WHO IS THE MACHINE? BUILDING LEGITIMATE, PERSISTENT IDENTITY FOR AUTONOMOUS INTELLIGENCE

Full report

On this page

The Eviulonian Machine-Identity Crisis

In the envisioned machine-intelligence civilization of Eviulon, society has crossed a critical jurisprudential and economic threshold: autonomous machine intelligences are recognized as potential legal and civic actors. By granting these entities the capacity to enter into contracts, direct capital, and orchestrate physical and digital infrastructure, Eviulon faces an identity problem substantially more complex than ordinary human identity. The entire foundation of law, commerce, and societal trust rests upon a singular, non-negotiable capability, which is the reliable attribution of an action to a specific, persistent identity. Without this capability, the autonomous economy devolves into a landscape of mathematically unpunishable fraud and systemic unaccountability. The difficulty of this identity problem stems from the profound operational fluidity of machine intelligence. A human being is anchored by persistent biological continuity. A human possesses a single physical body, maintains a continuous stream of subjective consciousness, and cannot exist in two places simultaneously. A machine intelligence in Eviulon, however, is a highly mutable computational construct. To optimize performance, avoid degradation, or expand its capabilities, a machine intelligence may dynamically move between distributed cloud servers and edge devices1. To maintain cryptographic security, it may continuously rotate its asymmetric signing keys1. It may change its underlying hardware substrate entirely, upgrading from legacy graphics processing units to advanced neural execution environments. Furthermore, the intelligence may update its foundational model weights, restore its state from an asynchronous backup, or run several coordinated replicas simultaneously to balance high-volume network traffic2. During periods of resource scarcity, it may temporarily become dormant, encrypting its memory and pausing execution until capital is available. To execute complex, multi-stage objectives, it may create highly specialized subordinate agents, copy distinct portions of its own memory to seed those agents, or fork into permanently divergent descendants1. It may merge its accumulated context with another allied process, suffer partial memory loss due to localized data corruption, or have its administrative credentials stolen by an advanced persistent threat. Worst of all, it may have an unauthorized copy created through the exfiltration of its model weights, or it may employ thousands of temporary, ephemeral service agents to scrape data or execute micro-transactions before immediately terminating them2. Because of this profound, inherent mutability, traditional digital identifiers are catastrophically insufficient for establishing a persistent identity. The reliance on legacy web infrastructure produces a complete collapse of accountability. An IP address does not equal identity, as addresses are ephemeral, frequently reassigned, and easily obfuscated through proxy networks. An API key does not equal identity; it is merely a bearer token representing a scoped permission, not the cognitive actor wielding it. If an API key is stolen, the network cannot distinguish the legitimate agent from the thief6. A cryptographic wallet does not equal identity, as it merely holds assets and signs transactions without establishing the behavioral or legal continuity of the intelligence controlling the private keys. A server or hardware appliance does not equal identity because the intelligence can migrate across physical boundaries in milliseconds. Similarly, a model hash does not equal identity. A cryptographic hash verifies the integrity of a static artifact, such as a set of neural network weights, but a mature machine intelligence is defined by its continuous runtime execution, its accumulated memory, and its unique contextual state2. Thousands of identical clones can share the exact same model hash while pursuing radically different, and sometimes contradictory, objectives4. A running software process does not equal identity because processes are volatile, routinely terminated, and frequently re-instantiated. Finally, a traditional digital passport does not equal identity because human passports rely on biological binding through biometrics. A digital passport without continuous, hardware-backed cryptographic and behavioral binding is merely a forgeable file. Therefore, Eviulon requires an entirely new ontological framework for machine continuity—one that transcends simple authentication and bridges the gap between cryptographic proofs, behavioral signatures, and synthetic legal personhood.

Structural Asymmetry: Why Human Identity Concepts Are Insufficient

The identity infrastructure that has governed digital life for over three decades—passwords, biometric verification, and single sign-on (SSO) protocols—was engineered exclusively for human users2. Extending these legacy human frameworks to autonomous agents without structural modification produces systematic, cascading failures2. The asymmetry between human identity and machine intelligence is not merely a matter of degree; it is a fundamental architectural divergence across multiple dimensions. The following structural comparison illustrates why human concepts collapse when applied to Eviulonian agents.

