Not metadata — a cryptographically verifiable legal identity record. An AID answers the four questions a skeptical counterparty must resolve before relying on an autonomous agent: who it is, what it may attempt, under whose authority, and what evidence exists.
Every field earns its place by enforcing a named property. Select a line to see the rule it carries — and why removing it would break the trust decision.
The document is encoded with a single canonical rule so it hashes identically in every implementation — key order sorted, numbers as integers or decimal strings, no floats. Hash verification is meaningless if two verifiers serialize differently.
Versions increment by exactly one. The chain is append-only, so history cannot be silently rewritten — every prior state remains reachable and hashable.
A PRAXIS agent identity must be a Tezos tz4 (BLS12-381) account. The BLS scheme lets principal, agent, and witness signatures aggregate into one verifiable artifact rather than three separate checks.
Control is vested in the controller recorded in the anchor — a legally answerable tz1 principal or wallet — not in whoever holds the token. Changing it is a deliberate two-step handoff, never a silent transfer.
Dotted namespaces register what the agent is permitted to try — a discovery surface for counterparties. They are never a grant of authority. Actual authority is the live CPoA.
The delegation chain must terminate in a depth-0 root principal. The anti-“unaccountable void” rule is enforced by validateAid — an identity that cannot name a legally answerable principal is rejected at construction.
The live, scoped, revocable mandate the agent acts under, referenced by hash. Discovery proposes an authority chain; the CPoA record confirms it is active, in-scope, and unexpired at the moment of action.
Derived once at genesis and carried unchanged through every later version. It is the immutable identity root — its constancy is checked on every chain walk, so an identity cannot be quietly re-based.
Each version commits to its predecessor by content hash. The chain is verified link by link back to genesis; a broken or forged link fails closed.
Declared IAL / AAL / FAL levels and key custody, drawn from the NIST vocabulary, let a relying party require a floor before trusting. A one-byte downgrade is caught by re-projection.
Active, superseded, or revoked — evaluated at an explicit instant with no hidden clock. Revocation is terminal; an offboarded identity can never read as active.
The whole model rests on two commitments that never fall into a fixpoint — each is defined over a preimage that excludes itself.
SHA-256 of the canonical document with the proof removed. This is what chain links reference and what the on-chain NFT anchors. Recomputed by every resolver against the fetched bytes.
Derived once, then carried unchanged through every version. Excluding it from its own preimage removes the fixpoint, so the value is well-defined and its constancy is checkable forever.
The full trust decision decomposes cleanly across the Tezos Agent Protocol layers. Identity is the load-bearing base; the higher layers rest on it.
The AID plus the soulbound FA2 anchor. What is this, and is this version authoritative?
The scoped mandate and its content-bound proof — signature verification is real; the live policy engine that evaluates an action against it is the remaining seam.
The controller plus a governance multisig. Who may change the identity, and how.
The append-only chain and emitted events. What happened, and can it be replayed?