Part 1 of the four-part series "Humans, Agents, Mandates: The Web Learns Identity". Part 2 (Human or Machine?) follows on September 5, part 3 (When Your AI Agent Pays) on September 8, part 4 (When Your Agent Represents You) on September 12.
Imagine losing your most important online account tomorrow. Not through a hack, but because the platform suspends it or simply shuts down. With the account go your name, your contacts, your posts, your reputation. That is not a contrived scenario; it is the normal architecture of today's web: our online identity is borrowed. It is a row in a provider's database, and the provider decides whether that row still exists tomorrow.
This is exactly the point several projects have been working on for years, projects that at first glance have little to do with each other: the Fediverse, web inventor Tim Berners-Lee, and lately the European Union. Their shared goal: an identity that belongs to the person rather than the platform. For a long time this was considered an idealists' niche. Why it is becoming urgent right now will emerge at the end of this series - it has to do with AI agents acting in our name.
Identity as a rental
Today's model is convenient and comes with a built-in catch. Whether it's your Google login, your Instagram profile or the account at your favorite forum: the identity lives inside the provider's infrastructure. Three dependencies follow:
- The provider can terminate. Account suspensions hit innocent people too, and a discontinued service takes the identity to its grave.
- The data stays in the silo. Followers, reviews, purchase history: none of it can be fully taken along.
- Switching means starting over. Leave the platform and you start from zero. That is not an accident but a business model: lock-in keeps users in place.
The Fediverse: moving boxes for your identity
The Fediverse, the network of federated services like Mastodon, has softened the problem without solving it. A Mastodon identity works like an email address: it belongs to a server. If the server goes offline - which happens regularly with volunteer-run instances - the identity is lost. The built-in migration mechanism transfers your followers but not your posts, and it requires the old server's cooperation. If you were banned, you cannot move.
More interesting is a concept that is older than ActivityPub itself: nomadic identity, in production for years in the Hubzilla and Streams platforms. The idea: the identity is not a database row on one server but a cryptographic key pair owned by the person. The account exists as a clone on several servers at once; if one fails, the others carry on. Since 2023, the proposal FEP-ef61 "Portable Objects" has been trying to bring this principle into the ActivityPub world: posts and profiles are cryptographically signed and thereby independent of whichever server currently hosts them.
Berners-Lee: the web gets an identity update
The most prominent champion of the idea is, of all people, the man who invented the web. Tim Berners-Lee has spent years on Solid), a project started at MIT that extends the web with exactly what was missing in 1989: identity management, access control and a standard format for personal data. At its core are so-called pods, personal data stores: my data lives with me (or a provider of my choosing), and apps ask for access instead of owning it. Data is organized around the person, not around the service.
To commercialize the idea, Berners-Lee founded the startup Inrupt, which now offers a Data Wallet: a digital wallet that holds all kinds of data and credentials and puts consent into the person's hands. This is no longer a lab project: the UK's National Health Service and the regional government of Flanders have piloted Solid-based systems to give citizens control over health records and digital identities. The governance is notable too: responsibility for the Solid standard now rests with the nonprofit Open Data Institute - the vision is not supposed to depend on a single company.
And now the state joins in: the EUDI wallet
What the Fediverse and Solid attempt from below, the EU is now mandating from above. The eIDAS 2.0 regulation obliges all 27 member states to offer their citizens a free digital identity wallet by the end of 2026; Germany plans to launch in early January 2027. The EUDI wallet is meant to hold your ID card, driver's license or diplomas as digital credentials, usable EU-wide, online and in person - and using it remains voluntary. You can think what you like about it (netzpolitik.org dissects the open privacy questions in a worthwhile read), but the direction is remarkable: the state, too, is organizing identity as a wallet held by the person, not as an account held by a platform.
The common principle: keys instead of accounts
However different the Fediverse, Solid and the EUDI wallet are, technically they converge on the same foundation: identity is the possession of a cryptographic key pair, not a row in someone else's database. Whoever holds the private key can prove who they are - regardless of which server happens to be running and which platform happens to exist. How powerful this principle is at small scale, I described using the example of passkeys; self-owned identity is the same idea, one floor up.
Which leaves the honest question: why should this succeed now, after nobody cared for 20 years? OpenID, "Web 3.0", countless identity startups - the graveyard list is long, because most people simply did not care who owned their account. My thesis: that is changing right now, because a new kind of actor is pushing into the net for whom borrowed identities do not work at all. AI agents that are supposed to book, cancel and pay in our name need provable, limited and revocable mandates - and those presuppose an identity that belongs to us. That is the subject of part 2 of this series on September 5.
Sources
- SocialHub (ActivityPub community): Nomadic identity for the fediverse? - discussion of nomadic identity, Hubzilla/Streams and FEP-ef61 "Portable Objects"
- Wikipedia: Fediverse and Solid (web decentralization project)) - overview of architecture and history
- Inrupt: company site and About Solid - pods, Data Wallet, commercialization
- Fast Company: How Tim Berners-Lee is building a better digital wallet - Data Wallet, pilots at the NHS and in Flanders, handover of Solid to the Open Data Institute
- Tech.eu: Inrupt's Data Wallet realises Sir Berners-Lee's data ownership dream - wallet details
- netzpolitik.org: FAQ on the EUDI wallet - mandatory offering by the end of 2026, voluntary use, open privacy questions (German)
- Dr. Datenschutz: The EU Digital Identity Wallet becomes mandatory in 2026 - eIDAS 2.0, German launch date in early 2027 (German)