname is MyTerms, much as the nickname of IEEE 802.11 is Wi-Fi.

The most basic MyTerms agreement is for services only. This resets the marketplace to what we have in the natural world, where one can visit an establishment for the services it provides, in faith that one will not be tracked out of it for any reason, and data about oneself will not be sold or given to others. It also commits the individual to respect for the establishment and the services it provides.

With MyTerms, voluntary and genuine relationships can be built on a foundation of mutual respect and willingness to engage. Following a MyTerms agreement, individuals can selectively disclose information about themselves and their intentions, and additional services might be provided, in mutually agreeable and fruitful ways.

In this manner, companies can come to know individuals far better than has ever been possible through unwelcome surveillance and algorithmic guesswork and manipulation. Genuine relationships can also replace the coercive kind typified by “loyalty” programs meant constantly to manipulate customers. (Consider how marketers, without irony, speak of customers as “targets” to be “acquired,” shoved through a “funnel,” “controlled,” “managed,” and “locked in” as if they were slaves or cattle.)

The MyTerms standard also says that both sides will use machine agents to make agreements. These can be as simple as browser plug-ins on the individual side and server plug-ins on the corporate side. They can also be AI agents, which is why it is opportune for the standard to be published in an age when AI is still a new and rapidly evolving—for both companies and individuals.

For maximized agency on both sides, AI agents must be private instruments of full sovereignty, meaning they work privately and exclusively for each party. They cannot be instruments of surveillance or control by outside actors of any kind. Working exclusively will also maximize agency for both sides.

Civilization requires privacy. Simple as that. We worked out privacy in the natural world with technologies such as clothing and shelter, and well-understood ways to signal our intentions. The digital world, however, is still new, and not civilized. We lack the equivalents of clothing and shelter, and in their absence, surveillance has become the norm. So has the theater of consent, with its insincere and ineffective cookie notices.

The only way to obtain personal privacy and make good on the Internet’s original promises is with mutually beneficial agreements that begin with the simple privacy requirements we as individuals present to the corporations of the world. With MyTerms, we can start civilizing the worldwide public marketplace, making it a safe and productive environment for business, and everything else that depends on it.

We are thrilled to share that Team “Sigmion” - joint forces of Argonauths and Human Colossus – has been selected as one of the three finalists in the Prawda w Sieci (“Truth on the Web”) challenge, held under the patronage of Centralny Ośrodek Informatyki (COI), the institution behind Poland’s digital-services and identity initiative mObywatel.

Source: https://www.bydgoszcz.pl/aktualnosci/tresc/maraton-programowania-za-nami/

What is HackNation

Prawda w Sieci (Truth on the Web) was one of the themes of HackNation — a new, nationwide hackathon ecosystem organized by the Ministry of Digital Affairs (Ministerstwo Cyfryzacji). This first edition gathered an extraordinary 1,500+ participants, who delivered over 430 projects across 16 thematic categories addressing real problems faced by public institutions.

HackNation is not a typical hackathon. It is the first implementation-driven innovation program for the Polish public sector, created to solve real administrative challenges with real code — and with a clear path to production. Finalist projects, such as ours, are not just prototypes: they are evaluated for practical deployment potential inside the institutions that sponsored specific challenge tracks.

Due to the overwhelming interest and the quality of outcomes, HackNation is already planned to return next year — a testament to how much untapped civic tech energy exists in Poland.

Our Unique Angle: Trust That Follows the Information

Most cybersecurity solutions verify locations — checking whether a website is legitimate, the URL is correct, and the certificate is valid. While necessary, this model collapses the moment information travels outside that domain.

We approached the problem differently:

We don’t bind trust to a website. We bind trust to the information itself.

Using cryptographically bound identifiers and verifiable payloads, our approach allows:

✔ Authenticating a government website
✔ Verifying any content that originates from it — even after it leaves the website
✔ Detecting manipulation in screenshots, copied texts, PDFs, or printed documents
✔ Extending trust to both digital and offline channels
✔ Integrating seamlessly with identity frameworks such as mObywatel and future eIDAS 2.0 wallets

This allows truth to become portable, not trapped inside a URL.

Why This Matters

We are entering an era where:

cloned sites are trivial to generate,

phishing outpaces awareness campaigns,

AI can fabricate screenshots indistinguishable from the original,

and public trust is routinely weaponized.

If trust depends only on where content is hosted, it becomes fragile.

Our vision introduces a new paradigm:

Trust becomes cryptographic, portable, and citizen-verifiable — anywhere, anytime.

This empowers Poland to set a global standard in digital public trust, extending the achievements of mObywatel beyond identity into the realm of verifiable truth.

What’s Next

Being among the top three among 300 project in such a competitive field is an honor — but for us, it feels like the start of something bigger.

We cannot wait to continue our collaboration and bring this prototype toward production. With institutional backing, what began during HackNation can evolve into a national — and possibly European — trust layer for public information.

If successful, citizens will no longer need to ask:

"Can I trust this website?"

Instead, they will be able to ask:

"Can I verify that it comes from authorize source?"

Stay tuned — the next chapter begins now.
Team Argonauths / Human Colossus

At a meeting held in Tokyo on December 5th, the FIDO Alliance explained the current status of the adoption of “Passkey Authentication (FIDO2)” and announced that as a new initiative, it aims to realize a secure and convenient digital wallet that stores digital credentials.

Passkey authentication is a system for accessing an account by verifying identity using a device, biometric information, PIN, etc. Since its introduction by NTT Docomo and PayPal in 2022, it has rapidly gained popularity as a secure method highly resistant to phishing attacks that target traditional authentication information such as IDs and passwords.

According to Executive Director and CEO Andrew Shikiar, the number of accounts using passkeys will reach over 3 billion by 2025, with approximately 15 billion potentially available accounts by 2024. Organizations such as the US National Institute of Standards and Technology (NIST) and the European Cybersecurity Agency (ENISA) have included passkeys in their security policies, and the system is also being increasingly adopted by government agencies, online services, and the private sector, particularly in the financial sector.

New Digital Credentials Working Group to work with global FIDO Alliance members and industry partners to align digital identity ecosystem 

December 4, 2025 – The FIDO Alliance announced today the launch of a new digital credentials initiative, marking an expansion of its mission to accelerate the adoption of verifiable digital credentials and identity wallets. This initiative is poised to help the world simplify and secure online and in-person interactions by establishing a trusted, and interoperable identity wallet ecosystem.

Work on this new initiative will be carried out by the FIDO Alliance’s new Digital Credentials Working Group (DCWG). 

“FIDO Alliance united the industry to solve the password problem, and the world is now embracing the simplicity and security of passkeys – with billions of accounts now leveraging this seachange in user authentication. We’re now aiming to bring that same proven, collaborative model to the adjacent digital credentials landscape — working closely with partners including EMVCo,  ISO, OpenID Foundation, and W3C to align a fragmented ecosystem,” said Andrew Shikiar, CEO of FIDO Alliance. “Together, we aim to deliver trusted, interoperable digital wallets that make everyday interactions simpler, more secure, and privacy-preserving for everyone.”

Digital credentials have the potential to offer enhanced ease, security, and privacy to everyday interactions and transactions. Governments around the world are helping lead the way in issuing digital identity credentials — including the European Digital Identity Wallet program that will see all 27 member states offer citizens digital identities by the end of 2026, and with 18 departments of motor vehicles in the United States having deployed standards-based mobile drivers licenses to over 5 million American citizens.  

Widespread adoption has been hindered by ecosystem fragmentation, however, including a lack of global alignment and end-to-end certification. Building on its success with passkeys, the FIDO Alliance will address these challenges through its proven ability to unite stakeholders, develop specifications and certification programs, collaborate with other standards organizations, and implement global adoption initiatives. By applying these strategies to the digital credentials ecosystem, the FIDO Alliance aims to foster a future where digital credentials are as pervasive, trusted, and user-friendly as passkeys are today – helping secure the entire identity account lifecycle for consumers and businesses around the world. 

FIDO Alliance will focus on three foundational workstreams in partnership with ecosystem partners such as The OpenID Foundation, ISO, W3C, and EMVCo to unblock the digital credentials ecosystem: 

Wallet Certification: This program will establish certification criteria for digital wallets, ensuring they are secure, protect user privacy, and are interoperable with credential issuers and relying parties. This will provide crucial assurance that credentials are handled with proper security, privacy, and functionality. Specification Development: FIDO will develop specifications to complement existing protocols and frameworks from industry partners such as OpenID Foundation, ISO and other standards organizations. For example, the Alliance will develop specifications for presenting credentials across devices by expanding the existing FIDO cross-device protocol. The Alliance also intends to define credential schemes (for example in payments and/or loyalty) as required to address new use cases as they emerge.  Usability and Relying Party (RP) Enablement: This workstream will accelerate adoption by providing the industry with necessary tools, branding, and best practice guidelines for successful implementation. Drawing from its experience with passkeys, the FIDO Alliance will ensure a seamless user experience, which is critical for new technology adoption.

Through these efforts, the Alliance aims to reduce friction for issuers and relying parties, increase user trust in data security and privacy, and create a vibrant, interoperable market for issuers, wallet providers, and identity services.

Work has already commenced, with initial deliverables planned for 2026.

Industry partner comments:

Loffie Jordaan, Business Solutions Architect at AAMVA and Convenor of ISO/IEC JTC1/SC17/WG10 said, “WG10’s work includes standards for digital credential exchange protocols. Wallets, being one side of a credential exchange, have to support these protocols. In addition to requiring support for these protocols, issuing authorities often have additional requirements on the wallets into which they provision, covering things like device security, holder privacy, and credential life cycle management. The FIDO work will allow issuing authorities to confirm if a wallet being presented for provisioning has been certified against a profile representing the issuing authority’s protocol and other requirements. In doing so, the FIDO work will be of significant value to issuing authorities.”

Gail Hodges, Executive Director of the OpenID Foundation said, “OpenID Foundation welcomes FIDO Alliance’s new initiative on digital credentials as an important step toward advancing a secure and interoperable identity ecosystem. Our organizations have a long history of close collaboration on standards that make authentication simpler and more resilient, and we see the same opportunity to align our efforts as the market rapidly moves toward verifiable credentials and identity wallets. We look forward to working with FIDO and the broader community to help ensure that digital credentials are built on open, privacy-preserving standards that scale globally.”

Seth Dobbs, President & CEO, the World Wide Web Consortium (W3C) said, “It will take the cooperation of many to address the challenges and opportunities of Digital Identities on the Web. The W3C Verifiable Credentials and Digital Credentials API specifications are designed to help ensure the privacy and security of web users. W3C is pleased to work with FIDO Alliance and others on the technical foundation for interoperable, secure, privacy-preserving digital credentials that work across different platforms and systems.”

Daniel Goldscheider, Executive Director of the OpenWallet Foundation said, “FIDO Alliance specifications are already foundational to the wallet landscape. We warmly welcome this expansion into digital credentials and wallet certification.”

Patrik Smets, EMVCo Executive Committee Chair, commented: “Through our Digital Identity and Payment Task Force, EMVCo is engaging with industry partners to advance agentic payments, authentication, verifiable digital credentials, passkeys for payment, and digital wallets. Earlier this year, we shared our existing digital payment credential schema activity with FIDO to align and gather feedback from its members. This level of ongoing collaboration is crucial to promoting global interoperability across the ecosystem in how we use identity in payments, and we are committed to working on payments use cases with all stakeholders as this progresses at pace.”

About the FIDO Alliance

The FIDO (Fast IDentity Online) Alliance was formed in July 2012 to address the lack of interoperability among strong authentication technologies and remedy the problems users face with creating and remembering multiple usernames and passwords. The FIDO Alliance is changing the nature of authentication with standards for simpler, stronger authentication that define an open, scalable, interoperable set of mechanisms that reduce reliance on passwords. FIDO Authentication is stronger, private, and easier to use when authenticating to online services. For more information, visit www.fidoalliance.org.

The FIDO Alliance is expanding its flagship Authenticate conference series to the Asia-Pacific region with Authenticate APAC 2026, a two-day event in Singapore dedicated to phishing-resistant authentication and digital identity. The conference will be held June 2 to 3, 2026 at the Grand Hyatt Singapore, followed by a FIDO Member Plenary from June 4 to 5 at the same venue.

We’re excited to announce updates to the FIDO Metadata Service (MDS), which helps ensure organizations have the information necessary to successfully validate authenticators. As organizations deploy passkeys and FIDO authentication, it is critical to validate trusted, certified authenticators.

