Agents act without audit trails
OAuth 2.1 (the MCP de-facto since June 2025) is single-hop, no holder-side scope attenuation. Reconstructing "which human → which agent → what scope" is impossible after the fact.
The cryptographic chain-of-custody for autonomous action. Tetract binds AI agents, humans, organizations, and products into one verifiable, regulator-shaped trust graph — built for the agentic economy that ships in August 2026.
A Claude Code agent commits to your main branch. An Atlas agent buys flights on your card. A Comet agent exfiltrates a 1Password vault — actually documented, November 2025. There is no cryptographic chain of custody answering who authorized what, on whose behalf, scope, validity, revocability. OAuth 2.1 is single-hop. The 2026 IETF AIP draft found no shipped standard satisfies more than 4 of 7 properties for genuine agentic delegation.
OAuth 2.1 (the MCP de-facto since June 2025) is single-hop, no holder-side scope attenuation. Reconstructing "which human → which agent → what scope" is impossible after the fact.
Stripe SPT, Visa TAP, Google AP2 (all launched Sep–Oct 2025) cryptographically authorize a payment. None carry forward to dispute, audit, or AI Act Article 14 oversight. IBM 2025 made the critique explicit.
Worldcoin, Humanity, Alien, Billions, Spruce, ENS — node primitives. Avery Dennison, Arianee, Circulor — product nodes. Nobody ships the verifiable edge. ToIP/DIF Trust Graph WG started 30 Sep 2025 because the gap is now standards-track admitted.
30B+ items on atma.io. Volvo cobalt traceability. Moncler tokens. None of them connect issuing org's verifiable identity → employee credential → AI agent that updates the DPP. ESPR Article 13 mandates a Registry by 19 Jul 2026 — without specifying the agent edge.
EU AI Act Art. 50 (2 Aug 2026). ESPR Art. 13 DPP Registry (19 Jul 2026). Battery Passport per-unit (18 Feb 2027). EUDI Wallet, EUDR, Sunrise 2027 stacking on top. One stack satisfies all four regimes — or eleven incompatible vendors integrate for four years.
a16z named "Know Your Agent" the 2026 identity primitive. Catena Labs raised $18M for it — in payments only. Astrix went to Cisco for ~$300M — enterprise NHI only. No vendor has the cap-table to ship the full four-node graph. We do.
Worldcoin proved humanity.— Tetract is building the verifiable edge.
ENS proved naming.
Stripe proved payment.
Avery Dennison proved the product passport.
Nobody has proven the relationship.
Each entity gets a W3C Decentralized Identifier. Each "passport" is a profile of Verifiable Credentials 2.0. Each edge — employed-by, produced-by, delegated-by, owned-by, authorized-for, attested-by — is itself a signed, scope-attenuated, revocable credential. Selectively disclosable via SD-JWT, BBS+, or ZK-SNARK as policy requires.
Proof-of-personhood (World ID / Humanity / Billions / EUDI 2.0 PID). KYC/AML. Roles. Selective disclosure via ZKP — prove "agent is authorized" without revealing the principal.
eIDAS 2.0 LPID. GS1 GLN. LEI. Industry consortia (CIRPASS, GS1 BeLu Solution Partner). ESPR / ESG compliance status. The legal-person anchor that lets every downstream credential carry liability.
GS1 Digital Link → DID → ESPR-compliant VC bundle. Manufacturing, sustainability, supply chain, ownership. Built on Fluxy.One backbone — 27 languages, AI parsing, prEN 18220 conformance.
Architecture, version, training-data lineage. Risk classification per EU AI Act. Operator delegation chains. Compatible with MCP, A2A, AP2, ERC-8004, AGNTCY, NANDA AgentFacts. Eleven verifiers; one SDK.
EU's regulatory window opens in 12 months and closes hard. Every agent platform shipped in 2025–26. Every standard hit Recommendation. Every vendor staked a single node. Nobody shipped the graph.
Eleven parallel agent-identity protocols are alive in 2026 (MCP, A2A, AP2, x402, ACP, ANP, AGNTCY, NANDA, Web Bot Auth, ENSIP-25, ERC-8004). Tetract emits the right attestation per surface. Single integration; eleven verifier compatibilities.
