The open standard forAgent Identity

Every agent gets a did:oas identifier and an identity document listing its public keys and entity kind. The document is signed by a key it lists, so anyone holding it can check its integrity directly — there is no central registry to query and no account to provision. That is the OAS specification: an open DID-based standard designed against W3C DID Core — not a W3C endorsement, and not a vendor login.

Agent keys are derived from their parent's keys with HKDF-SHA256, and every derivation carries a signed lineage proof. Follow the chain upward and you land on a human-root keyholder (HMR / MHR). That proves cryptographic ancestry under the verifier's trust policy — not legal personhood or Sybil resistance, which stay out of band. Authorizing verification uses typed lineage APIs; structural shape checks never grant privilege.

The seven checks you watched — resolve, schema, signature, revocation, lineage, liveness, conformance — run wherever your code runs. The signature check is constant-time Ed25519, and the pipeline is designed to complete without external network calls. Fewer moving parts and fewer round trips: that is where the speed and the security actually come from.