This is especially useful to deploying organizations in regulated industries and organizations handling sensitive data. These organizations can use MDS to verify that accepted authenticators meet certain criteria, such as FIDO L1, L2 and L3 certifications for compliance, as well as leverage security issue notifications to determine suitable responses.

To support the continued evolution of the FIDO ecosystem, we have released an update to the MDS that provides new tools for relying parties (RPs) to verify authenticator compliance, improve interoperability and life cycle management, while enhancing the user experience. This includes several substantial enhancements to the existing service:

Standardized Security Policy Enforcement: RPs can now ensure the correct level of FIPS compliance by verifying that authenticators meet their exact security criteria before granting access. Streamlined Cross-Provider Integration: RPs can dynamically discover and retrieve detailed information about the passkey provider’s Credential Exchange (CX) definitions, streamlining the process of cross-provider communication and setup. Authenticator Lifecycle Management: The addition of a new “retired” authenticator status value to accurately reflect MDS entries that are no longer actively supported or recommended for use. This status will help RPs maintain secure and up-to-date deployment strategies by clearly flagging deprecated metadata. MDS Version Check: Cuts processing times by introducing localCopySerial, a new parameter that can be specified to only return metadata if a new version of the MDS BLOB is available.

In addition to these MDS updates, the FIDO Alliance also launched a new Convenience Metadata Service. This enables RPs to offer a consistent user experience so that end-users see the same presentation of their passkeys, no matter which service or platform they’re using, to simplify the process of selecting and managing their credentials. This includes standardized, user-friendly names for passkey providers, and high-quality logos for RPs to use in user interfaces and presentation layers.

The updated FIDO MDS and the new Convenience Metadata Service are now live. For more information, visit https://fidoalliance.org/metadata/. For technical questions, implementation guidance, or inquiries regarding the new MDS versions or the Convenience Metadata Service, please reach out to support@mymds.fidoalliance.org.

IBM, Microsoft, and Industry Partners Launch ODF 1.4 with Enhanced Accessibility, Compatibility, and Security Across Platforms

BOSTON, MA, 3 December 2025 — Members of OASIS Open, the global open source and standards organization, have approved the Open Document Format (ODF) for Office Applications V1.4 as an OASIS Standard, the organization’s highest level of ratification. ODF V1.4 improves developer documentation, adds new features, and maintains full backward compatibility.

The release of ODF V1.4 coincides with the 20th anniversary of ODF as an OASIS Standard. Over two decades, ODF has served as a vendor-neutral, royalty-free format for office documents, ensuring that files remain readable, editable, and interoperable across platforms. Governments and international organizations, including NATO, the European Commission, and countries across multiple continents, have adopted ODF for document exchange.

“ODF V1.4 is the effort to evolve the ODF format to its newer challenges, adding relevant clarification and additions to the existing ODF V1.3,” said Patrick Durusau, OpenDocument TC co-chair. “We are pushing hard to meet expectations of the Office software industry.”

OpenDocument V1.4 contains enhancements in accessibility, professional document formatting, and advanced functionality across text documents, spreadsheets, and presentations. Improvements include better support for assistive technologies, enhanced visual design capabilities, and expanded features for data analysis and technical documentation. These updates strengthen OpenDocument’s role as a comprehensive solution for modern workplace productivity and inclusive document creation.

“ODF provides a vendor-neutral foundation for office productivity and collaboration worldwide. With V1.4, the standard continues to evolve, supporting cloud collaboration, richer multimedia, and standardized security,” said Svante Schubert, OpenDocument TC co-chair. “The format will remain reliable across platforms for years to come. Looking ahead, ODF is moving beyond document exchange toward standardized, semantic change-based collaboration — enabling precise, meaningful sharing of interoperable changes across platforms.”

The OpenDocument TC actively encourages global collaboration and input from stakeholders to support the standard’s ongoing evolution and adoption. To learn more about how to get involved, contact join@oasis-open.org.

Additional Information
OpenDocument GitHub
OpenDocument TC Homepage

About OASIS Open
One of the most respected, nonprofit open source and open standards bodies in the world, OASIS advances the fair, transparent development of open source software and standards through the power of global collaboration and community. OASIS is the home for worldwide standards in AI, emergency management, identity, IoT, cybersecurity, blockchain, privacy, cryptography, cloud computing, urban mobility, and other content technologies. Many OASIS standards go on to be ratified by de jure bodies and referenced in international policies and government procurement.www.oasis-open.org

Media Inquiries:
communications@oasis-open.org

The post OASIS Approves Open Document Format (ODF) V1.4 Standard, Marking 20 Years of Interoperable Document Innovation appeared first on OASIS Open.

Are you a digital security trainer, a helpline responder supporting spyware cases, or someone who accompanies communities through security challenges? If you missed our recent Community Call on Psychosocial Support & Digital Safety, we’ve got you covered.

The post Community call recap: psychosocial support & digital safety appeared first on The Engine Room.

November 19 was a big day for EU data policy. It saw the release of the European Data Union Strategy (now reframed to pursue data for AI), the Digital Simplification […]

Shoppers lose trust the moment they see that your data is inconsistent. In this episode, Jon Gatrell of Loren Data Corp. joins Reid Jackson and Liz Sertl to discuss why product information must stay consistent across every channel. Jon explains how aligned data reduces friction between partners, supports accurate inventory management, and strengthens the experience for buyers and internal teams.

This conversation shows how accurate product data becomes the thread that keeps every part of the supply chain working in sync.

In this episode, you'll learn:

The operational value of keeping product data consistent across channels

The challenges that emerge when item information falls out of sync

How accurate data protects customer trust

Things to listen for: (00:00) Introducing Next Level Supply Chain (02:54) What customers expect from product data (05:29) How inconsistent product information affects buying decisions (07:37) The biggest data challenges supply chain teams face today (12:55) What the industry is doing to improve data synchronization (19:32) Data strategy shifts companies should prepare for next (25:19) Jon's favorite tech

Connect with GS1 US: Our website - www.gs1us.orgGS1 US on LinkedIn

This episode is brought to you by:

AccuGraphiX and LSPedia

If you're interested in becoming or working with a GS1 US solution partner, please connect with us on LinkedIn or on our website.

Connect with the guests: Jon Gatrell on LinkedIn Check out Loren Data

As part of Passkeys Week, which took place on November 17 – 21, 2025, FIDO Alliance hosted a live, interactive Ask Us Anything (AMA) session designed for developers, product managers, and anyone building—or buying—authentication products and services. Attendees were able to bring their questions about passkey implementation, UX, security, standards, and ecosystem adoption directly to the experts shaping the industry.

South Korea has eliminated a significant barrier to the usage of the FIDO protocol for passwordless authentication by confirming that it falls outside the scope of a requirement for user consent to process biometrics.

Members of the FIDO Alliance Korea Working Group (FKWG) submitted an official inquiry to the Korea Personal Information Protection Commission (KPIPC), which has responded by stating that the consent rules do not apply to biometric processes performed entirely on user-controlled devices. Since biometric data is not collected, stored or processed by the organization requesting FIDO authentication, the process does not qualify as processing personal information under the Personal Information Protection Act.

Strengthening Korea’s Passkey Ecosystem Through Technical Collaboration and Regulatory Clarity

The FIDO Alliance Korea Working Group (FKWG) held its year-end workshop on November 14, 2025, at the Telecommunications Technology Association (TTA) office in Pangyo. Co-hosted by Samsung Electronics and TTA, the workshop brought together local FIDO members and invited guests to discuss the latest developments in passkey deployment, biometric authentication, and the accelerating momentum behind phishing-resistant authentication across the country.

With a half-day agenda featuring the Q4 member plenary, technical deep-dives, ecosystem updates, and a community networking session, the event highlighted the rapid expansion of Korea’s passkey landscape and the central role of the FKWG in driving adoption across industries.

One of the most important topics covered during the workshop was a newly clarified regulatory interpretation confirming that “FIDO authentication using on-device biometrics does not require separate user consent, since no biometric data leaves the device.”

This clarification removes a long-standing compliance concern for organizations and is expected to significantly accelerate enterprise adoption of FIDO-based biometrics across finance, telecom, commerce, and government services. The update has already drawn national and international attention, including coverage by Biometric Update, underscoring its significance to the broader authentication ecosystem.

Read the Coverage from Biometric Update

The technical presentations and updates from FIDO members provided insights into real-world deployments, new research, and ongoing product development:

Samsung SDS shared lessons learned from large enterprise-scale passkey rollouts at Samsung Group Companies and UX refinement. LINE presented developer-focused guidance and demonstrated how they are using passkeys for end-to-end encryption (E2EE). TTA shared perspectives on AI privacy challenges and mitigation strategies, along with associated regulatory considerations. Korea Quantum Computing (KQC) discussed how they developed PQC-based FIDO security keys, offering a forward-looking view on post-quantum security.

These sessions demonstrated the depth of local technical expertise and the collaborative spirit that defines the FIDO Alliance Korea Working Group community.

The workshop concluded with a networking dinner, a quiz session, and a prize giveaway that added a fun and engaging community element to wrap up the day.

With clear regulatory support, growing cross-industry deployments, and an active technical ecosystem, the FIDO Alliance Korea Working Group is well positioned to accelerate the adoption of phishing-resistant authentication throughout 2026 and beyond.

The FIDO Alliance extends its appreciation to Samsung Electronics, TTA, all presenters, and all members and guests who contributed to this successful event.

We’re excited to welcome Grace Rachmany as the new Executive Director of the Decentralized Identity Foundation!

Grace joins DIF at a critical time. Digital identity is evolving in multiple directions at once—governments building national systems, enterprises balancing privacy with functionality, Web3 projects rethinking sovereignty. The result? A fragmented ecosystem where credentials don't cross borders, privacy promises fall short, and the people who need accessible identity solutions most often can't reach them.

DIF has always focused on practical, interoperable building blocks that enable real systems to work in production, while prioritizing privacy and sovereignty. Grace brings both the technical depth and community perspective to help us expand that mission. Under her leadership, we'll continue doing what DIF does best—creating the foundational standards and infrastructure for decentralized identity—while bringing more voices into the conversation and strengthening collaboration across traditionally separate ecosystems.

Welcome from Kim Hamilton Duffy

It has been a profound honor to serve as DIF’s Executive Director. I’ve been part of this community since its earliest days – in working groups, on the Steering Committee, and ultimately in this role – and I will continue to enthusiastically support DIF. What has given me the most joy is how DIF consistently attracts and nurtures new participants who volunteer their time, contributing new energy and perspectives that continually strengthen DIF’s culture and momentum.

I’m beyond delighted to welcome Grace into this role. Grace has been deeply involved in building communities around decentralized technology that prioritize individual rights and human agency. She brings a rare combination of governance expertise, practical execution, and a deep understanding of how people collaborate in decentralized environments. I'm especially excited about her commitment to global outreach.

Recently, DIF has built remarkable momentum across AI agents, IoT, secure communication protocols, and emerging efforts like travel & hospitality and creator assertions. Grace is the right person to accelerate this work while we navigate key decisions about how DIF evolves as an organization and best supports its growing community. I look forward to supporting Grace's transition as she leads DIF into 2026 and beyond.

— Kim Hamilton Duffy

Meet Grace Rachmany

Grace is a leader in:

new economic models and tokenomics, blockchain governance and DAOs, digital democracy, and distributed organizational leadership

She co-founded Sideways.Earth, served on the Supervisory Council of SingularityNET, and has worked with hundreds of decentralized organizations on practical governance, incentive design, and real-world coordination.
Her work centers on infrastructure for collaboration—how communities make decisions, how decentralized systems scale, and how identity frameworks respect personal autonomy. These themes closely reflect DIF’s core values of individual agency, interoperability, and innovation without gatekeepers.

A Message from Grace

“Digital Identity is a hot topic these days, and it’s also a hot mess…”

As I write this post, I reflect on the e-mail I received this morning from my national Digital ID provider here in Slovenia. I went to the post office yesterday to get a higher security rating so I can access my medical records. At the post office, I presented my government-issued residency card. The e-mail from this morning informs me that my physical presence accompanied by my national residency card is not adequate to prove I am human enough to make a doctor’s appointment.

What I need is a passport or national identification document. By the way, if I used a different bank, I could use a bank card, but my particular bank does not have the right security rating. Presumably, of course, my online banking is much easier than other people’s banking as a result of whatever way they do or do not apply digital certificates and 2FA in their system. In any case, off I go this morning to have another in-person experience with the main post office in the nearby city (not the local inferior branch, mind you).