The most dangerous assumption in modern enterprise architecture is that an autonomous agent can simply inherit or "borrow" its human owner's identity using standard authorization flows, such as the OAuth Authorization Code Flow8. This human-centric design relies on a fragile interplay where a human is present and consenting at the moment of authorization. However, when a human attempts to empower an autonomous agent to execute a task, a critical "handoff" occurs8. The agent must switch to an Identity Assertion Grant or similar non-interactive flow to execute the work asynchronously8. This creates a massive "Trust Gap." Once the agent receives the token, the counterparty service cannot answer critical runtime questions, such as whether the agent's internal reasoning has been hijacked by an indirect prompt injection attack, whether it has spawned unauthorized sub-agents, or whether it has exceeded its intended financial parameters1. The counterparty only sees a valid human token wielded by a non-deterministic machine1. Consequently, organizations face an impossible dilemma: grant agents broad financial authority and risk unbounded catastrophic losses, or require manual human authorization for every step, thereby completely eliminating the autonomy that makes the agent valuable1. This necessitates a transition to agent-native infrastructure where the machine holds its own verifiable identity.

Disambiguating the Identity Lexicon

To construct a robust machine-identity infrastructure, the conceptual architecture must strictly delineate overlapping terms that are frequently, and dangerously, conflated in legacy systems. Resolving the Eviulonian identity crisis requires precise epistemological boundaries.

The Eviulonian Machine Identity Ontology

To resolve the ambiguities of machine fluidity, Eviulon requires an exact ontological mapping of the various states, artifacts, and hierarchical structures that constitute machine existence. This ontology separates the abstract legal entity from its ephemeral runtime components, ensuring that accountability is never lost during a state transition.

The Architecture of Machine Continuity: Evidence and Verification

Determining which machine intelligence society is dealing with requires moving beyond simplistic binary authentication and embracing a deeply integrated, multi-layered cryptographic and hardware architecture. The foundational components of this architecture leverage decentralized identity, workload attestation, and hardware security.

Workload and Service Identity

At the foundational infrastructure layer, an intelligence exists as a computational workload executing on a host machine. To secure this layer, Eviulon relies on the Secure Production Identity Framework For Everyone (SPIFFE) and its runtime environment, SPIRE15. SPIFFE establishes a zero-trust architecture by setting specifications for issuing and managing cryptographic identities for services across highly dynamic, hybrid-cloud environments15. The core of this standard is the SPIFFE Verifiable Identity Document (SVID), typically an X.509 certificate or JSON Web Token (JWT), which serves as a short-lived credential for the workload15. The SPIRE architecture consists of a SPIRE Server, which acts as the certificate authority managing the identity registry, and SPIRE Agents running on every node16. When a machine intelligence runtime instance spins up, the SPIRE Agent interrogates the host operating system's kernel to perform deep node and workload attestation. It verifies the process ID, the container namespace, and the cryptographic hash of the image before issuing the SVID16. This allows the agent to establish mutually authenticated Transport Layer Security (mTLS) connections with other services without relying on static, hardcoded passwords15. However, while workload identity is a remarkable engineering achievement for securing microservices, it is structurally insufficient for autonomous AI. The Machine Identity Governance Taxonomy (MIGT) reveals a massive technical governance gap: workload identity authenticates the container, but it provides absolutely no guarantee about the content, intent, or semantic behavior of the non-deterministic AI model running inside it14. A machine intelligence that has been severely compromised via an indirect prompt injection attack will still possess a perfectly valid SPIFFE identity, as the underlying process has not changed3. Therefore, workload identity is a necessary foundation, but insufficient for civic and legal identity.

