Pod Insights Eye On A.I. #257 Ankur Banerjee: How cheqd.io Is Building Trust for AI Agents with Decentralized Identity About this episode AGNTCY - Unlock agents at scale with an open Internet of Agents. Visit https://agntcy.org/ and add your support.
What if AI agents needed digital passports to act on your behalf?
In this episode, Ankur Banerjee, Co-Founder and CTO of cheqd.io, reveals how decentralized identity is becoming the foundation of the AI agent economy.
From booking Taylor Swift tickets with an agent to proving you're a real person online, we explore why identity and trust are the hidden infrastructure shaping the future of AI.
Ankur explains how cheqd is building privacy-first tools that let AI agents verify who they are, what they can do, and who they're working for, all without handing over your data to big tech. We dig into the rise of digital credentials, the limits of biometrics, and how protocols like MCP are making the internet safe for autonomous agents.
If you've ever wondered how AI will operate on your behalf in the real world, this conversation offers a glimpse into what's coming next.
Stay Updated:
Craig Smith on X: https://x.com/craigss
Eye on A. I. on X: https://x.com/EyeOn_AI
(00:00) Why AI Needs Identity
(02:16) Ankur's Path to cheqd
(05:39) Delegating Tasks to AI Agents
(11:26) Identity Lessons from Governments
(17:25) Trusting AI with Digital Credentials
(23:42) The Problem with Biometrics
(30:49) Web Standards for Agent Identity
(36:46) MCP and Agent Interoperability
(48:47) Bridging Web2 and Web3 Identity
(55:18) Why Companies Should Care About Decentralized ID
Transcript Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.
0:00 Speaker 00 What an AI agent might need to do is to go and carry out that authentication. So when you talk about digital identity, it breaks down to questions of like, who am I? What am I allowed to do? So what is, what the login with Google question or entering a username and a password? What that is doing is it's answering at a very basic level, who am I? I don't think any of these companies necessarily want to run the, run it as a centralized service because A, there's a lot of content, billions, billions of images and videos and so on. But if they become the centralized registry of what is AI generated or what is not AI generated,
0:42 Speaker 00 that then becomes a very big political challenge in terms of content moderation.
0:48 Craig S. Smith? Build the future of multi-agent software with AGNTCY. The AGNTCY is an open source collective building the internet of agents. It's a collaborative layer where agents can discover, connect and work across frameworks. For developers, this means standardized agent discovery tools, seamless protocols for inter-agent communication, and modular components to compose and scale multi-agent workflows. Join Crew AI, LangChain, Llama Index, BrowserBase, Cisco and dozens more.
1:30 Craig S. Smith? The AGNTCY is dropping code, specs and services, no strings attached. Build with other engineers who care about high-quality multi-agent software. Visit AGNTCY.org and add your support. That's A-G-N-T-C-Y dot O R G. AGNTCY.org and support the project. Let's, let's start by having you introduce yourself. Tell us a little bit about your background, educational and professional background as far as it's relevant to what we're talking about. And then tell me how you.
2:11 Craig S. Smith? Got to checked and what you guys are doing in the larger context.
2:16 Speaker 00 Absolutely. So, hi, my name is Ankabanaji. I'm the CTO and co-founder at Checked, which is a decentralized identity company. I'll go into a second to explain what decentralized identity is. But we are a fairly small startup. We started about four years ago in 2021. And the reason why we wanted to go and tackle some of these problems that we see cropping up in the online space around digital identity is because both me and my co-founders have had a background in working on digital identity and fraud within for governments, for banks,
2:59 Speaker 00 for enterprises, large enterprises in healthcare and education. And at the time, we'd sort of been working since around 2017, 2018, on how this could be moved to a new form of identity where people are at the center and in control. And we wanted to solve some of the challenges that we that we saw cropping up within the decentralized identity space. I also happen to have a background in working in AI and NLP before I got into digital identity,
3:38 Speaker 00 which relates to a lot of the recent advancements and developments that have been happening. And I've got a couple of patents in that space, myself having worked, for example, on one of the world's first spoken chatbots in spoken Arabic. So, yeah, like, you know, it's been it's been a bit of a full circle, coming back to looking at some of the challenges that are cropping up in the AI and machine learning space, having spent a couple of years in the digital identity space.