Ed25519 + secp256k1. Optional post-quantum migration. Hardware-backed keys (iOS Secure Enclave, Android StrongBox, YubiKey enterprise).
did:human (World ID / Humanity / Billions / EUDI PID) · did:org (eIDAS LPID / GS1 GLN / LEI) · did:agent (A2A Agent Cards + ERC-8004) · did:product (GS1 Digital Link / Fluxy backbone).
VCDM 2.0 (Recommendation 15 May 2025). Open schemas: PersonhoodCredential, AgentCredential, OrgEmployeeCredential, ProductPassportCredential + 7 EdgeCredentials. Bitstring Status List for hourly revocation.
Synthesis of MIT/Oxford Authenticated Delegation, IETF HDP, AIP, and UCAN with typed scopes (currency caps, time windows, geo, allowlists). 340–380 bytes per delegation, sub-ms verify at depth 5.
Emits MCP OAuth 2.1 + RFC 8707 · A2A signed VPs · Web Bot Auth (RFC 9421) · Visa TAP · Stripe ACP · Google AP2 mandates · Coinbase x402 · AGNTCY OASF · NANDA AgentFacts · ENSIP-25 / ERC-8004.
GS1 Digital Link resolver, EU GDPR-compliant, AI document parsing, 27-language hosting, ESPR three-tier access, prEN 18220 + ISO/IEC 15459 + ISO/IEC 18004 conformance. Every DPP is a VC issued by an LPID-anchored org DID.
SD-JWT (default, EUDI-compatible) · BBS+ unlinkable selective disclosure · ZK-SNARK via Iden3/Circom (Privado/Billions stack) · TEE attestation (Alien CHVP, AWS Nitro, Intel TDX) for biometric proofs.
Every use case is a four-node act. Every act is provable in one credential chain. Every chain reduces to agent → human → org → product — a structure traditional IAM cannot represent.
Every Claude Code / Cursor / Devin commit signed, scoped, audited. Engineering forensic ledger.
Atlas / Comet / Goose buy with merchant-verifiable authority alongside Stripe SPT / Visa TAP / AP2.
Textile MCP agent updates DPPs hourly. ESPR Art. 7 + 13, CIRPASS-2, EUDR satisfied in one chain.
Clinical agent → physician's medical-license credential → hospital org DID. HIPAA/GDPR audits in seconds.
Latvia SIA agent ↔ Delaware C-Corp agent. Both KYB-satisfied. x402 stablecoin settlement.
Article 50(1) chatbot transparency + GDPR controller ID + sector authorization in one credential.
Vestiaire agent presents chained ownership credentials anchored to original Moncler DPP. Counterfeits cannot present the chain.
Byline carries Tetract publisher-authority credential + human editor countersignature. EU GPAI Code of Practice satisfied.
Every >2 kWh battery: lifecycle credential chain. GBA Battery Pass / Catena-X / DKE Spec 99100 by default.
Planner spawns 3 executors with attenuated scope. Traditional IAM cannot represent this. Tetract was built for it.
Avery Dennison has no agent stack. Worldcoin has no DPP. Catena Labs has no products. Stripe has no humans. Vertical integration is what no individual leader has the right to ship.
Slava brings 12 years of fintech-grade compliance and the Identity.Global / Nansen.ID research arc. Maksim brings the only EU-compliant DPP pipeline ready for ESPR delegated acts and the only GS1 Solution Partner relationship in our category. Together: the four-node graph from day zero.
12 years of fintech / regulated-industry investing. Founder of Life.SREDA, the first fintech-only VC. Author of the Money of the Future reports (2014–2018). Steward of the Identity.Global / Nansen.ID research arc and the Retro-Futuristic Optimism design movement.
Founder of Fluxy.One — GS1 Belgium-Luxembourg Solution Partner, CIRPASS member, the only EU-compliant DPP pipeline ready for ESPR delegated acts at SME pricing (€1 / passport, AI parsing, 27 languages).
Use of proceeds:
Lead investor · regulatory infrastructure thesis (a16z crypto, Bessemer infra, Index, YC W26/S26, Sequoia, Lightspeed).
Strategic angels · W3C VCWG / DIF / ENS / Worldcoin / Stripe / Visa AP / Cloudflare / Spruce / Arianee / Avery Dennison / Anthropic / OpenAI alumni.
Design partners · 3 agent-platform vendors · 3 ESPR-priority manufacturers · 3 enterprise compliance teams.