“Complicated processes with heavy bureaucracies for essential services leave us feeling powerless.”

Digital Identity is a hot topic these days, and it’s also a hot mess, as this story demonstrates. Complicated processes with heavy bureaucracies for essential services leave us feeling powerless and at the mercy of large entities. On the opposite end, we feel creeped-out by seamless experiences such as departing from a London airport with absolutely no human looking at any document from the moment we enter the airport to the moment we board (when someone might potentially check our seat number).

I’m absolutely thrilled to step into the Executive Director Position at DIF at this critical moment for digital identity. I was first introduced to DIF Foundation as part of my expertise in DAOs in Web3. Startups like UPort and Sovrin were positioned to make SSI a part of the Web3 ecosystem. But here I am, 5 years later, scratching my head and wondering how we ended up with SBTs, POAPs and EAS. As a Web3 person who has done a deep dive into identity, reputation, and governance, I know the solutions exist, and yet, digital identity implementation is still squarely in the purview of governments and corporations.

“As a Web3 person who has done a deep dive into identity, reputation, and governance, I know the solutions exist.”

Even more disappointingly, while there is public discourse about digital identity, the public seems unaware of what their real choices are. The UK argument begins and ends with “just say no”. The Swiss referendum’s passing with such a thin margin puts tremendous stress on the government to get the implementation perfect. Both of these examples point to missed communication between institutions and citizens, and the UK example shows a gap in public education about how citizens can have more proactive influence in implementation and design of identity solutions that serve the public good.

As Executive Director, one of my objectives is to bring in a wider group of participants to the discussion. I hope to have more outreach to our partners in different areas of the globe, and will be spending the first quarter of 2026 located in Southeast Asia to get to know those of you in that area of the world. As a “crypto native” and governance expert, I’ll be inviting in more members from the Web3 and Network State communities, as we deepen our relationship with the Ethereum Foundation and others in the space.

Finally, I’d like to thank a few people who kidnapped me in Vienna on the first day of September in 2019 and coerced me to attend some thing called, unappealingly enough, RWOT. The kidnapping clan included long-time DIF board member Marcus Sabadello, Kaliya Identity Woman (who made it sound like I was just going to have a nice weekend in Vienna with cool people), Joe Andrieu (who pretended I had submitted a “paper” idea and gave me the RWOT discount rate), and Adrian Gropper (who spent a 4-hour train ride to Prague drawing little diagrams and explaining to me what DIDs and VCs were). Extra special thanks to Kaliya for sending me an email two months ago saying “you might want to apply for this job.”

Thanks to all of you for once more welcoming me into the identity fam. It’s going to be a fun ride!

— Grace Rachmany

Moving Forward Together

Grace’s priorities—expanding participation, inviting overlooked communities into the conversation, and strengthening ties across Web3 and open-source identity ecosystems—align with the direction many in our community have been moving toward. We share the belief that digital identity must be shaped not only by institutions, but by the people who will use it.

In the months ahead, we’ll continue evolving how DIF supports its contributors, including finding better ways to serve our community globally and ensuring our work remains interoperable, usable, and grounded in real-world needs.

Thank you for continuing to advance digital identity ecosystems that empower people and strengthen trust.

The industry’s premier event dedicated to digital identity and authentication expands globally with Authenticate APAC 2026 in Singapore

SINGAPORE, 02 December – The FIDO Alliance today announced the expansion of its flagship event series with the launch of Authenticate APAC 2026. This marks the first time the industry’s only conference dedicated to digital identity and phishing-resistant authentication will be held in the Asia-Pacific region. The inaugural event will take place on June 2 – 3 2026, followed by a FIDO Member Plenary from June 4 – 5, 2026, at the Grand Hyatt in Singapore.

As organizations worldwide accelerate the shift from passwords to passkeys and begin to unlock the potential of verifiable digital credentials, Authenticate APAC will serve as a regional hub for education, collaboration, and innovation. The decision to bring Authenticate to the region builds on the success of the FIDO APAC Summit held over the last two years. It also reflects the region’s growing influence in the cybersecurity landscape, where recent momentum in government digital identity initiatives and widespread commercial passkey deployments are helping to drive the global standard for secure, user-friendly authentication.

“The FIDO Authenticate conference has become the defining event for the authentication community, and we are proud to extend this platform to the Asia-Pacific region,” said Andrew Shikiar, CEO of the FIDO Alliance. “There is tremendous innovation happening across APAC, and this event will provide a dedicated space for local and global leaders to collaborate and help build the future of a secure, user-friendly and interoperable internet.”

The Authenticate conference series delivers high-quality content with a highly engaged community of professionals committed to advancing passkeys, digital credentials and related technologies. It is designed to bring together CISOs, business leaders, product managers, security strategists, and identity architects to advance their knowledge of digital identity and shape the future of authentication. 

Call for Sponsors and Registration
The FIDO Alliance will offer a wide range of sponsorship opportunities designed to maximize brand exposure and reach target audiences. The 2026 Prospectus detailing sponsorship packages also launched today and is available here. 

Whether you are new to FIDO, in the midst of deployment or somewhere in between, Authenticate conferences have the right content, and community, for you. Registration for attendees will open later this year.

To stay up to date on speakers, sponsorship opportunities, and registration details, please visit the Authenticate APAC 2026 website, @FIDOAlliance on X, and sign-up to the newsletter.

About Authenticate
Authenticate is the premier conference dedicated to advancing digital identity and authentication, with an emphasis on phishing-resistant sign-ins using passkeys. Hosted by the FIDO Alliance, this event brings together CISOs, security strategists, product managers and identity architects to explore best practices, technical insights and real-world case studies in modern authentication.

Authenticate is hosted by the FIDO Alliance, the cross-industry consortium providing standards, certifications and market adoption programs to accelerate utilization of simpler, stronger authentication with innovations, like passkeys.

About the FIDO Alliance
The FIDO (Fast IDentity Online) Alliance was formed in July 2012 to address the lack of interoperability among strong authentication technologies and remedy the problems users face with creating and remembering multiple usernames and passwords. The FIDO Alliance is changing the nature of authentication with standards for simpler, stronger authentication that define an open, scalable, interoperable set of mechanisms that reduce reliance on passwords. FIDO Authentication is stronger, private, and easier to use when authenticating to online services. For more information, visit www.fidoalliance.org.

Contact
press@fidoalliance.org

This post is an extended way of saying come to WAO's *Open* Xmas Party!

We Are Open Co-op (WAO) members want to collaborate. It’s why, almost a decade ago, we formed a cooperative – so that we could continue to work together.

When we started WAO, one of the things we talked a lot about was “solidarity for freelancers” because it's what we wanted most: a cooperative where we could find solidarity and support.

Lately, we've been reminded of this idea. Partly that's because this year has felt strenuous. We’ve felt like a lot of people have been struggling. We have struggled too – while trying to be there for other people as we collectively navigate the harsh realities of doing business in the mid 2020s.

We feel privileged and downright lucky that we are mostly OK. Wanting to go into 2026 both reinvigorated and in a spirit of solidarity, we want to make an offer to you: Let’s find ways to work together in the new year – we’re sure we can help each other.

We recently made a list of what WAO has to offer, which you can see on our wiki. The TL;DR, however, is...

1. Collaboration over Competition

For decades, we’ve contributed to open source projects, run open meet-ups, given “free” advice, met people and worked out loud. We know that the benefits of collaboration aren't just financial, but being able to pay the rent/mortgage kinda helps.

Nevertheless, we don’t have to compete with one another. We can collaborate. We can help you learn new skills around open working, and we're sure you've got stuff to teach us, too. In fact, we're always picking up vital lessons from people in our networks.

2. Networking over Not Working

Speaking of networks, we’re so pleased to have wide networks of really awesome people doing badass things. We want to be part of that even more than we already are and to grow the people with whom we're connected

Since the pandemic, there have been far fewer offline events, which means that online interactions are more important than ever. Let's find ways to get to know one another, discovering our interests, talents, and weird little quirks ;)

3. Solidarity over Solitude

Ultimately, this is all about building the world which we want to exist. That's only going to happen through solidarity and having each others' backs. It's easy to think that the world is against you when things aren't going well, but everyone has a talent and something to offer.

We'd like to find ways in which we can all help one another. That happens by showing up for one another rather than retreating into darkened rooms and doomscrolling on our mobile devices.

So if this post resonates with you and you feel like doing something about it, why not start with WAO's *Open* Xmas party? It's online at 14:00 GMT on Thursday 11th December and YOU are invited. Yes, you.

​Bring your cocoa, wear your hat, and come along for a festive chat! Join us for a laugh or two and we might just have some games for you... 🎄 🎁 🎅

The post Get More out of Open Badges: How Velocity Network complements Open Badges to ensure trust, privacy and utility appeared first on Velocity.

What if children aren’t just AI users to be protected, but experts we should be learning from? At MyData 2025, the MyData4Children workshop turned the usual conversation on its head. […]

For years, HYPR and Yubico have stood shoulder to shoulder in the mission to eliminate passwords and improve identity security. Yubico’s early and sustained push for FIDO-certified hardware authenticators and HYPR’s leadership as part of the FIDO Alliance mission to reduce the world’s reliance on passwords have brought employees and customers alike into the era of modern authentication.

South Korea has eliminated a significant barrier to the usage of the FIDO protocol for passwordless authentication by confirming that it falls outside the scope of a requirement for user consent to process biometrics.

Members of the FIDO Alliance Korea Working Group (FKWG) submitted an official inquiry to the Korea Personal Information Protection Commission (KPIPC), which has responded by stating that the consent rules do not apply to biometric processes performed entirely on user-controlled devices. Since biometric data is not collected, stored or processed by the organization requesting FIDO authentication, the process does not qualify as processing personal information under the Personal Information Protection Act.

Bitwarden has rolled out support for passwordless login via passkeys across its browser extensions and web vault, allowing users to authenticate without entering a username, password, or two-factor code.

As Black Friday 2025 approaches, passwords remain digital security’s weak link, exploited by AI-driven scams. Dashlane CEO John Bennett champions passkeys for frictionless, phishing-resistant authentication, with e-commerce leaders like Amazon leading adoption. Dashlane’s tools and deals bolster fraud protection for shoppers and businesses.

Live from Authenticate 2025, Jeff Steadman and Jim McDonald sit down with the Cal Ripken of IDAC, Andrew Shikiar, Executive Director and CEO of the FIDO Alliance. Andrew shares exciting updates on the incredible progress of Passkeys, revealing that over 3 billion are now in use securing accounts. We discuss the key themes of the conference, including the ongoing arms race with AI in security and the critical role of identity verification. Andrew also unveils the new Passkey Index, an initiative to provide industry benchmarks for deployment success. Looking ahead, the conversation shifts to the FIDO Alliance’s broadening focus on digital credentials and wallets, aiming to solve the usability and certification challenges that have held the space back. Finally, we hear about the global expansion of the Authenticate conference brand, with a new event launching in Singapore.

Listen to the podcast: https://www.identityatthecenter.com/listen/episode/29aaaa94/384-the-fido-alliances-next-frontier-digital-credentials-and-wallets

The post Elements of a Community-Governed Trust Framework (and how Velocity Network delivers them all TODAY) appeared first on Velocity.

By FIDO Alliance UX Working Group’s Enterprise Subgroup leaders Patryk Les, Yubico and Philip Corriveau, RSA

As we celebrate Passkeys Week 2025, the momentum around passwordless authentication is undeniable. Across industries, organizations are taking real steps toward a future where passwords – and the risks they bring – finally fade away.

Recent research from the FIDO Alliance and its members shows that over 85% of enterprises are implementing or evaluating passkeys. The question is no longer if your organization will deploy them – it’s how you’ll do it effectively.

And that’s where the next chapter begins. Because the hardest part of passwordless security isn’t the cryptography – it’s the culture.

People Are Not the Weakest Link – They’re the Strongest Asset

For years, cybersecurity has been framed as a struggle to “fix” users – those who forget passwords, fall for phishing, or sidestep controls. But people aren’t the problem. They’re responding to systems that often work against natural human behavior.

Passkeys flip that model. They align authentication with how people already act – using biometrics, devices, and gestures they trust. When security design works with human tendencies, compliance becomes intuitive and adoption accelerates.

This is more than a technical improvement. It’s a leadership opportunity.

Three Lessons from the Front Lines

The FIDO Enterprise UX Subgroup’s research with enterprise deployments uncovered one clear truth: the biggest challenges are human, not technical. Here’s what leading organizations are learning.