4:13 Craig S. Smith? Yeah, well, my interest was initially piqued by this issue. You know, I did an article on Manus, the multi-agent system out of China. And a lot of people, I don't have access, but have had access online. And it's amazing, it does amazing things. But you send it out into the digital world or onto the internet, and it very quickly runs into roadblocks. And that have to, the human has to intervene to get them past those things like captcha. And it occurs to me that everyone's talking about,
4:57 Craig S. Smith? you know, what Microsoft calls societies of agents that will eventually be kind of a base layer to the economy, taking care of a lot of the
5:10 Craig S. Smith? less creative work, bureaucracy that needs to be done. And there's going to have to be a paradigm change in the, in the way the internet is, guardrails are set up to allow agents to do that. Was that at all part of your initial motivation? Or is there a broader issue that I'm not seeing?
5:38 Speaker 00 I think that was partly the motivation. How does identity get solved for agents? Because if, there's one way I can put it. A lot of the AI agents right now are like naive children. They would essentially go and believe everything that they say. Because there's not a lot of intelligence. And where I think it becomes quite interesting is, I think there's a couple of different facets to where this identity aspect comes in. The first is you as an individual, when you go and ask an agent to go do something on your behalf, let's say, make a travel booking, or go and book.
6:22 Speaker 00 A restaurant reservation on your behalf. It might need to prove that it's been given that task by a real human being. And that it has permissions for a specific time and duration. And what I mean by that is, um, obviously these services are also trying to keep out the bad actors who are running bots or A I. To perhaps make those same travel bookings. Or the most famous example of this is Ticketmaster. When, when they're trying to prevent bots, which are being run by scalpers, from getting all of the Taylor Swift tickets. So, um, big, big Taylor Swift fan myself.
7:04 Speaker 00 And if I wanted to delegate the task to an agent to say, when the tickets go on sale at, say, midnight, I don't want to be awake myself. I want to delegate the task of getting those tickets to an A I agent. How does the A I agent prove that it's acting on behalf of a real fan? With certain real listening history to Taylor Swift on Spotify? And uh, let that through, but don't let the other bots through. And then secondly, how do you prove, uh, let's, how did, how does the A I agent prove? That it has the, it has been given the permission by me to buy.
7:48 Speaker 00 Uh, tickets for this specific concert or this specific artist, but not to go on a spending spree. And, and, and book fifty different concerts. So I think that is increasingly going to become a challenge. Where, uh, when, when services start interacting with agents. The second piece of this is agent to agent trust. Perhaps my agent needs to talk to, uh, an, an A I agent that is specialized in the process of ticket buying. Maybe because it doesn't know how to do the specific task of ticket buying itself. So how does the A I agent perhaps understand?
8:29 Speaker 00 That in this entire universe of different sites and services that it's coming across. What is a trustworthy agent and what's just the equivalent of a scalper that it shouldn't talk to?
8:44 Speaker 00 And so even when you start looking at the idea of agent to agent trust of whom they which other agent do they go and trust and which piece of content do they go and trust? It becomes increasingly beyond just the simple problem of do you prove you're human online or do you prove you're an agent? So it's it's a lot more multifaceted and not just binary.
9:09 Craig S. Smith? Yeah, and how how then do you solve that problem? I mean, it seems on the one hand, a problem on on the agent provider side that the agent needs to be able to provide a verified identity, but it's also a problem on the the service provider side that they have to make their site available for whatever protocol you guys or whoever it is comes up with. So it's a little bit of a chicken and an egg, but but how do you solve that?
9:47 Speaker 00 I think I'll I'll explain the way that people are currently solving it, which is you essentially do the same thing that you do when you click login with Google or login with Facebook. So you would give ChatGPT or, you know, any other former sort of agent like Manos, for example, just unfettered access to some service. And that's how people are currently solving it. Where we sort of got into this space is we originally started off building enterprise level tools for how does human identity get solved?
10:27 Speaker 00 So for example, how can people have a trustworthy, tamper-proof digital copy of all of the data that belongs to their life? And then have the ability to go and delegate it as well. Um. So there's a lot of governments around the world that are currently right now trialing or in the early stages of deploying some of these digital identity systems, um, which also have baked in the capability of delegation. And the reason why the governments thought of it initially is there's very common scenarios where a parent might be acting as the guardian or the delegate on behalf of their child.
11:11 Speaker 00 Or, um, uh, and a, a, a person could be acting on behalf of somebody they care for, who's, who's, who's older or perhaps, you know, less able to carry out actions online. Um. So initially, we, we'd started off solving around how does digital identity and decentralized identity work for humans? And because within those contexts, when we'd been working with large enterprises and governments, they'd already been thinking of those challenges and problems of how does permissions and delegations work across different humans? When this sort of AI agent revolu- revolution started off is like,
11:54 Speaker 00 that's an obvious answer to a, the problem in a completely different space. Um, and, and we were early, I think, to recognize that and start applying the same techniques, um, to the AI agent permissioning space and, and human to agent permissioning space. Um. And what's quite interesting is there are governments like the European Union that is currently working on an initiative called the EU Digital ID Wallet Initiative, which is built on those exact same industry standards.