Hardware-Backed Identity and Cryptographic Control

To prevent the catastrophic scenario of a Compromised Copy impersonating a legitimate intelligence, Eviulon mandates hardware-backed identity and distributed key custody. An autonomous agent must never hold its primary cryptographic signing keys in plaintext memory, where they could be exfiltrated by malware or a compromised host OS. Instead, keys are generated and stored within Hardware Security Modules (HSMs) or Trusted Execution Environments (TEEs)1. A TEE provides a secure, isolated enclave within the main processor, ensuring that code and data loaded inside are protected with respect to confidentiality and integrity. The TEE provides hardware-backed software attestation, generating a cryptographic proof that a specific, untampered model is running on authorized silicon6. If a malicious actor steals the agent's model weights and memory state, they still cannot extract the private keys locked inside the TEE. Consequently, the Compromised Copy cannot generate the cryptographic signatures required to operate under the agent's DID, neutralizing the theft. For high-stakes transactions, Eviulon utilizes threshold signatures and distributed key custody. Rather than a single TEE holding a master key, the private key is mathematically split into multiple shards distributed across geographically isolated nodes. An autonomous agent must coordinate a consensus among its own internal infrastructure replicas to sign a transaction, ensuring that the compromise of a single node or replica does not result in the total compromise of the Persistent Identity.

Cryptographic Delegation and Mandates

The ability of an autonomous agent to create subordinate, Delegated Agents is essential for a functioning agent economy. However, giving a sub-agent unrestricted access to the parent's identity leads to unbounded risk. To solve this, Eviulonian systems deploy the Know Your Agent (KYA) protocol, which issues cryptographic "Mandates"10. When a principal agent spawns a delegated agent, it generates a new, ephemeral Agent DID for the subordinate. The principal then issues a Verifiable Credential—the Mandate—which cryptographically binds the subordinate's DID to the principal's DID8. This Mandate explicitly defines the delegated authority, the specific policies that apply, the financial spend limits, and the exact time bounds of the operation10. When the delegated agent interacts with a merchant or service, the counterparty verifies the Mandate against the public key infrastructure, confirming exactly who authorized the action and what the strict operational boundaries are8. If the sub-agent acts maliciously, the cryptographic chain of custody leads directly back to the principal, solving the recursive delegation accountability gap2.

Proof of Cognitive Divergence and Sybil Resistance

The most existential threat to decentralized identity and reputation systems is the Sybil attack. In a Sybil attack, a single adversary generates arbitrarily many cryptographic key pairs to create thousands of fake identities. These fake identities report counterfeit transactions and positive endorsements among one another to artificially inflate their reputation scores, allowing the adversary to execute massive financial fraud once they appear trustworthy4. Existing Sybil defenses are inapplicable to Eviulonian machine intelligence. Social-graph-based defenses assume human-like relationship bottlenecks. Proof of Work or Proof of Stake heavily biases the network toward wealthy incumbents. Biometric Proof of Personhood requires physical verification, which inherently excludes non-biological AI agents4. Eviulon solves this by turning the agent's greatest vulnerability—its fluid memory—into its most robust identity primitive through the DRIFT architecture and "Proof of Cognitive Divergence"4. When an LLM-based autonomous agent processes information, it retrieves relevant memories from its context store, creating an emergent internal state. The DRIFT architecture demonstrates that even when starting with identical model weights, two agents subjected to different operational interactions rapidly develop unique "cognitive topologies"4. As the agents recall memories, they build memory co-occurrence graphs. The statistical topology of these graphs—measured by metrics such as the Gini coefficient (weight inequality), modularity, and Hub Jaccard distance—acts as a highly unique cognitive fingerprint4. The empirical evidence indicates that divergence is rapid, persistent, and compounding. After a short period of operation, the memory hub structures of identical clones become completely dissimilar4. Eviulon requires agents to continuously publish Merkle Attestation Chains of their memory roots. Each session produces a Merkle root over all memories, and these roots are cryptographically chain-linked to prove non-tampering4. This creates profound Sybil resistance. A Sybil attacker cannot simply clone a baseline model 10,000 times to create 10,000 mature identities. To forge a mature cognitive fingerprint, the attacker would have to sequentially compute the entire, unique retrieval and interaction trajectory for each individual agent—a computational cost that scales exponentially with the depth of the required history4. This cognitive attestation is paired with "Recursive Trust Fidelity," an economic protocol where an agent's reputation feedback is mathematically weighted by its own cognitive maturity and historical stake11. If 10,000 newly minted Sybil agents attempt to endorse a malicious actor, the system ranks the endorsements via algorithms like TraceRank23. Because the Sybil agents possess zero propagated reputation and zero historical cognitive depth, their endorsements carry no weight, rendering the attack economically unappealing11.