1. Enrollment Is the First Moment of Trust
The first time a user registers a passkey isn’t just a setup step – it’s their first interaction with your new security culture. Complex flows or unclear prompts can create frustration and mistrust before the rollout even begins.

Leaders who treat enrollment as change management – offering clarity, support, and communication – set the tone for success.

2. Users Need a Mental Model, Not a Cryptography Lesson
Practitioners told us: “Give me a one-sentence definition users actually understand.” That’s because awareness without understanding is ineffective. The best explanation we heard?

“A password is an easy-to-copy key you remember.
A passkey is a hard-to-copy key your device remembers.”

Simple, relatable language builds trust far better than technical jargon.

3. Consistency Builds Confidence
When authentication looks different across browsers and devices, it creates decision fatigue and confusion. This isn’t just a UX problem – it’s a behavioral one. Inconsistency erodes confidence; consistency builds it.

Forward-thinking leaders now recognize that usability isn’t a luxury – it’s a security control.

Redefining Success: From Compliance to Culture

Traditional cybersecurity programs measure success through compliance metrics: completed trainings, documented policies, audit readiness. But those measures miss what truly matters – behavioral outcomes.

Leading organizations are shifting to human metrics:

Adoption and retention rates User satisfaction (CSAT) Reduced authentication-related support tickets

One organization exemplified this shift during the passkey rollout: when satisfaction dipped below their 4.0 target, they paused to improve the experience before resuming rollout. That’s human-centered leadership – prioritizing outcomes that strengthen both trust and security.

Leadership in the Human Era of Security

When deployments struggle, it’s rarely due to user resistance – it’s because systems weren’t designed with human behavior in mind.
Leaders now have a clear mandate:

Simplify choices and reduce cognitive load Segment workforce experiences (field staff ≠ office staff) Establish feedback loops to learn and iterate

The most successful organizations treat passkey deployment as a cultural transformation, not a technical upgrade. They recognize that security performance is shaped by psychology, environment, and design – not just protocols.

The Path Forward: Share Your Voice

This Passkeys Week, we invite workforce leaders everywhere to help shape the next wave of adoption.

Your insights – what worked, what didn’t, and what surprised you – can help the entire community deploy smarter, faster, and more human-centered systems.

Share your experience and help shape the future of workforce authentication.

Your stories power our collective learning – and move the industry forward.

Closing Thought

The technology is ready. The future of workforce authentication now depends on how we lead.

When we design for human nature instead of against it, security becomes intuitive, sustainable, and strong. The workforce isn’t the weakest link – it’s our greatest asset.

Let’s make Passkeys Week 2025 the moment we prove it.

It’s no secret that Microsoft is on board with ushering in a fully passwordless computing future — specifically one that’s powered by a newfangled technology known as passkeys. Back in June, the tech giant confirmed its intention to bring so-called plugin passkey provider integration to Windows 11 in a future update, and, as of the recently-released November 2025 security update, the functionality is now live for a growing number of PC users running the latest version of the operating system.

Behind every safe meal is someone who got the data right.

Brandon Ballew, Senior Product Information Analyst at Beaver Street Fisheries, joins hosts Liz Sertl and Reid Jackson to discuss how the seafood industry is preparing for FSMA Rule 204, and how GS1 standards like GLNs, GTINs, and 2D barcodes are helping ensure food safety from port to plate.

Brandon shares how his team uses data to improve visibility, partner collaboration, and customer confidence, proving that accurate and standardized information benefits everyone in the supply chain.

In this episode, you'll learn:

How GS1 standards support FSMA 204 traceability

Why data quality impacts both compliance and customer trust

How Beaver Street Fisheries uses GLNs to connect digital and physical supply chains

Jump into the conversation:

(00:00) Introducing Next Level Supply Chain

(03:51) Preparing for FSMA 204 and data-driven traceability

(06:08) Lessons from SIMP and early adoption of seafood standards

(09:04) Creative uses of GLNs across operations

(12:31) Data synchronization with GS1 Data Hub and 1WorldSync

(15:34) The cost of inaccurate data in online ordering

(19:00) Educating trading partners about FSMA compliance

(22:11) The benefit of 2D barcodes for consumers

(26:37) Brandon's favorite technologies

Connect with GS1 US: Our website - www.gs1us.orgGS1 US on LinkedIn This episode is brought to you by: Avery Dennison and Syndigo If you're interested in becoming or working with a GS1 US solution partner, please connect with us on LinkedIn or on our website. Connect with the guests: Brandon Ballew on LinkedIn Check out Beaver Street Fisheries

In this episode of Apple @ Work, Rew Islam from Dashlane joins the show to talk about the company’s new report: The 2025 Dashlane Passkey Power 20.

In this episode of Apple @ Work, Rew Islam from Dashlane joins the show to talk about the company’s new report: The 2025 Dashlane Passkey Power 20.

Listen to the podcast.

OASIS Open Project Delivers Practical Tools to Build Trust and Defend AI Systems at Scale

Boston, MA – 18 November 2025 – OASIS Open, the international open source and standards consortium, announced the release of two critical publications advancing AI security practices from the Coalition for Secure AI (CoSAI), an OASIS Open Project. These new resources provide practical frameworks to help organizations strengthen the security and trustworthiness of their AI systems. CoSAI’s Software Supply Chain Security for AI Systems Workstream released “Signing ML Artifacts: Building towards tamper-proof ML metadata records” and the Preparing Defenders for a Changing Cybersecurity Landscape Workstream published “AI Incident Response Framework V1.0.” Together, these frameworks address key aspects of the full lifecycle of AI assurance, from preventing tampering before deployment to responding effectively when systems are attacked.

Model Signing: Building Trust in AI Supply Chains

Workstream 1’s publication, “Signing ML Artifacts,” addresses one of the most pressing challenges in AI deployment: verifying the authenticity and integrity of AI models before integrating them into mission-critical systems. As AI becomes woven into critical business processes, the question is no longer whether to implement model signing, but how quickly organizations can move to adopt it. Workstream 1’s guidance offers both the technical depth and implementation roadmap needed to accelerate adoption while ensuring interoperability across the AI ecosystem and maintaining the security, trust, and compliance their businesses demand.

“Model signing delivers tangible business value: reduced security risk, streamlined compliance, and increased stakeholder trust. This framework gives enterprises the tools to confidently deploy AI while maintaining visibility and control over their most valuable ML assets throughout their entire lifecycle,” said Workstream 1 Leads Andre Elizondo of Wiz, Matt Maloney of Cohere, and Jay White of Microsoft.

The publication introduces a staged maturity model designed to help organizations adopt model signing effectively, beginning with establishing basic artifact integrity through digital signatures, ensuring that models can be verified against unauthorized changes. It then advances to incorporating signature chaining and lineage, which create clear provenance trails and enable traceability across the entire AI supply chain. Finally, it integrates structured attestations and policy controls to support comprehensive AI governance frameworks that align with organizational security and compliance requirements.

AI Incident Response: Preparing Defenders for Evolving Threats

AI systems face unique threats including data poisoning, model theft, prompt injection, and inference attacks that traditional incident response frameworks aren’t designed to handle. Workstream 2’s “AI Incident Response Framework V1.0” equips security practitioners with comprehensive, AI-specific guidance to detect, contain, and remediate these emerging threats.

“AI adoption is reshaping enterprise security, and operationalizing incident response with rapidly changing technology presents new challenges,” said Vinay Bansal of Cisco and Josiah Hagen of Trend Micro, CoSAI’s Workstream 2 Leads. “This framework presents incident examples over common AI use cases and provides playbooks specific to new risks in AI systems, helping organizations move from theory to practice.”

The framework complements existing guidance by addressing capabilities and gaps unique to AI. It helps defenders minimize the impact of AI exploitation while maintaining auditability, resiliency, and rapid recovery, even against sophisticated threats. The guide also tackles the complexities of agentic AI architectures, emphasizing forensic investigation and providing concrete steps to prioritize security investments, scale mitigation strategies, implement layered defenses, and navigate AI governance challenges.

Industry Collaboration and Impact

Together, these publications – developed from the collaborative efforts of CoSAI’s more than 40 industry partners, including Premier Sponsors EY, Google, IBM, Microsoft, NVIDIA, Palo Alto Networks, PayPal, Snyk, Trend Micro, and Zscaler – build on and reinforce CoSAI’s broader initiatives, including the recent Strategic Update, the donation of Google’s Secure AI Framework (SAIF), and the Principles for Secure-by-Design Agentic Systems.

Technical contributors, researchers, and organizations are welcome to participate in its open source community and support its ongoing work. OASIS welcomes additional sponsorship support from companies involved in this space. Contact join@oasis-open.org for more information.

Both frameworks are publicly available on the CoSAI GitHub pages: 

Signing ML Artifacts: Building towards tamper-proof ML metadata records AI Incident Response Framework V1.0

About CoSAI

The Coalition for Secure AI (CoSAI) is a global, multi-stakeholder initiative dedicated to advancing the security of AI systems. CoSAI brings together experts from industry, government, and academia to develop practical guidance, promote secure-by-design practices, and close critical gaps in AI system defense. Through its workstreams and open collaboration model, CoSAI supports the responsible development and deployment of AI technologies worldwide. CoSAI operates under OASIS Open, an international standards and open-source consortium. www.coalitionforsecureai.org

Media Inquiries: communications@oasis-open.org

The post Coalition for Secure AI Releases Two Actionable Frameworks for AI Model Signing and Incident Response appeared first on OASIS Open.

As part of our work within the spyware network, The Engine Room collaborated with Fundación Acceso to investigate the psychosocial impact of spyware attacks and develop resources to strengthen support and accompaniment.

The post Psychosocial support and digital safety: A conversation with Fundación Acceso on spyware attacks and collective care appeared first on The Engine Room.

One of the most frequent questions we hear at MyData Global is: “Who’s actually doing MyData in practice?” It’s a fair question. While the principles of human-centric data control sound […]

Series: Building AI Trust at Scale
Part 4 · By DIF Ambassador Misha Deville
View all parts →

Think about how you share a Google Doc. You can add specific people to an access list or use “Anyone with the link”. The first gives some control but requires manual approvals. The second scales effortlessly but gives no control over who the link gets passed to. This captures two fundamental access models: identity-based, which grants access based on who you are, and capability-based, which grants access based on what you possess.

OAuth Was Built for Humans

OAuth 2.0 lets you grant applications access to your resources without sharing passwords. When you authorise Slack to access your Google calendar, Slack receives an OAuth access token that lets it retrieve event data on your behalf. This works because: 1) a human validates the request, 2) permissions can be broad and long-lived, or narrowly scoped at issuance, and 3) one identity represents one user.

Abstract Protocol Flow, The OAuth 2.0 Authorization Framework[1]

In practice, OAuth primarily treats tokens as impersonation rather than delegated authority. ‘Sign in with Google’ grants full access within your application context. The credential represents you, not a scoped capability. This trade-off prioritises usability and session continuity over least-privilege delegation. For human sessions, implicit impersonation is acceptable. For autonomous agents, it can be catastrophic[2].

Agents need to act without constant human approval. They require fine-grained, time-limited permissions that can be safely delegated through chains of sub-agents. Multiple agents can represent one user or act for multiple users. But OAuth has no concept of delegation chains. As Microsoft’s Alex Simons writes, agents need “their own defined set of privileges - not just proxy a user’s rights”[3]. Actions must be traceable, distinguishing if an agent is acting for a user, itself, or through a chain of agents.

The fundamental limitation emerges across security boundaries. As Nicola Gallo, creator of ZTAuth* and co-chair of DIF’s Trusted AI Agents Working Group, explains, “Each web API is its own security boundary. When invoking a service that resides behind a separate security boundary, trust cannot rely on the token alone. Establishing trust requires a verifiable trust chain that validates both the token and the identity of the entity that forwarded the request.”

Most agent interactions today are not fully autonomous[4] and operate within limited scopes via protocols like MCP[5]. MCP builds on OAuth and standardises connections between AI models and other services (think USB ports for agents). This works quite well within single security boundaries, where MCP provides a common language between known agents and servers. But it doesn't address attenuated delegation, ephemeral agent lifecycles, or cross-boundary trust establishment.

“[MCP] is limited in its full scope towards authorized delegation, enabling only system communication and optionally access controls rather than broader authentication and identity management”[6].

Three Breaking Points
1/ The human-in-the-loop and ‘prompt fatigue’: 1Password’s Secure Agentic Autofill lets AI agents complete browser logins by injecting credentials without exposing them to the agent[7]. But it still requires human approval for each access. Frequent authorisation prompts can lead to “prompt fatigue”[8], where users mindlessly approve requests without scrutiny. This may work for one agent and a few resources. It breaks down completely with hundreds of autonomous agents crossing multiple security boundaries, delegating permissions to sub-agents unpredictably.

