Mark · verifiable identity for AI

01What Mark answers

When an AI output appears, four questions matter:

• Who or what produced this?
• On whose behalf?
• Under what policy?
• When?

Until today, those questions had no answer. Now they have one. The answer is a small envelope attached to every AI output that Validiti products produce.

02What a Mark envelope looks like

A Mark envelope is a JSON object with the following top-level fields:

03The issuer object

{
  "id":           "<a stable identifier for the issuer>",
  "kind":         "ai_agent" | "ai_model" | "ai_pipeline",
  "key":          "<reference to the issuer's published public key>",
  "display_name": "<human-readable, optional>"
}

The seal is verified against the public key referenced by issuer.key. The key registry is public; anyone can publish a key, anyone can read any key.

04The for object

When an AI agent acts on behalf of a person or organization, the for object names them and the scope.

{
  "principal_id":   "<identifier for the human / org>",
  "principal_kind": "human" | "organization" | "service",
  "scope_id":       "<the authorization scope>",
  "scope_hash":     "<hash proving the scope was granted>"
}

05The installation object

{
  "device_id":     "<stable identifier for the device>",
  "binary_id":     "<the Validiti product producing this>",
  "binary_hash":   "<sha256 of the producing binary>",
  "runtime_state": "<runtime-attestation token>"
}

This is how a relying party confirms the envelope came from a known, untampered installation.

06The policy object

{
  "policy_id":      "<stable identifier>",
  "policy_hash":    "<hash of the full policy>",
  "policy_version": "<semver or sequence>",
  "policy_source":  "<reference, or 'self'>"
}

The policy_hash lets a verifier confirm what policy was in force without exposing the policy’s contents. Required when event_type is inference_produced, action_taken, or policy_loaded.

07The descended_from object

{
  "base_model_id":   "<identifier>",
  "base_model_hash": "<hash>",
  "derivation_chain": [
    { "step_kind": "fine_tune" | "rlhf" | "dpo" | "distillation" | "merge",
      "step_id":   "<identifier>",
      "step_hash": "<hash>",
      "step_ref":  "<reference, or null>" }
  ],
  "training_corpus_ref": "<reference, or null>"
}

Optional. When present, anyone can walk the chain back to the base model.

08Event types

Mark v1.0 defines these event types for the agent category:

Additional domain-specific event types are valid Mark v1.0 agent events, used by specific Validiti products: challenge_issued, verification_attempt, verdict_labeled, signal_published, persona_action, persona_loaded, corpus_loaded, corpus_queried, lineage_claimed.

09How to verify an envelope

A Mark envelope is verified in eight steps:

1. Check version is supported.
2. Strip seal from the envelope.
3. Compute the canonical JSON of what’s left (sorted keys, no extra whitespace, no seal field).
4. Look up the public key referenced by issuer.key.
5. Check the seal cryptographically verifies the canonical body against that public key.
6. Optional: walk the previous chain to confirm continuity.
7. Optional: confirm the policy.policy_source is known.
8. Optional: walk the descended_from.derivation_chain against the registry.

Steps 1–5 are mandatory. Steps 6–8 are optional checks that add stronger guarantees for relying parties that need them.

10Selective disclosure

You can present a subset of an envelope’s fields and prove the omitted fields existed in the signed original. Selective-disclosure presentations are a separate envelope shape, specified separately. Full-envelope presentation is what v1.0 requires; selective disclosure ships in v1.1.

11Revocation

To revoke a signing key (or a specific envelope), the issuer produces an envelope with event_type = "revocation" and the appropriate payload. Verifiers check their local revocation set before validating any seal. Revocations propagate through the same channel envelopes flow on; there is no central revocation server to call.

12What Mark is NOT

• Not a wallet you download.
• Not a service Validiti hosts.
• Not a registry Validiti controls.
• Not something you pay for.

Mark is a math layer over signed records that Validiti products already produce. You add the verifier to your software in five minutes. You don’t need an account, an API key, or a contract with anyone.

13What’s coming

Mark v1.0 is for AI agents. Mark v1.1 adds selective disclosure. Later versions add category = "human" (for people) and category = "machine" (for devices), using the same envelope shape. All three categories are free, forever. Identity should never be paywalled — not for AI, not for people, not for the devices people use.