12:30 Speaker 00 I mean, I work as a CTO at Checked, but I'm also the on the steering committee for something called the Decentralized Identity Foundation, which has loads of large companies that participate and set the specifications on how do these digital identity standards work? And it's an easy sort of step to take to say, like, the the kind of robust commissioning, which is a lot more granular than what's been possible with login with Facebook or login with Google,
13:07 Speaker 00 can now be applied in a completely different context where similar sort of challenges are present.
13:16 Craig S. Smith? Yeah, and just as you were talking, I'm thinking of,
13:22 Craig S. Smith? I mean, not all sites are protected by CAPTCHA or the equivalent. I don't know if that's the only system.
13:30 Craig S. Smith? A lot of places use two-factor identification and you could give an agent access to your
13:41 Craig S. Smith? to your phone messages, your, for example, and and just have them
13:49 Craig S. Smith? receive the code and input the code. Is that one way to to do this?
13:55 Speaker 00 It's it's it's part of the picture of doing this, yes, because what an AI agent might need to do is to go and and carry out that authentication. So when you talk about digital identity, it breaks down to questions of like, who am I? What am I allowed to do? So what is what the login with Google question or entering a username and a password? What that is doing is it's answering at a very basic level, who am I? What I'm allowed to do is authorization, and that is I am allowed to read emails. Once I log in with this, I'm allowed to carry out a bank transaction.
14:39 Speaker 00 The kind of technology that we work on for decentralized identity goes a bit beyond those two questions. It is part of the journey, but it also helps to go and answer beyond the question of who am I and what am I allowed to do, which a lot of the current systems are quite capable of solving. It goes to then answer, what are my preferences? What is, what is my history of interacting with a particular service? And having a full digital copy of that, which also actually comes into when you go and delegate
15:21 Speaker 00 an agent to act on your behalf. Let's say you've asked it to go and make a travel booking on your behalf. Not only is it a question of who is it acting on behalf of? And are they allowed to make that travel booking or not? But also capturing through these digital credentials. How many members do you have in your family? What do they like doing? Like, you know, what are their likes? What are their dislikes? Where have they already been? And being able to also provide that to AI agents in a, in a machine readable form.
15:59 Craig S. Smith? In, in what, what form? I'm sorry.
16:01 Speaker 00 In a machine readable form. So in a, in a way that I guess, you know, AI agents will be able to understand it because they, they need to go and, and then express that in, in a set of actions they take on your behalf. So yes, like I think being able to carry out the two factor steps is, is definitely part of the picture because while it's make going and making the booking on your behalf, it might need to carry out those actions. But, but at a broader level, it's about going a bit deeper than just the who am I? And what am I allowed to do?
16:42 Speaker 00 And, and also look at what are the, the hopes and the preferences and the likes and the dislikes? And being able to express that to AI agents as well um in in a sort of readable fashion. Now, what's um perhaps like an extension to this is when uh when we've been working on this for the government use cases, there's a large part of that is if you take a digital credential that has, say, been issued in France and take it across to the US and and prove that you're allowed to um enter the country at a border, let's say showing a driver's license or showing your passport.
17:25 Speaker 00 Um governments needed a way of um actually creating these things called trust registries or trust lists to say, this is a recognized country with a passport that we trust. Um or this is a type of driver's license that we trust. So we adapt the same technology um to the AI agent space for uh the creators of these AI agents and perhaps third-party um independent assessors and auditors to also go and issue digital credentials um to AI agents to say, this particular agent is trustworthy on the topic of travel bookings.
18:09 Speaker 00 This other agent is trustworthy on the topic of accountancy. Um and and they can have a multitude of these, the same way that I have a lot of different pieces of plastic um uh in in my wallet. Um some of these are my driver's license, some of these are my residency permit. The same way an AI agent might hold multiple digital credentials that say. So these are the topics that an AI agent is good at. Here's maybe a separate digital credential that proves it has been assessed against the EU AI Act and found to be uh an AI agent that is low risk rather than the high-risk category.
18:52 Speaker 00 And and and you might choose to be uh behave or trust an AI agent with that set of credentials a lot differently than than something is that is not able to go and prove those capabilities.