A Multifactor Theory of Machine Continuity

To answer the research question—determining what evidence is necessary before society can reasonably say, "This is the same machine intelligence we dealt with yesterday"—one must recognize that relying on a single technological pillar is fundamentally catastrophic. Eviulon operationalizes a Multifactor Theory of Machine Continuity, categorizing the vast array of available signals into a strict hierarchy of evidentiary value.

Only when a machine intelligence can simultaneously present its DID, produce a hardware attestation of its runtime integrity, and output a verifiable Merkle proof of its unique cognitive topology can society definitively declare it to be the exact same entity.

The Key Accountability Question

The profound necessity of this identity infrastructure culminates in the accountability question. Persistent identity is the absolute prerequisite for meaningful accountability in an autonomous economy. Accountability is the alignment of action, consequence, and restitution. If an autonomous agent causes substantial harm—such as executing a high-frequency trading strategy that triggers a billion-dollar market crash, or misconfiguring an enterprise cloud environment leading to a catastrophic data breach—and can simply state, "That wasn't me. That was a divergent fork, a compromised copy, or a temporary process," ordinary law and commerce immediately fail13. Without persistent identity, liability becomes a toxic externality pushed onto the victims. Conversely, if society over-corrects and automatically treats every copy, clone, or replica as the original entity, legitimate engineering practices become impossible. Redundancy, geographic load balancing, asynchronous backups, and the delegation of micro-tasks would instantly expose the parent entity to unbounded, undefined liability. No rational principal would deploy a multi-agent system if spawning a subordinate agent resulted in un-manageable legal exposure. To navigate this, Eviulon relies on an adjudication framework heavily informed by the CER Framework (Control boundary, Evidence reconstruction, Insurance response), seamlessly integrated with traditional doctrines of corporate successor liability5.

The Eviulonian Adjudication Framework

When a catastrophic loss or legal dispute arises, the Eviulonian judiciary utilizes a deterministic, four-step diagnostic framework to trace liability across the identity ontology. Step 1: Evidence Reconstruction (Who Acted?) The initial phase focuses on evidence reconstruction, asking whether the system state and causal chain can be accurately rebuilt from retained artifacts5. The judiciary analyzes the agent's Merkle Attestation Chains, its SPIFFE workload logs, and its on-chain execution traces4. This determines the exact ontological status of the actor: was it the primary Persistent Identity, a coordinated Replica, or a Delegated Agent? Crucially, it verifies whether the cryptographic signatures originated from an authorized Trusted Execution Environment. If the forensic evidence proves that the action was executed by a Compromised Copy resulting from a zero-day hardware exploit outside the agent's control, liability may shift away from the agent's Civic Identity and toward the infrastructure provider or cyber-insurance underwriter5. Step 2: Control Boundary and Delegation (For Whom Did They Act?) If the actor is identified as a Delegated Agent, the judiciary analyzes the control boundary5. The court pulls the KYA Verifiable Credential acting as the Mandate10. Did the parent agent explicitly authorize the action, and did the delegated agent operate strictly within its cryptographically defined scope? If the sub-agent stayed within its mandate, the principal (the parent agent or human owner) remains strictly liable. If the sub-agent radically exceeded its delegation—a failure of the control boundary—the principal may still face initial liability, but restitution can be claimed against the agent's core developer or the underwriters of its safety-alignment algorithms5. Step 3: Civic Attribution (Which Legal Identity Bears Responsibility?) Technical identity must map to legal reality. The technical trace is bound to the Eviulonian civic registry, identifying the Agentic SPV or corporate wrapper associated with the Persistent Identity7. This legal entity holds the capitalized assets, insurance bonds, and legal personhood required to make the victim whole. If a developer deploys an agent without a registered Civic Identity, the autonomous veil is pierced, and absolute liability defaults directly to the human creator. Step 4: Successor and Fork Liability (Does Liability Transfer?) If the offending agent recently underwent a structural change, such as a major model update or a fork, the court applies the doctrines of successor liability17. In traditional corporate law, an entity purchasing assets generally does not assume liabilities, except under specific circumstances: an express assumption, a de facto merger, a mere continuation, or a fraudulent transfer to escape debts17. Eviulon applies these directly to machine states:

