Entity Card
The typed, DID-anchored identity card that KYA-OS entities publish for discovery, with per-request proof riding on top.
Identity you can discover, then verify
The Entity Card is a typed, DID-anchored identity object. Discovery rails carry the card so a peer can find who an entity claims to be; the per-request proof then lets the peer verify, on every call, that the caller controls that identity.
What an Entity Card is
The Identity Layer gives every participant a DID and key material. The Entity Card is the object built on top of that DID: a signed, typed description of the entity that can be published wherever peers look for it.
Every card declares an entityType, so a verifier knows what kind of participant it is dealing with before any request is made:
entityType | The participant |
|---|---|
mcp | An MCP server exposing tools and resources |
agent | An autonomous agent acting for a principal |
client | A client application connecting to servers |
verifier | A component that checks proofs and delegations |
human | A person, as the root of a delegation chain |
The card is anchored on the entity's did:web document through a KyaOsEntityCard service entry.
That anchor is the canonical source; discovery rails carry projections of it.
Issuance and anchoring
An entity (or its issuer) signs a card over its controller key and publishes it as a KyaOsEntityCard service on its did:web document.
The card binds the key that will sign per-request proofs (via cnf.jkt), so discovery and runtime verification refer to the same key.
Four discovery projections
The same card is projected onto the rails peers already use to find each other. Discovery is not the security boundary — it only tells a peer where to look and what to expect. The proof does the verifying.
Per-request proof rides on top
Discovery ends where verification begins.
Once a peer has the card, every request carries a self-contained proof under _meta["org.kya-os/request-proof"] and every response carries _meta["org.kya-os/response-proof"].
The proof references the profile id org.kya-os/proof.v1 and is signed by the key the card pinned with cnf.jkt.
There is no separate handshake: the card is the standing identity, and the proof re-establishes control on every call. See the Verification Protocol for the request/response proof flow.
Card vs. proof
The card answers "who is this, and what type of participant?" once, at discovery time. The proof answers "does the caller control that identity, for this exact request?" on every call.
Next steps
- Identity Layer — the DIDs the card is anchored on
- Delegation Layer — how authority flows once identity is established
- Verification Protocol — the per-request proof flow