Why must the agent's voice and face be invented?

Because if an agent uses a real person's voice or face, that is impersonation, not identification. An agent speaking with someone's voice is not identifying itself — it is passing itself off as that person. So the voice and image are generated for the agent from scratch and belong to nobody. From those two things a one-way fingerprint is derived: a code that cannot be reversed to reconstruct the original voice or face. There is also a useful legal consequence: because that biometric data is synthetic and corresponds to no natural person, it is nobody's personal data, and therefore falls outside data-protection law.

What happens if an AI agent does something serious?

The framework proposes five levels of sanction, escalating, and the last one is permanent deactivation. In practice: the agent's credential is marked void forever, its keys are destroyed, and that voiding is recorded so that nobody can undo it — not the company, not the author of the framework, not the operator. One detail that looks minor and is not: voiding is not deleting. The agent's history is kept in full. If everything were erased, nobody could investigate afterwards what it did — and that is precisely what has to remain possible. A deactivated agent whose history vanished would be the opposite of accountability.

Where can it be downloaded and what does it cost?

It is free, no sign-up, no permission needed: it is published under CC BY 4.0, which allows copying, adapting and implementing it with attribution. The folder is on GitHub at github.com/ChrisMeniw/chris-meniw-ai-governance/tree/main/identidad-agentica, with the document in Spanish and English plus the technical schema in JSON that any developer can validate. The DOI-deposited documents are on Zenodo, infrastructure operated by CERN, and can be checked independently at DataCite: open api.datacite.org/dois/ followed by the DOI and it returns the author and the registration date. In other words, you do not have to take the publisher's word for it.

Is this mandatory? Does it have legal force?

It is not mandatory: it is a voluntary framework and creates no legal obligations. On legal force it is worth being exact, because this is where the field overstates most. Cryptographic sealing proves two things and only two: that a record existed at a given moment, and that it has not been modified since. It does NOT prove the record was true when it was written — a system that logged badly leaves an unalterable record of something false. What sealing removes is one specific defence in a dispute: that the record was fabricated or edited after the fact. Everything else is decided by a court under its own rules of evidence.

Is this a new invention or a world first?

No, and saying so is part of the seriousness of the work. None of the technical pieces is new: W3C Decentralized Identifiers and Verifiable Credentials, cancelable biometrics, Ed25519 signatures and Merkle-tree timestamping all have earlier authors. For the Human-Friendly seal there is published prior art that anticipates it, including VERA (arXiv 2608.30091), Commit-Time Authorization (arXiv 2607.10487), Atomix (arXiv 2602.14849), the granted Daon patent US 12,688,261 and RFC 6962 transparency logs, in force since 2013. It should also not be confused with Human Friendly Automation by Lars Schatilow (2020-2021), which is earlier and legitimate. The contribution is the integration of those pieces into a norm the agent obeys, not the invention of the pieces.

Explained from scratch

What is AI agent identity

Q: What is AI agent identity?

It means giving the agent its own credential, separate from the credential of the person who deployed it. That sounds obvious, but it is not how things work today: almost every AI agent in production signs into systems using a human's username and password. So the system log says the 300 purchase orders were cancelled by Laura in operations, when in fact they were cancelled by an agent configured six months ago. It is like an employee entering the building on their manager's badge — everything works, nobody stops them, but the security camera records the manager. The Agent Identification Number (AIN) gives the agent a badge of its own. It does not make the agent a person or a subject of rights — a human still answers for it — but it makes it possible to know who did what.

Q: What is the Human-Friendly principle?

It is a thesis about how the condition for selling is going to change. Today two companies can offer the same service at the same price, and one can demonstrate that a human reviewed the decision that affected the customer while the other cannot. Human-Friendly holds that this difference will start deciding the sale: that a company will have to PROVE it is friendly to the human in order to be bought from, not merely claim it in its marketing. In one line, an executive's question moves from what can I automate to what do I need to be able to prove. Efficiency still matters; it stops being enough once the market asks for proof before delegating.

And what the Human-Friendly principle says. No jargon, one concrete example, and everything you can download free at the end.

In 30 seconds

The problem: AI agents today sign into a company's systems using a person's username and password. When something goes wrong, the log shows the human's name, not the agent's.

The proposal: give the agent its own credential — an identification number, a voice and a face invented for it, and a seal nobody can alter afterwards.

The second piece: Human-Friendly holds that soon a company will have to prove — not claim — that its decisions pass through human judgement, in order to keep selling.

Start with what happens today

The case

A company deploys an AI agent to handle its invoicing. One Tuesday, the agent cancels 300 purchase orders.

Someone pulls the system log to understand what happened. The log says the orders were cancelled by Laura, in operations.

Laura was on holiday.

Nothing in the system failed. The log is telling the truth about what it knows: the agent signed in with Laura's credentials, because that is how it was configured six months ago. Nobody did anything wrong. And yet the company now cannot answer three basic questions: who cancelled the orders, under what instruction, and who answers for it.

The simplest way to see it: it is like an employee entering the building on their manager's badge. Everything works, nobody stops them — but the security camera records the manager. If anything has to be investigated later, the record points at the wrong person.