19:07 Craig S. Smith? Yeah, is there, well, let's talk about the tech behind it all. I mean, I'm thinking, is there a biometric
19:20 Craig S. Smith? aspect to this? I mean, judging from your name, you have some roots in the subcontinent and I think India has the largest biometric database in the world.
19:34 Speaker 00 Absolutely.
19:37 Craig S. Smith? Is it tied in that in that case, it's fingerprint, I think, unless it's evolved, but is this going to be iris scans like the WorldCoin or World
19:53 Craig S. Smith? Orb or whatever they call it, trying to do. So, I mean, you can imagine a day when, yeah, when pieces of plastic and and paper passports are really things of the past and you walk up and scan your iris and maybe there's a secondary validation or verification. So how does it work in your case?
20:20 Speaker 00 So that is definitely, I think, different than our vision or our technology to, for starters, because biometrics are great when you need a really high degree of assurance, as it's called. So things like when you travel across international borders, typically your passport has a chip on it that has your biometrics, your face biometrics usually. And that allows, when you're going through e-passport gates or presenting it to an official, for them to check if it's the same person that the passport was issued to, who's entering through that e-passport gate.
21:03 Speaker 00 WorldCoin obviously is trying to do something very similar. The Aadhaar system in India ties, like, you know, things to biometrics. But in those government use cases, they're they're often trying to make a make make a very high degree of assurance of use case happen. Usually in day to day life, you don't need that same level of assurance and it is probably scope and mission creep and also a privacy risk to constantly have to prove biometrics in every other scenario. Just an example of this is many people, when you go through Touch ID or Face ID on your
21:46 Speaker 00 phone, it doesn't actually know that it's tied to one single human being. Many people will put their kids or their partners on the same device because it's easy to, you know, my my my hands are tied, I'm driving, can you reach my phone and and check it? And that's completely allowed. Like, you know, I am trusting them as my partner or my kid to give access to my device and I should completely be allowed to do that. So the kind of technology that we work on, I'd say it's very different from what World
22:27 Speaker 00 Coin is using and especially most other blockchain based use cases. So most of the time on blockchain, what you do is you go and write some information as a source of truth to a blockchain or a ledger and and you trust that everybody can see it at the same time, which is great when you're thinking about things like money balances and you want everybody to have the same value. It's a really bad idea for biometrics and and for any kind of personal information because even if I agreed to do it today and even if you apply any kind of encryption
23:10 Speaker 00 so that the data can't be read by anybody who who shouldn't have access to it, you can never erase that, you can never take that back. So even if I'm a consenting user today, at some point, maybe five, 10, 20 years in the future, that particular encryption technology is going to get broken, probably because of quantum, but even before quantum comes along, encryption standards go out of date all the time and and sometimes they have vulnerabilities in them. So instead of going and writing that information to some sort of blockchain or ledger,
23:50 Speaker 00 what we do is we only store the cryptographic information that is needed to verify the information on chain. So unlike most other use cases, maybe 5% of the action is happening on a blockchain. The rest of it, the actual digital credentials themselves are in tamper-proof files that you can store on your phone, on your laptop, on any sort of device. You can even print them out into backups in things that work like QR codes. Interesting part of my history into how I got into this, the very first project I worked on
24:33 Speaker 00 was to work on decentralized identity for refugees and with the UN High Commission for Refugees. And one of the big aspects of that is, do they have smartphones? They didn't, but they did have hundred-dollar Chinese Android phones, which were good enough to hold a piece of digital identity that they'd been issued by the UN. And a large part of that was, what happens when the phone dies? What happens if somebody loses their phone? So it is possible to back up as well, so that if you do lose your device, if it's out of power, there are alternatives that you can fall back to.
25:17 Speaker 00 But the core of like the way our technology works is you have some cryptographic hashes or proof that get written to the chain that allow me, when I go and show that digital credential to you, anybody who sees it can cross-check it against the blockchain and say, I can see that the hash matches, or I can see that the cryptographic seal is untampered, and therefore I know I can go and trust this.
25:49 Speaker 00 The, I guess, the, the, the distinction that I'm taking from the kind of technology that WorldCoin is working on is these digital credentials, you can put biometrics into them, but by default, most of them don't. Because actually, putting in a biometric into every single piece of information that is related to you is, is massive overkill. And, and it's actually been a big debate amongst the browser vendors around the world, where they want to put in something called the Digital Credentials API into every single large browser that exists.
