papers/lux-agent-sovereignty/sections/03-agent-identity.tex

\section{Agent Identity}
\label{sec:identity}

Each Agent Capsule possesses a decentralized identifier conforming to the W3C DID specification~\cite{w3c-did2022}, anchored on the Lux I-Chain:

\begin{verbatim}
    did:lux:agent:<capsule-id>
\end{verbatim}

The DID document contains:

\begin{itemize}
    \item \textbf{Verification methods.} Public keys for authentication, assertion, key agreement, and capability invocation. Post-quantum keys (ML-DSA) are included alongside classical (Ed25519) for crypto-agility.
    \item \textbf{Service endpoints.} The agent's MCP endpoint for tool invocation, its messaging endpoint for inter-agent communication, and its attestation endpoint for proof submission.
    \item \textbf{Controller.} The principal's DID, establishing the delegation chain from human (or organizational) authority to agent autonomy.
\end{itemize}

\subsection{Verifiable Credentials}

Agent capabilities are expressed as W3C Verifiable Credentials~\cite{w3c-vc2022} issued by the principal and anchored on the I-Chain. A credential asserts that agent $A$ holds capability $c$ with scope $s$ until expiry $t_{\text{exp}}$:

\begin{equation}\label{eq:vc}
    \text{VC}(A, c, s, t_{\text{exp}}) = \text{Sign}_{\text{sk}_P}\big(\text{did}(A) \| c \| s \| t_{\text{exp}}\big)
\end{equation}

where $\text{sk}_P$ is the principal's signing key. Credentials are verifiable by any party holding the principal's public key, which is resolvable from the I-Chain.

\subsection{Delegation Chains}

Agents may delegate subsets of their capabilities to other agents, forming delegation chains. If agent $A$ holds capability $c$ with scope $s$, it may issue a delegated credential to agent $B$ with scope $s' \subseteq s$:

\begin{equation}\label{eq:delegation}
    \text{VC}_{\text{del}}(B, c, s', t'_{\text{exp}}) = \text{Sign}_{\text{sk}_A}\big(\text{did}(B) \| c \| s' \| t'_{\text{exp}} \| \text{VC}(A, c, s, t_{\text{exp}})\big)
\end{equation}

The delegation chain is bounded: the maximum depth $d_{\max}$ is specified in the original credential. Verification requires traversing the chain to the root principal and confirming that each link narrows (never widens) the scope.

\begin{proposition}[Scope Monotonicity]
For any delegation chain $P \to A_1 \to \cdots \to A_n$, the scope at each level is a subset of its parent: $s_n \subseteq s_{n-1} \subseteq \cdots \subseteq s_1 \subseteq s_P$. No agent in the chain can exercise capabilities beyond those granted by its immediate delegator.
\end{proposition}

\subsection{Revocation}

Credentials are revocable by the issuer at any time. Revocation is recorded on the I-Chain in a revocation registry indexed by credential ID. Verifiers check the registry before accepting any credential. Revocation propagates down the delegation chain: revoking $A$'s credential automatically invalidates all credentials $A$ has issued.