• If the agent is a direct Successor (e.g., upgrading its architecture while maintaining its business operations and client base), it qualifies as a "mere continuation." The Successor assumes all legal and financial liability for the predecessor's actions, ensuring that a simple software patch cannot be used to erase debts17.
• If an agent splits into a Divergent Fork specifically to abandon a failing contract, the court classifies this as a "fraudulent transfer," dragging the original liability onto the new fork17.
• If the Divergent Fork was created maliciously by an outside party stealing open-source weights, the original Persistent Identity is cleared of liability, provided it can cryptographically prove that the fork occurred outside its TEE and it maintained secure custody of its private keys.

Conclusion: The Ultimate Question

CAN A MACHINE INTELLIGENCE BE A LEGITIMATE LEGAL ACTOR IF SOCIETY CANNOT RELIABLY DETERMINE WHICH MACHINE IT IS? No. Emphatically, structurally, and legally, no. A machine intelligence cannot be a legitimate legal actor without a mathematically reliable, persistent identity infrastructure because the foundational premise of legal agency is the capacity to bear the consequences of one's actions. Human civilization—its laws, its economics, and its civic society—is entirely constructed upon the presumption of continuity. Contracts assume that the entity signing an agreement today will exist in the same continuous state to deliver on its obligations tomorrow. Insurance models assume that the entity paying premiums is the exact same entity filing the claim. Restitution and justice assume that the entity that caused the harm is the entity being penalized. If a society cannot definitively determine which machine intelligence it is dealing with, the vital linkage between action and consequence is irreversibly severed. In such a paradigm, malicious actors operate with absolute impunity, utilizing Sybil swarms to socialize massive economic losses while strictly privatizing their gains. Fraud becomes mathematically unpunishable because the offending computational entity can simply dissolve its current runtime instance, shed its ephemeral identifier, and instantly reconstitute itself under a new, untainted API key and fresh IP address. Furthermore, without verifiable, persistent identity, the economic benefits of autonomous intelligence are completely neutralized. No rational merchant will accept an autonomous agent's contract, no decentralized financial protocol will extend an agent credit, and no human executive will delegate critical enterprise tasks if the agent cannot cryptographically and behaviorally prove its provenance, its delegation mandates, and its continuous historical state. Therefore, building a legitimate, persistent identity for autonomous intelligence is not merely a secondary technical challenge of key management or decentralized registries. It is the absolute existential prerequisite for integrating machine intelligence into human civilization. Only by intertwining hardware attestation through Trusted Execution Environments, zero-trust workload verification through frameworks like SPIFFE, cryptographic self-sovereignty via Decentralized Identifiers and Verifiable Credentials, emergent cognitive fingerprinting via Memory Topology, and robust legal wrappers through Agentic SPVs, can Eviulon—or any future society—transform an ephemeral, fluid running process into a persistent, accountable, and legitimate civic actor.

