A Claim Is Not a Credential
Earlier in this series I argued that an AI agent should carry a passport — a verifiable record of what it is, what it's authorized to do, and who answers for it — and then, in the essay that followed, that the passport has to keep working when the agent can't phone home. Both took one thing for granted and left it deliberately unexamined, because it turns out to be the whole game: who signs the passport? A record you can carry to the edge and reconcile honestly is worth exactly what its issuer is worth. So before going any further, that question has to be answered.
The industry has a ready answer, and it's the wrong one. In most of the agent-identity schemes being drafted right now, the passport is signed by the agent itself, or by the operator who deployed it. The credential is cryptographically signed, the signature verifies, everyone moves on satisfied. They shouldn't be. A signature that verifies tells you the document hasn't been altered since it was signed. It tells you nothing about whether what the document says is true — not when the signer and the subject are the same party. The signature is a loop closed on itself: it proves the message is intact; it cannot prove the message is honest. Cryptography here lends the proceedings an air of rigor the underlying logic hasn't earned.
We already have a word for a document in which the subject describes itself: a business card. Anyone can print one. It can say Director, it can say Chief Trust Officer, it can list any authority at all, and the printing press will not object. A passport is a different kind of object entirely. You do not issue your own passport. A state issues it, a state's reputation stands behind it, and — this is the part that matters most and is most often missed — a state can take it back. A business card and a passport are both documents about you. Only one of them can be revoked, and only one of them means anything to a stranger who has no prior reason to believe you.
A self-signed agent passport is a business card with a cryptographic flourish. The flourish is real; the passport is not.
The three things a credential has that an assertion does not
Set the two side by side and the distinction sharpens into something you can build on. An assertion is a claim a subject makes about itself. A credential is a claim a third party makes about a subject — and it carries three properties an assertion structurally cannot.
The first is independent issuance. Someone other than the subject, someone with standing and something to lose, has put their name behind the claim. The diploma is issued by the university, not the graduate. The medical license is issued by the board, not the doctor. The value is not in the document; it is in the fact that an entity with a reputation chose to stake a sliver of it on you being who you say you are.
The second is revocability. The vouching can be withdrawn. This is not a minor administrative feature — it is the heart of the thing. Trust that cannot be taken back is not trust; it is a one-time bet. A license can be suspended, a passport pulled, a certificate revoked. The capacity to withdraw is what lets a credential track reality over time, as the subject's behavior or circumstances change. An assertion has no such mechanism. The subject simply keeps asserting, and there is no one positioned to stop.
The third is recourse. A credential creates a party, other than the subject, who is answerable when things go wrong. When a notarized document turns out to be fraudulent, there is a notary to investigate. When a self-signed claim turns out to be false, there is only the liar, pointing at their own signature. The deepest question in any trust system is not "can I identify this party," but "who do I turn to when this party is wrong?" An assertion's answer is: the very party that wronged you. A credential's answer is: someone else.
Why an agent needs this more than a crate of goods does
The provenance systems for physical goods can mostly get away with issuing a record once, because the thing the record describes holds still. An agent does not hold still. It acts, continuously, and it can be changed continuously — re-permissioned, pointed at new tools, handed new authority — and the operator's own standing can shift underneath it. A passport signed at deploy time and never revisited tells a counterparty what was true at deployment. It says nothing about whether the authorization still holds in the moment the agent is reaching into your system.
A revocable credential, checked at the moment of action, is a different kind of object. It isn't a record; it's a control surface. The issuer can pull it the instant the agent misbehaves, or the operator loses standing, or the configuration drifts past what the issuer was willing to vouch for — and because the credential is checked at use rather than at issuance, the withdrawal actually bites. This is the property that turns a passport from documentation into a live instrument of trust. It is also, not by coincidence, the property that will matter most at the harder question standing just behind this one — who pays when an agent gets it wrong — which is large enough to need its own essay.
What a credential does not do
It would be a mistake to oversell this. Independent issuance and revocability do not make the underlying claim true. A registrar can sign a fraudulent diploma. An auditor can certify a company that then collapses. An issuer can vouch for an agent that goes on to fail in a way no one anticipated. A credential is not a guarantee of correctness, and anyone who sells it as one is selling the same overclaim that has given trust-marks a bad name for as long as they've existed.
It's worth being precise about which failure the cryptography actually rules out, because this is where a great deal of current enthusiasm quietly overreaches. A signed, tamper-evident record proves that a claim has not been altered since it was made and that a specific party made it. Those are real and valuable properties: an examiner can hold the record up and the signer cannot disown it or quietly rewrite it after the fact. But a record no one can forge or repudiate is not the same as a record that is true. Integrity and non-repudiation are properties of the document; truth is a property of the world the document describes, and no amount of signing reaches across that gap. This is the failure mode toward which a great deal of current effort drifts — building ever more control over the infrastructure, signing every action into an unforgeable log, and treating the resulting audit trail as if it settled the question of whether the agent should have been trusted in the first place. It settles that the trail is intact. It says nothing about whether the authority behind it was ever sound. The only thing that reaches the second question is an issuer independent of the subject — which is the whole point of a credential, and precisely what a self-signed log, however cryptographically impeccable, does not have.
What a credential does is narrower, and more useful than a guarantee. It relocates the consequence of being wrong. When an assertion turns out to be false, the loss falls on whoever relied on it — the counterparty, the customer, the person on the far end who didn't even know an agent was involved. When a credential turns out to be false, there is, by construction, an independent party who chose to put their name on it: someone with standing, something to lose, and the ability to have withdrawn it. The credential doesn't remove the possibility of failure. It moves the cost of failure onto a party who agreed to bear it. That relocation is the entire product.
Which is why the issuer question is not a detail to be settled once the schema is finished. It is the thing that determines whether the schema is worth finishing. A passport with thirty well-designed fields, every one of them signed by the party the fields describe, is a more elaborate résumé. A passport with six fields signed by someone independent who can revoke them is a credential. The agent industry is going to be tempted, hard, by the first version — because it's free, and it ships this quarter. The second is slower, costs something, and forces a reckoning with who the issuers are and what they are liable for. It is also the only version that survives contact with anyone who has a reason to check.
The first essay in this series argued that in an economy where generation is free, the scarce and valuable thing is the ability to verify what was actually done. This is that argument aimed at a narrower target. Producing the claim was never the hard part. The hard part — the part that is actually worth something — is finding someone willing to sign it who has something to lose if it's false.
A small open-source reference implementation of these ideas lives at github.com/surroundapps/human-credential.