Digital identity as a tech-stack addition · content/identity_stack.md

Qal ID — Digital Identity as a qalarc Tech-Stack Addition

Date: 2026-09-06 · You said: "I'm interested as well on a digital identity front. Could be a cool addition to the tech stack." Verdict up front: it is — and it's the cheapest, fastest, most strategically-loaded piece of the whole QALS system. This page is the product view; the full research is the Identity & AI page.

1. Why identity is the sleeper hit of the IOTA codebase

IOTA spent years building a trust framework for governments and supply chains (EBSI pilots, Tokenized KYC with walt.id/IDnow/Bloom, Digital Product Passports, GLEIF alignment). The 2026 stack ships it as open source:

• IOTA Identity (iotaledger/identity, Rust/WASM, v1.9.x 2026): W3C DIDs as on-chain Move objects, Verifiable Credentials (VC 2.0), SD-JWT selective disclosure, post-quantum/hybrid signature options, on-chain revocation (BitstringStatusList) — revoking a credential flips one indexed bit: ~2 seconds, no gas drama.
• IOTA Hierarchies: root authority → federation → accreditations → attestations — cryptographic delegation of permissions, not just identity, validatable off-chain in microseconds via WASM (no chain call) or on-chain when money moves.

That second one is the underrated gem: it's a machine-readable permissions system with cryptographic teeth — exactly what an AI-agent company needs and almost nobody else has shipped.

2. What Qal ID adds to the existing qalarc stack (concretely)

3. The stack layers (what runs where)

┌────────────────────────────────────────────────────────────┐
│ qalarc apps (web + mobile) — "Sign in with Qal ID" button  │  dApp-kit + existing OAuth layered on top
├────────────────────────────────────────────────────────────┤
│ Agent layer — hub, cron jobs, GPU rigs, AI workers         │  DID per agent + capability VCs + RFC 9421 signing
├────────────────────────────────────────────────────────────┤
│ Issuer layer — qalarc identity service                     │  Hierarchies root authority; accredits per-app issuers
│                                                            │  (tradez issuer, hub issuer, compute issuer)
├────────────────────────────────────────────────────────────┤
│ Verification layer — WASM libs, µs checks, off-chain       │  Verifier SDK in every app + on-chain checks at value
├────────────────────────────────────────────────────────────┤
│ Qalnet (chain) — DID documents, status lists, anchors      │  Inherited from iotaledger/identity (Apache-2.0)
└────────────────────────────────────────────────────────────┘

Humans stay on OAuth/login they already know — Qal ID layers underneath; nobody has to learn seed phrases. Agents, devices and inter-service calls are where the cryptography shines first.

4. Why this is strategically bigger than it looks

1. The agent economy is arriving without an identity layer. Web Bot Auth (IETF), x402 agent payments, C2PA 2.3 (OpenAI/Google on the steering committee), VC 2.0 with explicit AI/ML provisions — 2025-26 standards are converging on exactly this design. Qal ID makes qalarc standards-native before clients ask.
2. EU eIDAS 2.0 / EUDI wallets are mandated EU-wide by end-2026. Any European client work (endispute's dispute-resolution ambitions, tradez trade flows) will hit verifiable-credential requirements — Qal ID is the readiness story.
3. "Show your work" becomes a product feature. AI outputs with verifiable provenance (which agent, which model, which inputs, who vouched) are sellable trust — to lawyers (endispute), traders (tradez), and enterprises. It also future-proofs against AI-content regulation.
4. It composes with everything else in QALS: identity gates credit tiers, accredits compute providers, signs receipts, keys the Qalx safety systems, and would carry the Zip-style credit reputation objects later.
5. Cost: near zero to start. The libraries are free and Apache-2.0; the first milestone (hub agents get DIDs + one revocation drill) is days, not months.

5. Build plan (Phase A → C)

• Phase A (days–weeks): Stand up the issuer service on the devnet; give the 3–5 hub agents DIDs + capability VCs; wire RFC 9421 signing into one internal API pair; run the revocation drill (kill an agent, time it, write the post-mortem). Deliverable: agents that cannot be impersonated and can be fired in seconds.
• Phase B (+1–2 months): User DIDs layered under existing logins; KYC credential pilot (SD-JWT selective disclosure) for one app; provenance stamps on AI deliverables; device accreditations for the compute fleet.
• Phase C (+3–6 months): Tokenized-KYC tiers on Qalx; verifiable provenance as a client-facing product ("Qal Provenance"); EUDI-interop testing for EU work; agent-to-agent payment credentials (x402-compatible pattern).

6. Risks (honest, and small)

Key management is now a real operational duty (Stronghold + backups + rotation drills — the repo ships the tools); DID method lock-in is mitigated by W3C standards (portable did:key/did:jwk fallbacks exist in the lib); over-credentialing bureaucracy is avoided by keeping accreditation issuance programmatic. And identity alone, without any token or chain, is already worth deploying — which makes it the lowest-risk entry point of the entire program.

Bottom line: the chain gives you money and data rails; Qal ID gives you accountability — for agents, devices, AI outputs and users, in one cryptographic system the IOTA Foundation already built and battle-tested with governments. If you only green-light one thing from this research, green-light this.