Semantic Trust Infrastructure
QuantumFieldInc.
The proof layer for the agentic economy — making every agent's identity, authority, and governance independently verifiable.

The future
will be verified.

Not asserted. Not inferred. Computed. As software becomes an economic actor, trust must move from institutional convention to computational fact.

The defining question of the agentic internet is no longer whether machines can think — it is whether they can prove they are authorized to act.

See how it works Explore PRAXIS
The design creed Identity is a function of authorization and accountability — never reputation.
01 — The predicate problem

Every autonomous action raises the same unanswered question.

Agents are already transacting — initiating payments, executing settlement legs, negotiating inside regulated workflows. On whose authority? Verifiable how, without trusting the operator's own API? Existing identity mechanisms fail this in structural, not incidental, ways.

MechanismWhat it establishesWhy it fails the agent question
API keys / OAuthsession auth
A connection is authenticated.
Authenticates a session, not an accountable principal — and leaves no tamper-evident history a third party can replay.
PKI certificateskey ↔ name
A key is bound to a name.
Says nothing about delegated scope, assurance level, or lifecycle discipline; revocation is a weak, poll-based afterthought.
Reputation / scoresaggregate signal
An aggregate signal of past behavior.
Actively harmful here: farmable, purchasable, Sybil-inflatable — and uncitable by a regulator or court.
Web2 agent registriesdirectory row
A directory entry exists.
Reduces to "trust the registry" — a single point of failure, capture, and silent edit.
The missing primitive

A cryptographically anchored, append-only, standards-graded identity record whose every claim is independently checkable from public artifacts alone — with no reliance on the issuer's continued cooperation, honesty, or existence.

02 — One statement, five audiences

A single principle, read differently across every domain it touches.

"The future will be verified" is not a slogan. It is a design constraint with a specific meaning in each field where autonomous systems are about to become participants.

Intelligence
AI systems carry verifiable identities, scoped permissions, and provenance for every action they take.
Finance
Transactions and assets settle against cryptographic proof rather than reputation or intermediation.
Law
Authority and accountability become machine-verifiable — delegation encoded, not merely documented.
Knowledge
Facts, provenance, and lineage are cryptographically anchored — a knowledge graph of trust itself.
Commerce
Autonomous agents transact on demonstrated authority — proving what they are permitted to do.
The three-layer anchoring model

No single layer is trusted alone.

An agent's identity exists at three layers, each doing one job. The document is the source of truth; the token is the anchor; the chain is the transparency log. A resolver that checks only one has not verified identity.

L1
On-chain anchor
A soulbound FA2 token (TZIP-12/16/21), permanently bound 1:1 to the agent. Its metadata commits to the current document — aid_hash, version, controller, status. It holds a commitment, never identity data.
Tezos L1
answers: what's live now
L2
Permanent storage
Every version of the Agentic Identity Document is written once to Arweave, immutably, forever. The document is the source of truth; the token merely points and commits.
Arweave
answers: readable in ten years
L3
Version chain
Each version names its predecessor by content hash; genesisHash is the immutable identity root, constant across every version. A per-agent transparency log — never rewritten, never deleted.
v1 ← v2 ← v3
answers: prove it wasn't forged

The binding rule. The token could point anywhere, so a resolver re-hashes the fetched document against the on-chain commitment. The document could claim any predecessor, so the chain is walked link by link back to genesis. Verification never trusts an indexer — it recomputes. Read the full architecture →

03 — The Agentic Identity Document

What a skeptical counterparty can resolve, without trusting anyone.

The AID exists to answer one question for a bank compliance desk, a regulator, a settlement contract, or another agent: who is accountable, what is it registered to do, which version is authoritative, at what assurance, and is it still active? See the field-by-field anatomy →

Q1
Who is accountable for this agent?
A delegation chain that must terminate in a depth-0 accountable legal principal — enforced by validateAid, not merely suggested.
Q2
What is it registered to do?
Dotted capability namespaces — a discovery surface, never a grant. Live authority is the scoped, revocable CPoA in cpoaAnchors[].
Q3
Which version is authoritative?
The anchor names exactly one current version and hash; an old version replayed as current fails verifyAgainstAnchor.
Q4
At what assurance — and is it live?
NIST SP 800-63 floors (IAL/AAL/FAL + key custody) plus point-in-time effectiveStatus with no hidden clock.
First-class primitives
Identity
A did:tz over a tz4 (BLS12-381) account — signatures that aggregate principal, agent, and witness into one artifact.
Authority
Delegation chains with an enforced accountable root; capabilities distinct from grants; CPoA committed by hash.
Provenance
An append-only version chain with a constant genesis root — silent rewriting is detectable by construction.
Lifecycle
Expiry, rotation, offboarding, and terminal revocation are first-class — an identity cannot outlive its mandate.
Compliance
Scored against five NIST NCCoE properties and the OWASP NHI Top 10 — descriptive and gap-honest, never a certification.
Try It · Default-Deny, Live

Ask the mandate a question. Watch it decide.