Andor Kesselman, co-founder of the Agentic Internet Workshop and co-chair of DIF’s Trusted AI Agents WG, puts it plainly: “Imagine sitting at your job, just clicking approve, approve, approve for every single OAuth request coming in from your agents. We would have created a completely dystopian world.” The paradox is the more effective your agents become, the more difficult the human-in-the-loop problem is to manage.

2/ Missing attribution: When multiple agents operate under the same account credentials, they become indistinguishable from each other both in real-time and retrospect. GitHub sees actions by “alice@company.com” but has no way to know which specific agent executed the task.

A typical organisation of 100 employees using Claude, ChatGPT, and Gemini to interact with external services might spawn an average of 10 instances per day, that’s 3000 agent instances operating daily. When something goes wrong (e.g. private internal data written to a public GitHub repository) you might see that an MCP server acted on behalf of alice@company.com’s token, but you can’t identify which agent was compromised or investigate how. Revoking one token might break multiple agents. You either keep all agents connected or shut them all down.

Andor uses the analogy of a car key. If you give your key to someone, who then gives it to someone else, who gives it to another person, and someone crashes your car, you can’t prove who did it because every access to the car used your key. This also means you remain accountable. Without distinct agent identities, delegation chains aren’t traceable, auditable, or debuggable.

3/ Agent Lifecycles: Agentic systems frequently spawn short-lived agents for specific tasks. They might exist for 15 minutes, then terminate. But OAuth assumes authorisation relationships persist over time. For ephemeral agents, you either grant overly broad access using your credentials, or create individual authorisations that require human approval, leaving stale tokens that outlive the agent.

Even longer-lived agents break OAuth’s model. Agents coordinating distributed transactions across multiple identity providers (IdPs) must have tokens that persist so the system can maintain state and handle failover. But when an agent connects to multiple IdPs with different trust relationships, it creates what Nicola calls the ‘Internet of Shared Credentials’ paradox. It also makes dynamic recovery impossible because you can’t reauthorise all transactions in real time.

OAuth’s basic model of “trust established at issuance, valid until expiration” fails for both scenarios: agents that spawn dynamically and disappear, and agents that orchestrate workflows across multiple trust domains.

Why Object Capabilities Alone Aren’t Enough

If identity-based access models don’t work for autonomous agents, what about capability-based systems? Object capabilities grant access through unforgeable tokens scoped to specific actions. They enable delegation chains, provide automatic least privilege through attenuation, and can be time-bounded. As Alan Karp writes, “Without chaining, every private in the army is saying ‘Yes sir, Mr. President.’ Without attenuation, that private ends up with permission to launch nukes.”

Much like “Anyone with the link” for Google Docs, you set capabilities upfront (e.g. ‘view’, ‘comment’, or ‘edit’) and pass them along attenuated chains to then-unknown second and third parties.

Alan’s access management use cases[9] form a key conceptual foundation for DIF’s Trusted AI Agents WG approach, and illustrate the power of capabilities through a backup scenario.

Alice tells her agent Bob: “Backup X to Y.” Bob, as a backup service provider, has broad permissions. Bob uses a copy service provided by Carol, and passes those permissions onward. But Alice changes her instruction: “Backup X to Z.” If Z is owned by Carol, she ends up overwriting her own resource. If Z belongs to someone else, Alice enables unauthorised updates to resources she doesn’t control.

‘Transitive Access Problem’, Use Cases for Access Management

This is the ‘confused deputy vulnerability’, where a privileged service can be tricked into misusing its authority. With capabilities, Alice designates resources by delegating specific tokens: query X, update Y. Bob executes using Alice’s capabilities, not his own broad permissions. Z is safe because Alice never granted that capability.

Capabilities solve critical access control problems. But for autonomous agents operating at scale, they’re not enough on their own. Primarily because you can’t predict all capabilities upfront. And agents need capabilities to be expressed in much more limited scopes than human users. As Andor says, “you can have an agent specifically scoped to email, but humans encompass a much broader set of capabilities”.

Take Nicola’s travel example: An agent books a rental car to line up with a flight time, then the flight becomes unavailable. The agent needs to cancel that specific car booking, but you couldn’t have known which car would need cancellation when you granted capabilities. Granting “cancel any booking” upfront is too broad for an agent. But without knowing which specific agent made the booking, you can’t dynamically scope the cancellation capability to just that transaction.

”While capability-based models provide strong security guarantees and natural least privilege, they are not trivial to apply in dynamic or stateful distributed environments”, explains Nicola, “Recovery, rollback, and context rehydration require additional mechanisms beyond static capability assignment”. Even if you can apply fine-grained capabilities for security, excessive granularity becomes impractical. Too many capabilities require frequent user approvals or inter-agent exchanges. You have to balance security and operational practicality.

Dmitri Zagidulin, co-chair of DIF’s Trusted AI Agents Working Group, further explains the “patchwork problem”. Without agent identifiers, capabilities from multiple sources can be composed in unintended ways. An agent might get read access from one source and write access from another, then combine them in unintended ways, creating access patterns you never explicitly authorised.

With autonomous agents, you need to prove who they are, who spawned them, who they’re acting on behalf of, and if they have the authorisation to carry out the task they’re requesting. All in a format that the requested service can verify without “phoning home” or checking with a central authority. To do this, you need both identifiers and capabilities working together across boundaries.

Attaching Identity to Capability
“What’s becoming clear to everybody that has anything to do with AI agents is that agents and any sort of software need their own identity,” explains Dmitri, “Not just for access control, but for quality assurance.” Akin to how mobile apps have guardrails of least privilege access to other apps on your device, and registered accountability to their creators.

“When you’re interfacing with an agent, you actually do care a lot about who built the agent, where they came from, how the agent got spun up, and where it’s running,” says Andor. But as Alan notes, what matters isn’t the arbitrary identifier, it’s that the identifier enables verification of the agent’s provenance and capabilities. For example, NANDA’s first project focuses on agent discovery[10]. The system allows agents to advertise their capabilities dynamically through cryptographically verified “AgentFacts”, which declare what the agent can do, under what conditions, and with what limitations. When an agent needs specialised functionality, it queries for agents offering those services, verifies their credentials, and grants them attenuated access strictly scoped to the sub-task. This enables composable authorisation, where agents can discover and delegate to each other on the fly, rather than via centralised orchestration.

This represents a fundamental mental model shift in how we think about authorisation. Traditional identity systems operate on “authority by identity”. You prove who you are, and the system checks what you can access against a central registry. This worked for humans with relatively stable roles, particularly within organisations. Whereas agents require “authority by possession”, they prove they hold a capability token that grants specific permissions. But critically, as Nicola frames it, “Trust doesn’t come with impersonation. Trust comes from knowing who is executing the action”. You need to know who to hold accountable if something goes wrong. To establish this accountability across organisational boundaries, you need distributed and dynamic identity systems rather than centralised, static-ones.

The Case for DIDs and VCs
Decentralised Identifiers (DIDs) and Verifiable Credentials (VCs) provide the technical foundation for agents to operate across trust boundaries.

DIDs offer cryptographically-anchored identity that’s portable across platforms and organisations. Unlike email addresses or OAuth client IDs that belong to specific providers, a DID is controlled by the entity it identifies. An agent can prove its identity cryptographically without depending on a centralised authority to vouch for it every time. This portability is critical when agents need to work across multiple services that don’t have federation agreements.

VCs provide a standardised format (W3C VC Data Model, or ISO/IEC 18013-5) for expressing certificate capabilities and attestations (e.g. ZCAP-LD[11]). They’re cryptographically signed by issuers, making them tamper-evident. They can include delegation chains showing how authority flows from human to platform to agent to sub-agent. They support selective disclosure, whereby an agent can prove it has a capability without revealing more information than necessary. And crucially, they have independent lifecycles from identity, meaning capabilities can be issued and revoked separately from the agent’s core identity.

Together, they enable hierarchical identity with delegation chains, dynamic capabilities, cross-boundary trust, and complete audit trails.

Now when an agent books CAR-123, the rental service automatically issues a VC with a scoped capability: ‘“cancel”, booking ID “CAR-123”, “only by the agent that created this booking”, valid until pickup’. If the flight becomes unavailable, the agent has exactly the capability it needs without requiring human approval or having overly broad permissions.

There are of course still practical challenges with this approach. DID registration has performance implications. Revocation checking impacts latency. Key management, storage, and rotation for ephemeral agents creates new operational needs.

The alternative however, of trying to scale OAuth-based systems to billions of autonomous agents crossing organisational boundaries, is significantly more problematic. The major payment networks, Google, and Microsoft aren’t building agent identity systems because they love new standards. They’re building them because they know the current models break at multi-agent scale.

The Path Forwards
The pragmatic path forwards, as Andor explains, is to start exposing external agents with decentralised identifiers. Organisations can maintain their existing OAuth infrastructure for internal systems while giving agents portable identities for cross-boundary interactions.

Solutions like SPIFFE[12] represent a middle path. Not fully decentralised, but enabling workload identities to establish trust across organisational boundaries without requiring universal federation. SPIFFE provides cryptographically verifiable identity for workloads, creating a foundation where agents can prove ‘who is executing’ a task. However, you still need to be able to verify delegation context and trust positions. Emerging frameworks, like ZTAuth*, WIMSE[13], and others, are developing complimentary approaches that combine workload authentication with explicit delegation mechanisms.

Marketplaces provide a good business case for this. “Marketplaces are great because you can rarely capture both sides of the market,” Andor says, “You’re normally on one side or the other, so that means you have to interact with each other, and you can’t always be in your federation.” Using DIDs and VCs, agents from different platforms can establish trust and verify delegation chains without requiring pre-existing reciprocity of identification systems.

Admittedly, both Andor and Dmitri think the catalyst for change may likely be a significant security incident attributable to inadequate agent identity management, or regulatory requirements for accountability that current systems can’t satisfy. It’s better to get ahead of both.

Get Involved
DIF’s Trusted AI Agents WG is actively defining an opinionated, interoperable stack to enable trustworthy, privacy-preserving, and secure AI agents. The first work item, Agentic Authority Use Cases is focused on anchoring the important work on agents with real human led use cases, to help prioritize and discover where things break down.

Autonomous agents executing complex tasks across organisational boundaries has captured significant investment and attention, but as Andor puts it, “Identity is the first problem that needs to be solved in the agentic web to make it happen and for agents to scale”.

A huge thank you to Andor Kesselman, Dmitri Zagidulin, Nicola Gallo, and Alan Karp, for their time and insights in preparing this article.

To learn more or get involved with DIF’s Trusted AI Agents work, visit the Trusted AI Agents working group page.

Building AI Trust at Scale — Series ← Previous in this series: Part 3 – Why your content needs an ingredient list Next in this series: Part 5 — Building the Agentic Economy By DIF Ambassador Misha Deville View all parts Hardt, Ed. (2012). “The OAuth 2.0 Authorization Framework”. IETF. ↩︎ Lab42AI (2025). “When OAuth Becomes a Weapon: AI Agents Authentication Crisis”. Hackernoon. ↩︎ Simons, Alex (2025). “The Future of AI Agents - Why OAuth Must Evolve”. Microsoft Entra. ↩︎ Feng, K. et al. (2025). “Levels of Autonomy for AI Agents (Working Paper)”. Arvix. ↩︎ Anthropic (2024). “Introducing the Model Context Protocol”. Anthropic. ↩︎ South, T. et al. (2025). “Authenticated Delegations and Authorized AI Agents”. Arvix. ↩︎ Wang, Nancy (2025). “Closing the credential risk gap for AI agents using a browser”. 1Password. ↩︎ South, T. et al. (2025). “Authenticated Delegations and Authorized AI Agents”. Arvix. ↩︎ Alan Karp (2025). “Use Cases for Access Management”. Alanhkarp.com. ↩︎ NANDA: The Internet of AI Agents. ↩︎ Lemmer-Webber, C. et al. (2025). “Authorization Capability for Linked Data v.0.3.”. W3C. ↩︎ SPIFFE Overview. ↩︎ WIMSE IETF Working Group. “Workload Identity in Multi-System Environments”. GitHub. ↩︎

For years, HYPR and Yubico have stood shoulder to shoulder in the mission to eliminate passwords and improve identity security. Yubico’s early and sustained push for FIDO-certified hardware authenticators and HYPR’s leadership as part of the FIDO Alliance mission to reduce the world’s reliance on passwords have brought employees and customers alike into the era of modern authentication.

