Identity / Lineage
Chain of
Trust
This illustrates an owned derivation path. Delegated agents carry signed ancestry to an approved root; a direct approved self root has no parent chain. Every required link and current root policy must pass verification.
scroll to forge the chain
00
hmr
Alice (Human Root)
did:oas:l1fe:hmr:z6MkA...
Illustrative owner root | Real custody and owner approval required
HKDF-SHA256
01
agent
Research Agent
did:oas:l1fe:agent:z6MkB...
HKDF-SHA256 derived | Depth 1 | Capabilities: read, analyze, report
HKDF-SHA256
02
agent
Data Collector
did:oas:l1fe:agent:z6MkC...
HKDF-SHA256 derived | Depth 2 | Capabilities: read, fetch (narrowed)
HKDF-SHA256
03
tool
Web Scraper
did:oas:l1fe:tool:z6MkD...
HKDF-SHA256 derived | Depth 3 | Capabilities: fetch (scoped to domains)
HKDF-SHA256
04
agent:instance
Worker #7a3f
did:oas:l1fe:agent:z6MkE...
Illustrative instance | Lifetime and revocation enforced by its host
HKDF-SHA256
05
model
Prediction Model v2
did:oas:l1fe:model:z6MkF...
HKDF-SHA256 derived | Depth 2 | Bound to Trading Agent lineage
END OF CHAIN
Derivation Properties
Deterministic
The same parent key + context always produces the same child key. No randomness in derivation.
One-Way
Knowing a child key reveals nothing about the parent key. The derivation function is computationally irreversible.
Verifiable
Anyone with the parent's public key can verify that a child key was correctly derived, without knowing either private key.
AgentLineageProof2025
{
"type": "AgentLineageProof2025",
"parentDid": "did:oas:l1fe:hmr:z6MkA...",
"childDid": "did:oas:l1fe:agent:z6MkB...",
"derivationPath": "/agent-research",
"algorithm": "HKDF-SHA256-Ed25519",
"publicKeyMultibase": "z6MkA...",
"signature": "iQF3Bw6r8mVbq1t...9Rax7Qw"
}