From human or bot to who is behind the agent
More and more of what happens online is done by software acting for someone: agents that check out, sign up, book and reply on their own. Every one of those actions starts with a person and ends at a service that has to decide whether to trust it.
So the question changes. It used to be “human or bot?” Now it is a sharper one.
Is a real person behind this agent, is it one person, and what exactly did they authorize?
What a service needs to know
When an agent shows up at a checkout, a sign-up form or a comment thread, the service is weighing four things.
- 01Human origin. A real person asked for this.
- 02Uniqueness. One person counts once, however many agents they run. A free trial, a vote or a limited release depends on it.
- 03Scope. “Buy these headphones, up to 80 euros” is a very different permission from “act in my name”.
- 04Responsibility. Someone stands behind the action, and the delegation can be switched off.
What Soverage does today
The usual shortcut hands the agent a login, a saved card and an inbox, and every site it visits collects a little more. A better design separates proving that a real person is involved from revealing who that person is. Most tasks only need the first.
Soverage Gateway, in beta, covers that human side. A person links a wallet, completes a one-time document check (the document is deleted right after it) and receives W3C verifiable credentials in their own wallet. Email, phone, a passkey and social accounts can be added over time.
- Link a wallet
- One-time document check, deleted right after
- W3C verifiable credentials in your own wallet
- Narrow answers through selective disclosure
- Scoped, revocable credentials a person hands to an agent
- Service rules like one trial per person, across a fleet of agents
Services then ask narrow questions and get narrow answers, “unique human: true”, “over 18: true”, through selective disclosure. Name, birth date and documents stay with the person.
Stacking independent signals is what makes duplicates costly: the idea is to make it expensive to be two people.
Extending it to agents
A natural next step is a narrower credential that a person hands to an agent, derived from their own. It says the agent represents a verified, unique human, for this task, at this service, within this limit, until a set date or until the person revokes it from their wallet. The service learns that a real person approved the action and how far it goes, and the identity stays home.
A delegated proof
Direction- PersonVerified once. Holds their own credentials.
- CredentialDerived from theirs: this task, this service, this limit.
- AgentActs within that scope. Revocable from the wallet.
- ServiceLearns a real person approved it, and how far it goes.
The ecosystem is moving the same way. Google’s Agent Payments Protocol describes a shopper’s instructions to an agent as signed mandates built on verifiable credentials, shared through standards like OpenID4VP. A personhood layer supplies the first link: whoever signs is a real person, counted once.
With that link in place, a service sets its own rules, one trial per person or five agents per person, and still counts one human behind a fleet of assistants.
Looking ahead
Soverage covers the first layer today: a real, unique person, verified once, holding their own credentials. Scoped, revocable proofs for agents are the direction Soverage is exploring next, and teams building agents, marketplaces or communities are invited to share what they would need.