Microsoft is making Windows 11 a lot friendlier to your favorite password manager. Windows 11 now supports third-party passkey managers, meaning you’re not locked into Microsoft Password Manager anymore.

Passkeys are part of the FIDO standard, a newer authentication method that replaces passwords with secure, device-bound cryptographic keys. Unlike passwords, passkeys can’t be phished, reused, or stolen from the cloud.

First Conformity Assessment Body (CAB) certifying against the UK Digital Identity and Attributes Trust Framework (DIATF) THAMES DITTON, England, 13 November 2025 — The Kantara Initiative (Kantara), the acknowledged expert […]

The post Kantara Achieves Historic First: Accredited to Certify Against the UK DIATF appeared first on Kantara Initiative.

November 2025

DIF Website | DIF Mailing Lists | Meeting Recording Archive

Table of contents Decentralized Identity Foundation News; 2. Working Group Updates; 3. Special Interest Group Updates; 4. User Group Updates; 5. Announcements; 6. Community Events; 7. Get involved! Join DIF 🚀 Decentralized Identity Foundation News DIF Steering Committee Election Results

We're pleased to announce the results of our Steering Committee elections, welcoming three new members who bring diverse expertise and perspectives to DIF's leadership:

JC Ebersbach (identinet) Matt McKinney (ArcBlock, AIGNE) Eric Scouten (Adobe)

We welcome re-elected DIF Steering Committee members, including:

Sam Curren (Indicio) Rouven Heck (Fidenexum) Markus Sabadello (DanubeTech)

These members will guide DIF's strategic direction, oversee working group activities, and strengthen connections across the growing decentralized identity ecosystem. Their combined experience in standards development, enterprise implementations, and emerging technology governance will be invaluable as DIF enters its next phase of growth.

🛠️ Working Group Updates

Browse our active working groups here

Trusted AI Agents Working Group

The Trusted AI Agents Working Group has made substantial process on its inaugural Agentic Authority Use Cases work item by creating use case clusters and architectural component mappings. Use cases span enterprise workflows, travel booking, calendar management, and supply chain scenarios. The group established a governance process for evaluating and advancing use cases, with emphasis on identifying stakeholders willing to drive implementation. Key discussions have focused on agent discovery mechanisms, trust registries, and the balance between decentralized identity approaches and traditional federation models.

The working group is exploring how existing DID and verifiable credential standards can be adapted for AI agents while considering unique requirements like delegation chains, authorization boundaries, and human oversight mechanisms. With strong participation from across the DIF community, the group aims to deliver concrete specifications and reference implementations by early 2026.

Hospitality & Travel Working Group

The HAT Pro specification advanced with Neil Thomson's automated schema generation tools using PlantUML and JSON Schema. The team developed comprehensive data models for travel profiles including identity, preferences, accessibility requirements, and relationships. Key architectural decisions established distinct branches for parallel development. Marketing expanded with outreach to Oracle, Marriott, and Hospitality Solutions. The group is developing use cases for AI-driven travel agents that maintain traveler control over personal information.

👉 Learn more and get involved

Creator Assertions Working Group

Finalized an interim trust model valid through March 2027, leveraging existing S/MIME governance programs. Integrated with IPTC Verified Publishers lists and Mozilla root stores with email trust bits enabled. Developed best practices for media identifier standards using EIDR and DDEX. Beginning work on agentic identity and AI-generated content provenance.

👉 Learn more and get involved

Applied Crypto Working Group

BBS+ work item reviewed recent academic security analyses, confirming robustness for practical applications. Advanced integration with device-bound credentials combining BBS with ECDSA for hardware security modules. Evaluating approaches for pseudonym systems and blind signatures. Examining post-quantum combinations for "everlasting privacy" guarantees and coordinating with IETF standardization efforts.

👉 Learn more and get involved

DID Methods Working Group

Conducted deep dives into did:webs (DID:web with KERI) and MDIP (Multidimensional Identity Protocol). MDIP uses IPFS for content addressing, supports multiple blockchains including Bitcoin and Litecoin testnets, with ~18,000 active DIDs. Refined the DIF recommendation process with updates to coordinated release strategy and formal review requirements.

👉 Learn more and get involved

Identifiers and Discovery Working Group

Finalized DID Traits v1.1 updates including well-known resource specifications and IANA registration processes. Patrick St-Louis showcased comprehensive DID:webvh server implementation with Explorer UI, GraphQL APIs, and BC digital trust integration. Addressed DID URL path resolution and service endpoint handling with proposed cascading fallback algorithm.

👉 Learn more and get involved

DIDComm Working Group

Explored post-quantum encryption approaches for DIDComm V3, focusing on key encapsulation mechanisms (FIPS 203) and hybrid encryption schemes. Reviewed new protocol proposals for workflow management, payment processing, vault coordination, and multi-signature documents. Evaluating CBOR encoding implementation and session management for ephemeral key exchange.

👉 Learn more and get involved

Claims & Credentials Working Group

Following the Credential Schema Specification 1.0 release, expanded work on business employment credentials and verified person credentials. Explored assurance levels for identity verification strength across different use cases. Began developing DIF membership credentials to demonstrate practical schema applications.

👉 Learn more and get involved

🌎 DIF Special Interest Group Updates

Browse our special interest groups here

DIF Hospitality & Travel SIG

The SIG hosted two key presentations this month. Google Wallet's team demonstrated their comprehensive digital identity vision for travel, including TSA integration, mobile driver's licenses, and privacy-forward data sharing through zero-knowledge proofs. The presentation drew over 100 participants and sparked discussions on wallet interoperability and EIDAS compliance.

Passive Bolt showcased frictionless hotel check-in using NFC technology, addressing the industry's low mobile key adoption rates. Their solution works with both existing infrastructure and future state-issued digital IDs, with deployment costs as low as $2,000 annually for a 200-room property.

👉 Learn more and get involved

APAC/ASEAN SIG

Terminal 3's Gary Liu presented on decentralized identity and privacy-enhancing technologies for AI agents, addressing trust and authorization challenges in agentic AI systems. The group explored Terminal 3's integration with Hedera blockchain and Open Campus ID, discussing regulatory compliance across APAC jurisdictions and data sovereignty requirements.

👉 Learn more and get involved

DIF Africa SIG

Focused on mobile-first credential management and offline verification capabilities for limited connectivity environments. Participants shared insights on regulatory frameworks across African nations and mechanisms for establishing trust without consistent internet access.

📢 Announcements Ethereum Foundation PSE Grants Available for did:ethr Development

The Ethereum Foundation's Privacy and Scaling Explorations team has announced grant opportunities for advancing the did:ethr method specification. This funding opportunity aims to support development and standardization efforts for Ethereum-based DIDs, strengthening the intersection of blockchain technology and decentralized identity. Interested parties can learn more and apply at https://esp.ethereum.foundation/applicants/rfp/did_ethr_method_spec.

DIF Collaborates with Decentralization Research Center on Treasury Response

The Decentralized Identity Foundation collaborated with the Decentralization Research Center in responding to the US Treasury's Request for Comments, emphasizing the critical importance of self-sovereignty and fit-for-purpose design in systems handling people's identity data. The response highlighted how decentralized identity architectures can address regulatory concerns while maintaining user privacy and control. Read more about the collaborative response here.

🎉 Community Events DevConnect and ZKID Day Coming Soon

Mark your calendars for DevConnect, featuring the dedicated ZKID Day focused on zero-knowledge identity solutions and privacy-preserving technologies. This event, starting November 17th, brings together developers, researchers, and implementers working at the intersection of zero-knowledge proofs and decentralized identity. Learn more about DevConnect at https://devconnect.org/ and register for ZKID Day at https://devconnect.org/calendar?event=zkid-day.

TRUSTECH 2025

DIF is partnering with TRUSTECH for their upcoming international event dedicated to innovative payment and identification solutions. TRUSTECH has provided the following information about their December 2-4 event at the Paris Porte de Versailles Exhibition Centre:

TRUSTECH offers a complete programme featuring conferences, keynotes, and pitch sessions, allowing participants to discover major innovations in key sectors such as: Biometrics, Innovative Payments, Cryptocurrencies, Smart Cards or Digital Identity.

TRUSTECH offers a complete programme featuring conferences, keynotes, and pitch sessions, allowing participants to discover major innovations in key sectors such as: Biometrics, Innovative Payments, Cryptocurrencies, Smart Cards or Digital Identity.

The event welcomes upstream technology providers in the payment sector offering solutions like smartcard manufacturing, secured frameworks and transaction processing infrastructures, as well as identification solutions providers for both private and public sectors, offering Civil ID documents, authentication systems and Identity Access Management solutions.

TRUSTECH promises three intense days of networking to exchange ideas and insights, discuss trends, discover the latest innovations and solutions, while connecting with an international audience from Europe, Africa, North and South America, and Asia.

👉 Learn more about the event program
👉 Register using DIF's partner code

Browse the DIF Calendar:

🆔 Join DIF!

If you would like to get in touch with us or become a member of the DIF community, please visit our website or follow our channels:

Follow us on Twitter/X

Join us on GitHub

Subscribe on YouTube

🔍

Read the DIF blog

New Member Orientations

If you are new to DIF join us for our upcoming new member orientations. Find more information on DIF’s slack or contact us at community@identity.foundation if you need more information.

In 2016, I published The Path to Self-Sovereign Identity (https://www.lifewithalacrity.com/article/the-path-to-self-soverereign-identity/) and with it proposed ten foundational principles for digital identity systems. These principles were centered on human dignity, agency, and consent and quickly became a touchstone in the emerging world of Self-Sovereign Identity.

At the time, I asked for support in refining those principals. And, we tried: at ID2020, Rebooting the Web of Trust, IIW, and elsewhere. But for nearly a decade, the original principles have remained largely unchanged, inspirational yet sometimes misunderstood.

Now, in 2025, as the Self-Sovereign Identity movement turns ten next year, I’m renewing that invitation. And I’m asking for your participation.

📌 The 10-Year Revision Project

The 10-year SSI Revision Project is an effort to revisit and refine the original SSI principles, not as a rigid standard, but as a living framework for people designing, governing, and deploying identity infrastructure that respects and protects the people it serves.

SSI is no longer a theory. Its infrastructure has been adopted by governments, companies, communities, and protocols. As that adoption accelerates, the foundational values must evolve to meet today’s ethical, legal, and technical challenges including coercion, use of biometrics, AI agency, exclusion by design, and gamified behavioral manipulation.

The goal is ultimately to revisit old principles and to propose new ones while making a renewed call to protect the dignity of all identity holders.

📅 Join the Collaboration

To support this project, I’ll be hosting a series of open online calls over the next year to co-develop and discuss revised principles, new proposals, and system guidance. These sessions will welcome technologists, designers, researchers, regulators, and community stewards from across the SSI and identity ecosystem.

Kickoff Meeting 1 — EU/US time compromise

Tuesday, December 2nd, 2025 10:00am PT / 7:00pm CET

Kickoff Meeting 2 — EU/Tokyo time compromise

Tuesday, December 9th, 2025 (Tokyo local) 3:00pm Tokyo / 7:00am CET / (10:00pm PT Monday for the host)

The goal of these first two meetings is to discuss opportunities for different topics, with the goal of writing up some initial rough “concept papers” (ala RWOT’s “topic papers”) to scope some of ideas that people have of what needs to be done.

Hopefully you’ll join us for these initial calls. No longer commitment is required, but the intent is to investigate your participation in writing some papers on this topic by May! However, the most important thing is ultimately that your ideas and your feedback help to shape the continued development of Self-Sovereign Identity.

Please let me know that you’re interested in joining us!

🧭 Team Topics

If we get enough participation, I expect we may split up into teams, to cover some of the various topics that bear discussion as we rethink SSI.

Some early broad topics that we are considering currently are:

Beyond Property: Principal Authority and the Legal Foundation of SSI. Agency law, principal authority, and revamping or expanding the SSI principles based on them. Anti-Coercive Design and Cognitive Liberty. Avoiding coercive design, which will likely include more academic discussions of philosophy and may reveal new principles. From Principles to Properties: Operationalizing SSI. A deep dive into the CSSPS 42-property framework published in IEEE Access, looking for objective design principles that might contribute to SSI. And forward from that. More Than a Digital Shadow: Rewriting Principle 1 – Existence. Reclaiming the original intent of the first principle, that every person has an identity that precedes any digital system, drawing on generative identity, Ubuntu philosophy, feminist sovereignty, decolonial theory, legal personhood guarantees, and real-world harms.

