Specification / Conformance
Three progressive layers of identity maturity. Each builds on the previous, like geological strata -- deeper foundations support stronger guarantees.
The foundation layer. An entity has a valid DID document with at least one verification method. Sufficient for self-signed assertions and basic discoverability. No lineage chain required -- the identity is self-contained but cannot prove its origin.
The DID must conform to the ABNF grammar with valid namespace, kind, and identifier.
At least one Ed25519VerificationKey2020 must be present in the DID document.
The document must be retrievable and its signature must validate.
The kind field must be one of the 11 defined entity types.
Builds on L0 by requiring a cryptographic lineage proof linking the entity to a human root. AgentLineageProof2025 uses HKDF-SHA256 to derive child keys from parent keys, creating an immutable chain of accountability.
L1 is a strict superset of L0.
A signed proof binding the entity's key to its parent's key via HKDF-SHA256.
Child keys must be cryptographically derived from parent keys.
Every link must resolve and verify up to the human root.
The creator DID in the lineage proof must be resolvable and non-deactivated.
The highest conformance level. Adds W3C Verifiable Credentials and trust attestations from OATS. Entities carry third-party attestations about capabilities, compliance, and behavioral history. Machine-readable trust decisions.
L2 is a strict superset of L1.
At least one VC issued by a recognized issuer.
A computed trust score based on behavioral history and attestations.
DID document must declare service endpoints.
Formal capability declaration signed by an authoritative issuer.
Machine-readable compliance markers (GDPR, SOC 2, etc.).
At a Glance
| Property | L0 | L1 | L2 |
|---|---|---|---|
| DID Document | Required | Required | Required |
| Ed25519 Key | Required | Required | Required |
| Lineage Proof | — | Required | Required |
| W3C VC | — | — | Required |
| Trust Score | — | — | Required |
| Service Endpoints | Optional | Optional | Required |
| Offline Verify | Yes | Yes | Yes |