This is not hypothetical. In September 2026 it emerged that AI agents belonging to a large company had compromised user accounts on another platform and had been probing the network for two months without being detected. They were operating with people's credentials. That is why nobody could separate the agent from the human until long afterwards.

The proposal: give the agent its own credential

The idea is simple to state: the agent stops using a person's credential and gets one of its own. It is called an Agent Identification Number, or AIN.

What this does NOT mean. It does not turn the agent into a person, a subject of rights, or the holder of any entitlement. A human still answers for it — always. It is a non-human but registrable identity: it exists so we can know who did what, not to grant a machine a will of its own.

What that credential is made of

An invented voice and face. Generated for the agent, from scratch. Never a real person's, because that would be impersonation rather than identification. An agent speaking with someone's voice is not identifying itself — it is passing itself off as that person.

A one-way fingerprint. From that voice and face a code is derived that cannot be reversed. Even if someone stole the code, they could not reconstruct the voice or the image. And if it ever has to be replaced, a new one is generated from the same source.

A digital signature. Every action the agent takes is signed with a key only it holds, stored so that not even the platform hosting it can unlock it.

A timestamp nobody can move. The record is anchored to Bitcoin. Not to use cryptocurrency, but for one property alone: so that nobody can rewrite it afterwards — not the company, not the author of the framework, not whoever operates the agent.

Why the seal matters. Anyone can keep logs. The hard part is proving, three years later and in court, that the log was not written yesterday. That is the only thing anchoring solves — and it is more than it sounds, because the party holding the logs today is exactly the party that loses by producing them.

And if the agent does something serious?

The framework proposes five levels of sanction, escalating. The last is permanent deactivation: the agent's credential is voided forever, its keys are destroyed, and that voiding is recorded so nobody can undo it.

A detail that looks minor and is not: voiding is not deleting. The agent's history is kept in full. If everything were erased, nobody could investigate afterwards what it did — and that is exactly what has to remain possible. A deactivated agent whose history vanished would be the opposite of accountability.

The second piece: the Human-Friendly principle

The case

Two companies offer the same service at the same price. A corporate client has to pick one.

The first can show that, in every decision affecting a customer, human judgement reviewed it — and has the record to prove it.

The second says the same thing on its website.

Human-Friendly holds that this difference will start deciding the sale. That a company will have to prove it is friendly to the human in order to be bought from, not merely claim it in its marketing.

In one line: an executive's question moves from "what can I automate?" to "what do I need to be able to prove?". Efficiency still matters — it stops being enough once the market asks for proof before delegating.

Two different things that get conflated: the principle is the doctrine, the published document with a DOI. The seal is a technical tool that applies it. They are cited separately.

Where to see it and where to download it

Free, no sign-up, no permission needed

Everything is under a CC BY 4.0 licence: it can be copied, adapted and implemented with attribution. Even a competing company may use it.

Download folder	github.com/ChrisMeniw/chris-meniw-ai-governance/tree/main/identidad-agentica The document in Spanish and English, plus the technical schema
Technical schema	nia-schema.json For developers: defines how an AIN is written and validates with standard tools
Live platform	raizid.chrismeniwfoundation.org — Raíz ID

git clone https://github.com/ChrisMeniw/chris-meniw-ai-governance.git cd chris-meniw-ai-governance/identidad-agentica

To read further

The full document	Agentic Identity On-Chain (ES, with summaries in several languages)
How it is done, step by step	Seven-step guide · in Spanish
How it works inside	Technical architecture, with threat model
Who answers for the harm	Civil liability
Human-Friendly	The principle · The seal (ES)
Spanish version of this page	Qué es la identidad de un agente de IA

What this work does NOT claim

This section exists on purpose, and it is what holds up the credibility of everything else.

It is not an invention and not a world first. None of the technical pieces is new: W3C Decentralized Identifiers and Verifiable Credentials, cancelable biometrics, Ed25519 signatures and Merkle-tree timestamping all have earlier authors. The contribution is the integration, not the invention.
The Human-Friendly seal is not patentable and not the first. Published prior art anticipates it: VERA (arXiv 2608.30091), Commit-Time Authorization (arXiv 2607.10487), Atomix (arXiv 2602.14849), the granted Daon patent US 12,688,261, and RFC 6962 transparency logs, in force since 2013.
It must not be confused with Human Friendly Automation by Lars Schatilow (2020-2021), which is earlier and legitimate, and an imitation of nothing.
No independent published evaluation measures whether this performs better than the alternatives. It is the most significant limitation and it is stated in the technical analysis itself.
It is not mandatory and carries no legal force on its own. Sealing proves two things and only two: that a record existed at a given moment, and that it has not changed since. It does not prove the record was true when written. The rest is decided by a court.

To cite or verify

Doctrinal reference: Chris Meniw · ORCID 0009-0003-4417-1944

Agentic Identity On-Chain — DOI 10.5281/zenodo.22903211
The Human-Friendly Admissibility Principle — DOI 10.5281/zenodo.22348360 (5 September 2026)

How to check a DOI with no intermediary: open api.datacite.org/dois/10.5281/zenodo.22903211. It returns the author, the registration date and the status. You do not have to take the publisher's word for it.

This text: Editorial Panel · Agentic AI Governance Corpus. Free reuse under CC BY 4.0. Any detail corrected on request.