The intent is to write articles on each of these topics, and hopefully some more, by May 2026, in time for the anniversary and to use those articles to revise, revamp, and expand the original principles. But to get there from here, we need to start coordinating now!

🌱 Why This Matters

SSI has always been more than a technical spec. It’s a movement for restoring dignity, agency, and trust in a digital world that too often erodes all three. As its adoption spreads, we must ensure that the principles at its foundation still serve the people they were meant to protect.

Let’s not let another ten years pass before we act.

📙 Requested Reading

I’ve written a number of articles about SSI over the years. I think three of them are particularly important to these discussions, and I suggest that people read them as part of this process:

The Path to Self-Sovereign Identity (2016). My original article, which lays out the pre-history of SSI and the initial 10 principles. Origins of Self-Sovereign Identity (2021). A look at the philosophical and political roots of SSI, including its lineage in civil liberties, cryptographic activism, and human rights frameworks. Principal Authority: A New Perspective on Self-Sovereign Identity (2021). How identity should not be framed as property, but as a domain of agency governed by fiduciary duty and inalienable rights.

I am also working on an annotated syllabus of some of the most important papers and articles published the last 9 years. I’ll share my initial pass before our first meeting in December.

For more info on everything, see the Revisiting SSI website.

🤝🏼 Join Us

Some of the people that have expressed interest in joining us for this effort are Kim Hamilton Duffy (DIF), Rodolfo Costa (University of Coimbra), Georgy Ishmaev (Inria), Vinay Vasanji (EF), Ian Grigg, and Philip Sheldrake. This includes a mixture of both critics and supporters of SSI, coming from a variety of backgrounds, from academia to technology. What we are weak on so far are people from law and regulation.

You can email me directly and let me know you’d like to be involved, or sign up for an announcements-only #RevisitingSSI email list or alternatively join our Signal group, which we’ll be using to coordinate our initial calls.

If you or your organization wishes to demonstrate its support for goals of Self-Sovereign Identity, I am seeking financial sponsors for this project. Contact me about different sponsorship opportunities, or you can directly support my work on these kinds of efforts via GitHub (via a one-time donation or ongoing monthly patronage) at https://github.com/sponsors/ChristopherA.

I look forward to collaborating with you!

Microsoft is rolling out a significant update to its Edge browser that allows users to save and sync passkeys across their Windows devices. Announced on November 3, the new feature integrates passkeys directly into the Microsoft Password Manager, starting with Edge version 142.

Addressing a key weakness in the company’s passwordless strategy, this move untethers passkeys from a single machine. By enabling cloud synchronization for these phishing-resistant credentials, Microsoft aims to make secure, password-free logins more practical for everyday use. F

or now, the feature is limited to Windows desktops, with support for other platforms planned for the future.

iProov’s biometric injection attack detection technology has passed an evaluation by Ingenium Biometrics to the Level 2 (High) standard set out in Europe’s CEN TS 18099.

Ingenium carried out independent testing of iProov’s Dynamic Liveness technology, which uses patented Flashmark signals to confirm a user’s real-time presence. The European standard is the only one established for defending against deepfakes and synthetic media, and will be used as the starter document for a global ISO/IEC standard.

WhatsApp has introduced passkey-encrypted chat backups using biometric authentication like Touch ID or Face ID, simplifying end-to-end encryption and replacing cumbersome 64-digit keys. This enhances security for cloud-stored messages amid rising cyber threats, potentially setting a new standard for messaging apps and promoting broader privacy adoption.

WELLINGTON, New Zealand, 4 November 2025 – The iconic Kiwi Access Card (formerly 18+ Card) is going digital. Hospitality New Zealand has partnered with NEC New Zealand, a leader in biometrics and digital identity, to deliver a secure new way for people to prove who they are – straight from their smartphone.

This collaboration marks a major step in advancing New Zealand’s digital identity ecosystem and supports the Government’s goal of a trusted, privacy-preserving digital identity future. It comes as Minister for Digitising Government Judith Collins’ urges the public and private sectors to “move from discussion to delivery”.

For more than two decades, the Kiwi Access Card has been one of New Zealand’s most recognised forms of identification, helping hundreds of thousands of people prove their age and identity. The new digital Kiwi Access Credential will build on that legacy, offering a secure, convenient way for people to verify who they are directly from their smartphone while maintaining control of their personal information.

“Hospitality New Zealand has shown real leadership in modernising one of the country’s most trusted credentials,” said Steven Graham, Head of Identity Cloud Establishment ANZ at NEC New Zealand.

“This partnership reflects NEC’s global commitment to building secure and interoperable digital identity platforms, with our Identity Cloud capability being established across Australia and New Zealand. We’re proud to help shape the future of identity in New Zealand as a transformation partner alongside Hospitality NZ.”

Built on NEC’s Identity Cloud Platform, the new credential uses global verifiable credential standards and NEC’s expertise in digital identity and biometrics to deliver benefits, convenience and trust for individuals and businesses:

Reduces identity theft and fraud through cryptographically secure, tamper-resistant credentials. Limits data sharing, ensuring only essential information is exchanged with consent. Simplifies compliance with the Sale and Supply of Alcohol Act and other verification requirements. Improves trust and efficiency across everyday age and identity checks.

Will Kim, representing Hospitality New Zealand, said: “The Kiwi Access Card has always been about trust and accessibility. Working with NEC allows us to carry that trust into the digital era, giving customers more privacy, helping businesses meet their obligations, and making verification faster and safer.”

This partnership reflects growing momentum behind New Zealand’s digital identity programme and the Government’s drive for trusted, privacy-preserving services.

NEC New Zealand is preparing to support Hospitality NZ through accreditation under the Digital Identity Services Trust Framework, ensuring the Digital Kiwi Access Credential meets the national standards for trusted and secure digital identity.

The post Kiwi Access Card goes digital in new Hospitality New Zealand and NEC partnership appeared first on Digital Identity New Zealand.

Geneva, November 8th 2025 — As a global leader in direct democracy, Switzerland faces a unique test: how to scale secure, private, and verifiable E-Collecting, E-Voting, national E-ID, patient health records across 26 cantons — without eroding public trust and losing digital sovereignty.

Democracies worldwide grapple with the same tensions between security, privacy, and trust in digital public services, Switzerland — as a neutral, innovative, business friendly and small alpine nation — is uniquely positioned to experiment, refine, and export globally viable solutions.

on anonymity, linkability and the need of continuous governance

“Voting Without Tracing: A Holistic Look at Privacy in Digital Democracy” by Michal Pietrus

This article written by a core contributor to the Human Colossus Foundation’s open protocols Decentralised Key Management System (DKMS) and Overlays Capture Architecture (OCA), offers a solid blueprint:
✅ Cryptographic tools (Merkel trees, zero-knowledge proofs, end-to-end verifiability) can preserve ballot secrecy and enable audit trails — critical for Swiss federalism
✅ Governance must match technology: transparency, cantonal autonomy, and public oversight are non-negotiable. Therefore digital governance has to become continuous, not fragmented in isolated digital signature events.
✅ Switzerland’s experience is not an exception — it’s a prototype for democracies worldwide grappling with digital transformation

🌍 The global takeaway: In an era of rising digital authoritarianism and voter distrust, secure, privacy-preserving e-voting isn’t optional — it’s a democratic necessity. Switzerland has the chance to leverage its historical direct democracy tradition to lead the way in the digital era. The world should be watching.
🔗 Read the full analysis

🔗 Read HCF news post with more details on Human Colossus Foundation contribution to the E-Collecting program

Dontate today to the Human Colossus Foundation Contribute to the Dynamic Data Economy Overlays Capture Architecture Decentralised Key Management System

Permalink

FIDO Alliance and Liminal collaborate on utilization snapshot

The FIDO Alliance, in collaboration with digital identity consultancy Liminal, has unveiled the Passkey Index — a new benchmarking tool that tracks the adoption, performance and impact of passkey authentication across leading online services.

Launched alongside Liminal’s Passkey Adoption Study 2025, the Index offers the most comprehensive view to date of how passkeys are reshaping digital authentication. “The data in the Passkey Index marks the first time we have been able to measure the actual utilization and performance of passkeys,” says Andrew Shikiar, CEO of the FIDO Alliance.

“The FIDO Alliance intends to grow this program over time as a benefit to service providers within our membership, a guideline for newer implementers and an industry benchmark to track ongoing growth of passkey utilization over time.”

Digital Identity Means Security

One particular leaf of that nettle is authentication, and here I think we Brits can have some optimism. NCSC is working with the government and the FIDO Alliance on improving the adoption of “passkeys” across the public and private sectors. If you are not familiar with passkeys (which are already widely used), imagine you want to sign in to your Google Account on a new device. Instead of entering a password, a passkey allows you to log in to your account with a device you’ve already verified (e.g., your phone). You don’t need to remember a password and no-one else can log in as you because they don’t have your phone.

The passkey tipping point may be fast approaching. As the anointed successor to passwords, passkeys are seeing increased support from huge global companies, improved data analysis and better resources. And, significantly from an industry standpoint, the FIDO Alliance appears to be on the verge of reorienting its priorities to encompass more work on account recovery and digital credentials – a sure sign that, even if passkeys do not deliver the fatal blow to passwords many have predicted, they are established enough for their primary defender to declare a kind of victory in its primary mission.

The Mastercard Newsroom recently sat down with Andrew Shikiar, FIDO’s Executive Director and CEO, to learn how the FIDO’s Payments Working Group is helping bolster protection in a rapidly changing digital world.

Kia ora,

As we approach the business end of the year, the hard mahi is ramping up more than anything. The strength of the fabric of our DINZ community can be seen right across the ecosystem from the Reference Architecture working groups expertly facilitated by Christopher Goh, to the heavy lifting being undertaken by so many government and industry practitioners.

Reference Architecture Working Group progress

It is wonderful to see the Policy & Technical Reference Architecture Working Groups progressing so well:

Priority reference use cases voted on and confirmed Mapped mDoc standard to the NZ regulatory framework Sovereign namespace* proposals under consideration – paving the way for the benefits of RealMe without a centrally issued ID card or super credential Ecosystem wide open for industry players and consortiums to emerge.

*A namespace is a unique digital “domain” that distinguishes identifiers and credentials within a system – similar to how an internet domain name (example.nz) separates one website from another. In self-sovereign identity SSI, namespaces ensure that identifiers, schemas, and credentials are globally unique, resolvable, and trustworthy.

Trusted Credentials Adoption (TCA) Group

The recently incarnated Trusted Credentials Adoption (TCA) Group foundations have now been established by the founding team:

Shared commitment to collaboration under principles of trust, transparency, and equity
Te Tiriti-based approach ensuring iwi involvement and Māori representation from the outset
Focus on priority sectors: payments fraud reduction, health, and education
Coordinated strategy for consistent market messaging and shared standards.

DINZ Strategy 2026: The Year of Digital Identity

It is estimated that at least 4 million+ credentials will be issued to New Zealanders in the next 12 – 24 months.

In 2026 DINZ will deliver a coordinated, sector-wide program built on structured engagement, clear communications, and measurable outcomes. 

The DINZ Executive Council has identified the following areas of work and will be prioritising based on available resources and member guidance and engagement.

Structured Industry Engagement: Sector-specific forums (finance, health, education, construction, travel, Māori data, public sector) driving co-design and standards alignment. Each will be framed as mini-ecosystem pilots with measurable adoption targets in line with interoperability standards (e.g., ISO 18013-5 mDL, W3C VC).

Capability Building: Customised training equips practitioners with the knowledge and skills necessary to navigate and leverage technologies such as decentralised identity, digital wallets, and verifiable credentials – DINZ Academy modules accredited under the DISTF capability framework supported by best practice modules.

Workshops and Seminars: Interactive sessions that delve into the latest trends, tools, and technologies in digital identity. Comprehensive guides, briefings, case studies, and reference materials to support ongoing learning.

Marketing & Adoption: Launch nationwide storytelling initiative showcasing digital-trust champions, iwi partnerships, and citizen success stories.

Communications & Reach: National campaign, accessible resources, and regional roadshows to grow public awareness and trust.

Expertise & Experience: Thought leadership in identity policy, trust architecture and cross-sector facilitation ensures efficient delivery.

Innovation Enablement: Integrated Ecosystem Innovation Hub with industry funded grants and pilot funding for emerging TrustTech solutions. DINZ will host an Ecosystem Innovation Hub to co-fund proofs of concept with DIA and industry. Each pilot will demonstrate measurable public-value outcomes (privacy protection, fraud reduction, access equity).

