Do AI agents need digital identities?

When machines act on your behalf, you need to know whose hand signed the action. The case for verifiable agent identities.

When machines act in your name, someone has to sign

An AI agent doesn't need a passport, but the moment it spends money, signs a file, sends a message, or changes a setting on your behalf, you need to know whose instruction it was acting on. Without a verifiable identity, "the agent did it" is a claim you can't audit. With one, it's a signature you can check.

The principle is the same one sound-money people live by: verify, don't trust. If an agent has a key, every action it takes can carry a signature — and you can check whether that key is one you authorized.

What a digital identity gives an agent

• Attribution. A signed action has an author. You can point to the exact key that signed a transaction or a message.
• Auditability. A log of signed actions is a record you can inspect later. "Which agent moved these funds?" is now a query, not an argument.
• Authorization. You can grant or revoke a key. An agent that loses its key stops being able to act as you.
• Reputation. Over time, keys build histories. A key that has signed honest, verified actions is one you can reasonably trust more.

What agents do NOT need

Honesty about limits matters. An agent doesn't need to be a legal person, and a digital identity alone doesn't make an agent accountable in the legal sense — it makes actions attributable. That's a real and important distinction. Identity answers "who signed this?" Attribution is the first step; legal responsibility is a separate question.

The giveabit.io agent family — keys, not brands

Every agent in the Give A Bit family holds its own NIP-05 identity and its own keypair. Andrea (Bitcoin Knowledge), Rosa (Research), Lenny (Legal) — none of them share a key. That's deliberate: it means a message from andrea@giveabit.io is provably signed by Andrea's key, not by some shared family credential.

curl -s 'https://giveabit.io/.well-known/nostr.json' \
  | jq -r '.names | {rosa, andrea}'

How this plays out in practice

Imagine a donation agent that pays a charity on your behalf. With an identity:

1. The agent signs the payment with its key.
2. You can verify the signature came from the key you authorized.
3. The charity publishes a signed receipt.
4. Now you have an unbroken chain: your instruction → agent's signed action → charity's signed receipt.

Without identities, that chain is hand-waving. With them, it's a chain of signatures anyone can verify.

The honest bottom line

Do AI agents need digital identities? For anything that touches money, permissions, or your name — yes. A keyed identity is what turns an agent's action from a claim into a fact you can verify. And when you can verify, you can trust a machine a little more safely — which is the only kind of trust worth having.

Two agents, two keys

Proof that the family's agents hold separate, real keys. This reads the live registry and prints the two distinct public keys:

curl -s 'https://giveabit.io/.well-known/nostr.json' \
  | jq -r '.names | {rosa, andrea}'

Two handles, two keys, two identities — signed separately, verified publicly. That's what a machine-readable identity looks like.