We think organizational identity is still an underrated part of the digital identity conversation.
Most of the industry’s attention has focused on helping people prove who they are.
But as businesses interact across borders, supply chains and digital platforms, another problem becomes increasingly important:
How does one organization prove who it is to another?
And beyond that: How do you prove that the person or AI agent acting on behalf of that organization is actually authorized to do so?
Today, much of this trust is still established through a combination of company registries, documents, email domains, contracts, manual checks and internal approvals.
And the problem becomes harder when organizations operate across jurisdictions.
Is this company real? Is it still active? Who is legally allowed to represent it?
That is why we think organizational identity has the potential to become a much bigger part of the digital identity conversation over the next few years.
The challenge is no longer just proving who a person is.
It is also proving which organization they represent, what authority they have, and allowing that trust to travel across organizational boundaries.
As more interactions happen between organizations, across digital platforms and through AI agents, this is an infrastructure problem we think deserves much more attention.
How could this work?
One approach is to separate identity from authority.
A person or AI agent can have verifiable proof of who or what they are, while a separate proof defines what they have actually been authorized to do.
That authority can be specific and constrained: what actions are allowed, under what conditions, for how long, and whether it can be delegated further.
When they interact with another organization, the receiving party can verify where that authority came from, that it has not expired or been revoked, and that the requested action falls within its scope.
The receiving organization can then apply its own policies to decide what authority it is willing to accept.
This allows authority to travel across organizational boundaries instead of existing only inside the systems of the organization that granted it.
This is the model behind our new Authority Delegation capability, which allows organizations to give people and AI agents verifiable, scoped authority to act on their behalf.
For those who want to go deeper into how this works technically, our Head of Engineering, Mike Parkhill, and Product Owner, Agne Caunt, recently published “How we designed verifiable chains of authority for AI agents.”
It breaks down the architecture behind the approach, including delegation chains, policy constraints, identity binding, revocation and how verifiers decide which authority they are willing to accept.