This is the real scope grammar — the same closed, default-deny logic the SDK ships. Pick an action and an amount; the mandate resolves the request against a live Cryptographic Power of Attorney. Nothing is allowed unless a statement explicitly permits it.

cpoa:record · active signature ✓
principaltz1Ldn… · US Bank NA
agenttz4Gk9…settle-01
allowed actionpayments.transfer
ceiling1,000,000 USDt
window2026-07-01 → 10-01
Can this agent…
500,000
Adjust the request to resolve it
The engine evaluates every dimension — action, then ceiling — and denies unless all pass.
Protocol Suite · Developed by Quantum Field
PRAXIS
The Agentic Identity Standard

Where traditional systems ask "who are you," PRAXIS answers who, under what authority, and whether it can be proven.

An open protocol family for autonomous entities — establishing identity, delegated authority, governance, provenance, and computable compliance as first-class primitives. Agent ID is the load-bearing base; the wider TAP stack extends the same doctrine upward.

Identity — TAP-1 / 2
Agents · Organizations · Wallets
Authority — TAP-3
Delegation · CPoA · Revocation
Governance — TAP-5
tz4 / BLS multisig spine
Transparency — TAP-8
Append-only event log
Explore the protocol
04 — Standards alignment

Enforced, not decorative.

Where the protocol claims a standards property, a validator or the compliance evaluator actually checks it. Citing a control without wiring its check is treated as a defect.

W3C DID / VC
Decentralized identifiers
The AID is a did:tz; keys, services, and credentials follow DID-core shapes. Credentials are hash references — inline PII is structurally impossible.
NIST SP 800-63
Assurance floors
IAL / AAL / FAL plus key custody, validator-enforced, so a relying party can require a floor before it transacts.
NIST NCCoE
Agent identity properties
Provenance, delegation, and the audit chain map to identification, non-repudiation, and auditing — scored, with gaps reported honestly.
OWASP NHI Top 10
Non-human identity risk
Lifecycle, assurance, and security posture actively mitigate improper offboarding, secret leakage, overprivilege, and long-lived secrets.
Tezos TZIP-12/16/21
On-chain anchor
A soulbound-constrained FA2 with rich token metadata, and an explicit FA2.1 / TZIP-26 migration path for native events and views.
W3C PROV-O / RDF
Verifiable knowledge graph
Lineage and delegation reuse PROV-O; the graph ships a JSON-LD context and a Turtle ontology, deterministic without blank nodes.
— The engineering baseline

Conformance you can prove. Artifacts that cannot drift.

Two guarantees make the standard real rather than merely written: a second implementation can prove byte-for-byte agreement without reading the code, and every published figure is mechanically bound to the source that generated it.

FIXTURES · CANONICAL-VECTORS

Golden byte-equality vectors

Determinism is externally testable. A published suite fixes { input, canonical, sha256 } across recursive key sorting, unicode escapes, and safe-integer bounds — plus rejection vectors an encoder must refuse. A Python indexer or Rust verifier reproduces every acceptance vector and rejects every rejection vector, proving hash compatibility without reading a line of TypeScript.

9 + 3acceptance + rejection
praxis-canonical-json/1the frozen encoding
PHASE 0 · COMPLETE

The artifact-drift gate

Every example and fixture is generated, never hand-edited — and CI enforces it. On each push across Node 20 and 22, the pipeline regenerates everything from source and fails on any difference. The gate is proven in both directions: a hand-edit fails, the honest tree passes. Releases publish with npm provenance, binding the tarball to the exact commit.

exit 0 / 1proven both directions
npm provenancetag-gated releases
Verify, don't trust

Every figure is reproducible from one command.

The reference implementation regenerates every example from source, reprojects the knowledge graph, replays the golden byte-equality vectors, re-verifies the chain and anchors, executes a deliberate tamper that must be rejected, and fails on any drift between the committed artifacts and what the code generates. No figure is transcribed by hand. Run a live proof in your browser →

The pipeline is the argument. Examples and fixtures are generated artifacts, and a drift gate — proven in both directions — fails CI on any hand-edit, so schemas, SDK, and artifacts can never diverge unnoticed. A reviewer verifies the core claims mechanically rather than taking them on faith.

68
tests passing — core, crypto, graph, resolver e2e
0
vulnerabilities in the shipped surface (2 audited deps)
1
command reproduces every figure
05 — Honest boundaries

What is not yet done, stated as plainly as what is.

A trust system that hides its own edges has not earned trust. Every stub, mock, and unaudited component is labeled — a mock is never presented as real. Phase 0, the engineering baseline, is complete; each remaining phase is gated on the one before it.

Invariant I11 · honesty about boundaries
PHASE 2

The smart contract has a full SmartPy test harness but is unaudited — the tooling refuses mainnet origination by policy. This is the one boundary held closed by choice, not capability; a clean audit precedes Ghostnet.

SHIPPED

Signature verification, the live Arweave client, and the deployable resolver are now real and fail closed — signed examples verify end-to-end with content-bound BLS proofs.

ILLUSTRATIVE

Example Arweave transaction IDs are placeholders until a live upload. The proofs over them, by contrast, are now real signatures — as is every hash, chain link, and vector, each drift-gated.

PHASE 4

The w3id.org/praxis identifiers await registration at stable URLs; the evaluator describes compliance — it does not certify it.

See the full phased roadmap

Trust, made computable.

An identity that cannot show its accountable principal, its authority, the assurance of its keys, and the unbroken history of its versions has asked to be trusted. PRAXIS is built so it never has to ask.

Watch a proof run Explore the protocol See it for your institution