Identity
How can people and organisations prove who they are without surrendering the identity, data, and intelligence built around them?
Identity is sacred—and increasingly easy to imitate. AI can clone a voice, face, or writing style.
Identity, truth, and trust form a single meta-problem: you cannot build consensus if you cannot verify who is in the conversation.
The Bridge
Identity connects the inner game to the outer game. Who you are (character, values, culture) is shaped by community and shapes community in return. Crypto makes this legible — not by replacing identity, but by making it portable, sovereign, and verifiable without surrendering it to a gatekeeper.
| Layer | What it is | Where it lives |
|---|---|---|
| Inner | Character, values, pepeha — who you are before you act | Agency |
| Social | Culture, community, belonging — identity in relation | The Journey |
| Verifiable | DIDs, ZKPs, proof of personhood — identity that travels | This page |
A pepeha declares identity to a room. A DID declares identity to a network. Same function, different scale. The inner identity must be real before the verifiable identity means anything.
The Crisis
Deepfakes create two risks: a specific falsehood may be believed, or authentic evidence may be dismissed as synthetic. Both weaken confidence in digital speech.
| What's At Risk | The Threat |
|---|---|
| Personal likeness | Voice, face, writing style cloned without consent |
| Reputation | Synthetic content attributed to real people |
| Authentication | "Seeing is believing" no longer works |
| Public discourse | Cannot verify who is actually speaking |
The greatest challenge: balancing transparency and privacy while pursuing intents and purposes.
Proof of Personhood
Proof of Personhood (PoP) ensures each participant in a decentralized system is a unique human being. Prevents Sybil attacks where an attacker creates multiple fake identities to manipulate the system.
| Property | What It Does |
|---|---|
| Uniqueness | Each participant verified as a unique human |
| Sybil Resistance | Multiple fake identities cannot manipulate the system |
| Equality | Equal voting power and rewards, independent of economic stake |
Methods: Biometric verification (iris scans — WorldCoin), physical verification (pseudonym parties), time-locked wallets, zero-knowledge proofs.
Self-Sovereign Identity
Self-sovereign identity means a person or organisation can control how its identifiers and credentials are used without making one platform the permanent owner. It is an architectural goal, not a guarantee supplied by blockchain alone.
| Property | What It Requires |
|---|---|
| Control | Grant, constrain, and revoke use of credentials |
| Privacy | Reveal only what the decision requires |
| Portability | Move credentials without rebuilding identity for each service |
| Recoverability | Recover access without handing one provider unilateral power |
| Accountability | Inspect issuers, verifiers, policies, and revocation paths |
Methods: Decentralized Identifiers (DIDs) on-chain, Verifiable Credentials without exposing sensitive data, ZKPs for attribute proof without disclosure.
Sovereign Attention
Not your identity, not your data. Not your model, not your mind.
This is a warning about dependency, not a claim that a platform can own a person. When another system controls your credentials, behavioural history, model objective, and interface, it gains leverage over what you can access and what reaches your attention.
People and organisations need a sovereign layer inside the wider technology stack:
| Layer | Sovereign question | Minimum control |
|---|---|---|
| Identity | Who can prove who we are? | Hold or govern credentials; choose what a verifier learns |
| Permission | Who may use them, for which purpose, and until when? | Grant bounded access and revoke it |
| Data | Who remembers our behaviour and relationships? | Inspect, export, delete, and selectively share records |
| Model | What intelligence learns from that history? | Choose the model, context, objective, and retention policy |
| Attention | What gets ranked into focus, and why? | Set the intention; inspect and change the ranking rules |
| Proof | Did the system follow those rules? | Retain receipts that can be independently checked |
The loop changes when these controls move toward the edge:
Platform objective -> algorithm -> your attention
becomes
Your intention -> governed data and model -> your attention
Owning every server is unnecessary. The practical goal is to own or govern the decision layer closest to the person or organisation, while using shared infrastructure under explicit permissions.
Use the six layers as a reusable model. Start at identity and stop at the first layer where the subject cannot inspect, constrain, revoke, or leave. That layer is the current sovereignty boundary.
Zero-Knowledge Proofs
ZKPs prove a statement is true without revealing additional information. The enabling primitive for both PoP and DID.
| Application | What ZKPs Enable |
|---|---|
| Attribute verification | Prove age or nationality without revealing the data |
| Identity verification | Prove credentials without exposing sensitive information |
| Transaction privacy | Validate transactions without revealing details |
| Access control | Prove permissions without disclosing identity |
| Compliance | Meet regulatory requirements without compromising privacy |
A ZKP protects a proof boundary. It does not decide who stores behavioural data, which model learns from it, or which objective ranks a feed. It is one primitive in the sovereign stack, not the whole stack.
Sui's zkLogin is a concrete example: a person can authorise an on-chain transaction with an OpenID credential without publishing the underlying account identifier on-chain. The remaining OAuth, salt, proving-service, application-data, and attention controls still need to be evaluated separately.
Data Sovereignty
Identity sovereignty and data sovereignty are related but different. A person may control a credential while an application still owns the interaction history built around it. An organisation may control customer records while depending on an external model whose retention and optimisation rules it cannot inspect.
Use this five-part test before calling a system sovereign:
- Can the subject understand what is being proved or collected?
- Can the subject refuse, constrain, export, and revoke it?
- Can the subject choose which data and objective direct the model?
- Can the subject inspect why information or action was recommended?
- Can the subject leave without losing their identity or history?
If any answer is no, name the dependency instead of claiming full sovereignty.
Context
- Agency — Identity in motion — character plus capability
- The Journey — Identity is the root of the Theory of Knowledge
- Culture — Identity is shaped by and shapes culture
- Pepeha — The deepest prompt: declaring what grounds you
- The Mycelium — Truth, trust, identity as agent commerce infrastructure
- Web3 Identity Tech — Implementation stack
- Zero Knowledge Proofs — The enabling primitive
- Data — The custody, consent, purpose, and model-context layer
- Data Footprint — Map where organisational data enters, compounds, and directs agents
- Sui Technical — zkLogin as a bounded implementation example
- Verifiable Truth — What identity is built on
- Identity — The human anchor — who you are before you prove it
- Truth Recognition — The capability loop that identity anchors
- Trust — What identity enables
- Smart Contracts — Deterministic execution layer
- Principles — Test whether identity infrastructure serves human agency before scaling it
Links
- Why Identity Matters
- Decentralized Identity Foundation
- Ethereum Decentralized Identity
- Biometric Update
Questions
When AI can clone any voice, face, or writing style, what does "proving you are you" actually mean?
- If biometric verification (iris scans) solves Sybil resistance but creates a biometric database, has identity become more secure or more fragile?
- At what point does privacy-preserving identity (ZKPs, selective disclosure) become so frictionless that people stop understanding what they are proving?
- If decentralized identity works across platforms, who maintains the revocation list — and what happens when they disagree?
Changes my mind: evidence that a person or organisation can preserve equivalent control, portability, privacy, and exit while one application permanently owns the identity record.
Next question: at which layer—identity, permission, data, model, attention, or proof—does your current system first remove the subject's power to leave?