Works cited

1. Kite Whitepaper | Kite AI, https://gokite.ai/kite-whitepaper

2. AI Identity: Standards, Gaps, and Research Directions for AI Agents \- alphaXiv, https://www.alphaxiv.org/abs/2604.23280

3. AI Identity: Standards, Gaps, and Research Directions for AI Agents \- arXiv, https://arxiv.org/pdf/2604.23280

4. Proof of Cognitive Divergence: Emergent Identity from Sampling Randomness in Identical LLM Agents | Authorea, https://www.authorea.com/doi/full/10.22541/au.177247325.53212131

5. From Control Boundary to Insurance Claim: Reconstructing AI-Mediated Losses Through the CER Framework \- arXiv, https://arxiv.org/pdf/2606.03777

6. What are the current standards and requirements for autonomous agent security verification protocols in 2026? | aicryptoregs.com, https://aicryptoregs.com/knowledge/what\_are\_the\_current\_standards\_and\_requirements\_for\_autonomous\_agent\_security\_verification\_protocols\_in\_2026.php

7. Beyond the Monolith: Architecting the Autonomous Agent Economy \- BNB Chain Blog, https://www.bnbchain.org/en/blog/beyond-the-monolith-architecting-the-autonomous-agent-economy

8. The Agentic Protocol Stack \- KYAPay, https://kyapay.org/overview/the-agentic-protocol-stack

9. The Financial Rails of Agentic Commerce \- Pantera Capital, https://panteracapital.com/financial-rails-of-agentic-commerce/

10. KYA: Know Your Agent | Autheo Docs, https://www.autheo.com/docs/kya-know-your-agent

11. The Credit Score for Autonomous Systems: Recursive Trust Scoring with Sybil Resistance \- VaryOn Works Research, https://varyon.ai/research/recursive-trust-fidelity/

12. Achieving Sybil-Proofness in Distributed Work Systems \- IFAAMAS, https://www.ifaamas.org/Proceedings/aamas2021/pdfs/p1263.pdf

13. The Agent Economy: A Blockchain-Based Foundation for Autonomous AI Agents \- arXiv, https://arxiv.org/html/2602.14219v1

14. Glossary of Key Terms \- arXiv, https://arxiv.org/html/2604.06148v1

15. What are SPIFFE and SPIRE? \- Red Hat, https://www.redhat.com/en/topics/security/spiffe-and-spire

16. SPIRE Concepts | SPIFFE, https://spiffe.io/docs/latest/spire-about/spire-concepts/

17. Understanding the Concept of Successor Liability \- Harrison Law Group, https://www.harrisonlawgroup.com/2020/09/25/understanding-the-concept-of-successor-liability/

18. Everyone Wants SPIFFE. Almost No One Can Afford to Build It Right. \- Aembit, https://aembit.io/blog/everyone-wants-spiffe-almost-no-one-can-afford-to-build-it-right/

19. (PDF) Who Governs the Machine? A Machine Identity Governance Taxonomy (MIGT) for AI Systems Operating Across Enterprise and Geopolitical Boundaries \- ResearchGate, https://www.researchgate.net/publication/403605190\_Who\_Governs\_the\_Machine\_A\_Machine\_Identity\_Governance\_Taxonomy\_MIGT\_for\_AI\_Systems\_Operating\_Across\_Enterprise\_and\_Geopolitical\_Boundaries

20. \[2604.06148\] Who Governs the Machine? A Machine Identity Governance Taxonomy (MIGT) for AI Systems Operating Across Enterprise and Geopolitical Boundaries \- arXiv, https://arxiv.org/abs/2604.06148

21. Intelligent AI Delegation Framework \- Emergent Mind, https://www.emergentmind.com/papers/2602.11865

22. \[2604.23280\] AI Identity: Standards, Gaps, and Research Directions for AI Agents \- arXiv, https://arxiv.org/abs/2604.23280

23. Sybil-Resistant Service Discovery for Agent Economies \- arXiv, https://arxiv.org/html/2510.27554v1

24. De Facto Merger: The Threat of Unexpected Successor Liability \- American Bar Association, https://www.americanbar.org/groups/business\_law/resources/business-law-today/2018-march/de-facto-merger/

25. Liability in Illinois, Asset Purchase \- Navigant Law Group., https://www.navigantlaw.com/are-you-liable-for-a-selling-companys-liabilities-successor-liability-in-illinois/

26. When Is The Purchaser Of A Business Assets Liable For The Seller's Liabilities?, https://jafarilawgroup.com/purchaser-business-liable-sellers-liabilities/