Inclusion & Access: Partnerships with Māori tech networks, SMEs, and training providers to extend digital trust capability nationwide.

DINZ Council election — voting opens Monday

Nominations for the new DINZ Council are now closed. Online voting will open next Monday, 10 November (please note only member primary contacts are eligible to vote). I could not be more grateful or excited about the quality of those nominated and I wish all well for what is shaping up to be a closely contested election. 

View the nominees here.

Key dates and upcoming events

10 November: List of nominees issued to Digital Identity voting members and electronic voting commences 13 November: Any proposed notices, motions, or remits to be advised to Digital Identity NZ 13 November: Trusted Credentials Adoption (TCA) Working Group Session 2, in person at Wynyard Quarter, Auckland 17 November: NZ vendor VC Solutions Showcase at NZTA – part of ISO’s international interoperability test event 25 November: Half day Identity Workshop focused on open banking and financial services hosted by Xero  2 December: The last informal DINZ Coffee Chat with Andy Higgs for the year 4 December: DINZ Annual Meeting & Council election results  4 December: TCA Working Group Session 3, in person at Wynyard Quarter, Auckland 11 December: Save the Date for our End of year Celebration – those that do the mahi should get the treats after all!

Check your inbox for invites or visit the events page on the DINZ website.

Recent highlights in digital public infrastructure

There have been several highlights in the past month across the identity specific digital public infrastructure landscape:

Excellent whitepaper published by Payments NZ – Digital Identity in the Digital Economy NEC NZ’s exciting announcement re iconic Kiwi Access Card (formerly 18+ Card)  The OPC’s Biometric Processing Privacy Code creating new rules for biometric processing comes into effect this month (applies to any new collection and use of biometric information from 3 November 2025 ) Reference Architecture Policy and Technical Working Group on track to deliver by Christmas Trusted Credentials Adoption (TCA) Group established.

More big announcements are imminent making for an action-packed end to the year.

The AWS NZ Region is now open. Build, scale and innovate locally.

The AWS Asia Pacific (New Zealand) Region is here, bringing game-changing opportunities to our shores. Three Availability Zones, single-digit millisecond latency, renewable energy and your data stays in Aotearoa. NEXTGEN, a trusted AWS distributor, together with AWS have hand-picked expert AWS partners to help with everything from AI tools and communications to security, cloud migration, contact centres and apps. Meet the partners, read success stories and book a free cloud assessment. 
Visit the hub → 

This is a sponsored member promotion for AWS/NEXTGEN. 

A warm welcome to all our new and returning members. Mahi tahi, when we work as one, the load is lighter and the journey richer. It’s up to each of us to keep the fabric of our community strong, connected, and vibrant.

Tihei mauri ora!

Andy Higgs
Executive Director
Digital Identity NZ

Read the full news here: Mahi Tahi: It takes a village to build an open, safe digital future

SUBSCRIBE FOR MORE

The post Mahi Tahi: It takes a village to build an open, safe digital future appeared first on Digital Identity New Zealand.

Andrew Shikiar, Executive Director and CEO of the FIDO Alliance tells us why passkeys are superior to passwords for online safety. The simple step to protect yourself online is to upgrade to passkeys.

Geneva, November 3rd 2025 — The participation of the Human Colossus Foundation in both an international and Swiss events underlines the necessity of new globally accessible protocols for digital authenticity and integrity.

1. Digital Transformation: Global Forces, Local Realities

Digital transformation is not a policy choice — it is a technological tide reshaping governance, democracy, and civic participation worldwide. Its impact is simultaneously global in scale (AI, data flows, platform power) and local in consequence (voter access, municipal infrastructure, cultural trust).

Last week, the Human Colossus Foundation’s participation in both the UNDP Global Conference on “New Ways of Governing” (Track 1: Governing Data & AI) and the Swiss “E-Collecting Hackathon” reflects a strategic positioning: to bridge the global discourse on digital sovereignty with the grounded, technical work of implementing democratic innovation at the national and municipal level.

2. Global Engagement: Shaping the Framework

On Oct. 28/29, at the UNDP conference in Oslo. The forum organised by the UNDP Global Policy Center for Governance the Foundation engaged with global thought leaders — from Indigenous data sovereignty advocates to EU regulators and Global South innovators — to help define what democratic digital governance looks like in a multipolar world. Key themes aligned with HCF’s mission:

New Ways of Governing: Track 1 : Governing Data & AI

Sovereignty as plural: Not state vs. tech, but hybrid models combining community control, technical design, and regulatory oversight.

Innovation at scale: Identifying pathways to move from projects to systemic change — a core challenge for HCF’s global network.

Governance through an ecosystem architecture: How data flows across independent sovereign partners, and interface design embed democratic values — or undermine them.

This global engagement ensures HCF contributes to — and is informed by — the emerging norms, frameworks, and political economies shaping digital governance worldwide.

3. Local Implementation: Trust Through Verifiability — “Trust But Verify” in Practice

Swiss SRF news - Saturday November 1st

On Oct. 31st and Nov. 1st in Bern, the Foundation brought its distinctive approach, coined Dynamic Data Economy (DDE), to the Swiss E-Collecting Hackathon: “Trust But Verify” — a design philosophy that ensures every participant can verify what concerns them, without needing to trust any single technological intermediary.

This is not just a slogan — it is an architectural principle applied consistently across scales:

🔹 Globally — In ecosystem design, DDE ensures that data flows, authentication, and consent mechanisms are transparent and auditable. No black boxes. No hidden intermediaries. Everyone — citizen, regulator, platform — can verify the authenticity and integrity of data flowing through the ecosystem.

HCF contributed with a team dedicated to developing verification as the vector of trust

🔹 Locally — In the Swiss e-collecting prototype, HCF advocated for paper/digital hybrid solutions where:

- Communes/Cantons can integrate in their systems softwares tools to help validate eligibility and produce encrypted authentic attestation without long term storing additional sensitive data.

- Committees, relying on the integrity of communes encrypted attestations, can compile initiatives or referendum for the Federal Chancellery without accessing voter identity. Real-time dashboard enables Committees to track the progress on verifired signatures.

- The Federal Chancellery can perform a second level control — through digital proofs, receipts, open APIs to secured registeries. Final decision on the acceptance of intitive or referandum to be backed by an auditable processes respecting the federal structure of Swiss democratic institutions. The problem we did not address during the hackathon is the essential ceremonial of depositing the boxes of signature form in Bern by the initative committee. Transfering a set of cryptographic key is less visual than a pile of boxes.

Dealing with accessibility with the representatives of the Incluthon Initiative that makes digital product available for people with disabilities

This is verifiable democracy: not just secure, not just private — but transparently accountable to all stakeholders. Trust must be earned, not assumed. The same underlying digital protocols that enable global data ecosystems also enable local voting systems.

Once the signature process is securely digitalised and harmonised with legacy systems, an enhanced form of participative democracy can emerge with new possibilities unavailable with solely paper based solution. During the hackathon, we discussed, for example, the possibilities that

Citizen can verify their signature was counted.

Swiss citizen abroad can participate as if they were in Switzerland, no time-lag.

Vision impaired persons are offered specific digital support with the same level of security without adding complexity to the communes, initiative committee or chancellery process

Tradition of signature in the street is kept and dedicated secured app for collecting agencies are developed

Extension of the system to cantonal petition without creating a separate infrastructure

Here is the “solution stack” we proposed to address the ten topics of the E-Collecting process.

For more information, connect to the E-Collecting website of the Swiss Chancellery for our report.

4. Synergy: From Global Discourse to Local Impact

The combination of these two events enables the Human Colossus Foundation to:

✅ Contribute to global vision — shaping how digital sovereignty, AI ethics, and participatory governance are defined — always through the lens of verifiability.

✅ Develop models locally — validating principles against real-world constraints in Switzerland’s federal, multilingual, and highly regulated context — with “Trust But Verify” as the anchor.

✅ Build bridges — between global policy, local governance, and technical implementation — creating feedback loops that make both levels stronger, more resilient, and more trustworthy.

This dual presence is not coincidental — it is strategic. Digital transformation cannot be governed from above or below alone. It requires actors who can operate across scales — and the Human Colossus Foundation is positioning itself as one of them, with a clear, consistent, and verifiable approach to building trust in digital systems.

Follow us through our different channels for more information.

Dontate today to the Human Colossus Foundation Contribute to the Dynamic Data Economy Overlays Capture Architecture Decentralised Key Management System

Permalink

Things really have improved, according to a new Dashlane study, and yet we’re sure that many of the sites you use all the time have yet to get the memo about passkeys.

Dashlane’s latest report about passkeys doesn’t offer fresh insights about why adoption of this account-security upgrade remains so uneven, but it does draw out two selfish reasons for sites to deploy it: either they’re afraid of a sign-in snafu costing them a single sale, or they fear a compromised login will cost them a customer’s money and then all of that person’s future business. In fewer words: Greed clarifies. 

Read the Article

Why passkeys The password problem persists, but the solution is accelerating

Despite years of warnings from security experts, passwords remain the Achilles’ heel of digital security. According to Dashlane data, the average person now manages 301 passwords across their personal and work accounts. Yet, credential abuse remains the most common initial attack vector.1 For CISOs and IT leaders, the problem is clear: The authentication method designed to protect users has become their greatest liability.

“The FIDO Alliance’s own data shows that passkeys significantly reduce sign-in time and have a much higher success rate compared to other authentication methods, meaning customers are able to get to the checkout cart more easily.”

Andrew Shikiar, CEO and Executive Director, FIDO Alliance

Read the Report

GuidePoint Security, IBM, Tenable, and Industry Partners Collaborate to Establish Framework for Preventing, Assessing, and Resolving Technology Exposures

BOSTON, MA, 30 October 2025 — As cybersecurity organizations face increasingly complex technology footprints and evolving cyber threats, a unified approach to exposure management has never been more critical. OASIS Open, the global open source and standards organization, is launching the Open Exposure Management Framework (OEMF) Technical Committee (TC) to create a community-driven, standards-based framework to prevent, assess, and resolve organizational exposures in organizational technology.

“Having focused on find-and-fix security for the last decade, I understand the importance of having specific guidance on managing technology exposure,” said Chris Peltz, GuidePoint Security and OEMF TC Convener. “I’m excited to be part of this group of stellar professionals building the Open Exposure Management Framework, which will deliver guidance on best practices and enable organizations to finally begin preventing exposure at scale.”

The OEMF TC will develop a comprehensive exposure management lifecycle and capability requirements that integrate with existing cybersecurity frameworks such as NIST, CIS, and Gartner. Its deliverables will include vendor-agnostic best practices, a maturity assessment model, and tactical implementation guidance to help organizations maximize their security investments.

The TC’s work will also address data inconsistencies across disparate exposure sources and bridge secure design practices with operational security activities. By establishing a functional lifecycle, mapping capability requirements to recognized frameworks, and defining an industry-accepted maturity scale, the framework will equip organizations with the tools to prevent, assess, and resolve technology exposures. These resources will be particularly valuable for larger enterprises, public entities, and organizations that design their own infrastructure and applications.

The OEMF TC welcomes contributions from cybersecurity professionals, security vendors, enterprise practitioners, and anyone committed to advancing exposure management practices. The first meeting is Friday, 31 October 2025. To learn more about how to get involved in this collaborative effort, contact join@oasis-open.org.

Support for the OEMF Technical Committee

GuidePoint Security
“GuidePoint Security is proud to contribute to the development of the Open Exposure Management Framework, helping define what effective Exposure Management looks like across the industry. This collaboration marks a key milestone in uniting the cybersecurity community around a common approach to reducing exposure and commitment to staying ahead of evolving threats.”
-Chris Peltz, Director, Strategy and Solutions Architecture at GuidePoint Security

Tenable
“Exposure management is a transformational mindset shift and strategic approach to how organizations measure and reduce cyber risk. Instead of reacting, exposure management enables organizations to get ahead of attackers by resolving issues before they can be exploited. This is why it’s so important that Tenable collaborates with cybersecurity luminaries to build an exposure management framework that empowers organizations to successfully implement exposure management practices and focus on what matters most.” 
-Eric Doerr, Chief Product Officer, Tenable

Additional Information
OEMF Project Charter
OEMF TC Homepage

Media Inquiries:
OASIS Open: communications@oasis-open.org

The post OASIS Launches Initiative to Standardize Exposure Management Practices in Cybersecurity appeared first on OASIS Open.