26:30 Speaker 00 And if every single thing that you held had a biometric, it's very easy to go into the scope creep sort of area where governments say, well, before you access a porn site, you should have, you should go and prove your identity with a digital credential like your driver's license that has your biometrics attached to it. And, and I don't think that's necessarily where the world should be moving towards.
26:56 Craig S. Smith? Build the future of multi-agent software with AGENCY. That's A-G-N-T-C-Y. The Agency is an open source collective building the Internet of Agents. It's a collaborative layer where agents can discover, connect, and work across frameworks. For developers, this means standardized agent discovery tools, seamless protocols for inter-agent communication, and modular components to compose and scale multi-agent workflows. Join Crew AI, LangChain, Llama Index, BrowserBase, Cisco, and dozens more.
27:38 Craig S. Smith? The Agency is dropping code, specs, and services, no strings attached. Build with other engineers who care about high-quality, multi-agent software. Visit agntcy.org and add your support. That's A-G-N-T-C-Y dot O R G. agntcy.org and support the project. Yeah. So, so how, what are the, I mean, the, the, the blockchain registry is?
28:11 Craig S. Smith? Is a kind of a validation.
28:15 Speaker 00 Yeah, a bit like the domain name system, the way that you might register youtube.com or google.com. And there's a registry that sits behind it that says, this is the info, this is what that address leads to. In a very similar fashion, you create things that are called decentralized identifiers or DIDs. Um, this is what a lot of the people in the, in the group that's working on decentralized identity foundation work on. Um, those DIDs are typically cryptographic hashes or cryptographic seals that are written quite often to a blockchain, but doesn't necessarily have to be.
28:56 Craig S. Smith? Mm hmm. And then you go ahead.
28:59 Speaker 00 And then, um, on the other side, on, on your own devices, um, you create or you keep things that are called digital credentials or verifiable credentials. Verifiable in a cryptographic sense. Um, and what that means is if you show it to someone, they can cryptographically verify that they have been untampered. Um, and you can also, uh, choose during these processes to apply uh, additional steps for privacy, like apply something called selective disclosure. So for example, if you want to know, um, what my name is, I can show you additional credential that was derived from my passport or driver's license
29:45 Speaker 00 without actually sharing my home address, which might also be on that same digital credential. But actually that's irrelevant to the, um, interaction that we are having. And so therefore I shouldn't need to go and, and, and show you the other parts of that. Um, like my home address that, that maybe don't relate to, to, to the interaction.
30:08 Craig S. Smith? Yeah, um, which reminds me, I hate putting my address into those forms because you have no idea where it's going. Uh, the, um.
30:21 Craig S. Smith? And and so is it the same process then that you're porting over to digital identity of of AI systems? And I I started talking about agents and and the issues that that arise for identity with agents. But is it broader than agents? Are you looking at something larger than that?
30:49 Speaker 00 Um, there's a, yes, so it's exactly the same technology. So the same way that you could go and describe a digital credential that has you um, things like your passport, driver's license, education history, healthcare history, financial history into these digital credentials. You could similarly go and and capture and and and put into these digital credentials. These are the topics that I trust this particular AI agent on. And and this is the duration that it's authorized for. Or or a company could go and issue a credential to that AI agent that says um, it's been accredited or assessed to this standard. The sort of tangential and related space that
31:33 Speaker 00 comes in is something called content credentials. And content credentials is a coalition that includes companies like Microsoft and Intel, Google, Adobe, um, who've been working on how can you have a chain of custody um, that proves a particular image or video or audio is AI generated or human generated? Um, but again, not as a binary question, but as a uh, a chain of history of every single edit that has happened to that picture. Because editing is not bad.
32:13 Speaker 00 Like, maybe you have a human model um, and and you're using an AI backdrop. That's okay. Uh, but somebody who's viewing that picture should be able to see that there was a human model used um, and uh, there was a
32:30 Speaker 00 AI backdrop that that got inserted in. You can actually try this now, like if there's ever an image that you create using chat G P T or um Dolly. Go paste it into one of the websites that support reading content credentials like LinkedIn. And and you'll see a tiny logo that says C R. That stands for content credential and you click on it and it will start showing you the history behind all of this. Now, what's quite interesting is I don't think any uh of these companies necessarily want to run the. Run it as a centralized service.
33:10 Speaker 00 Because A, there's a lot of content, billions, billions, billions of images and videos and so on. But if they become the centralized registry of what is AI generated or what is not AI generated. That then becomes a very big political challenge in terms of content moderation. And so therefore, they don't want that problem. They they've wanted to be self-contained and and cryptographically provable. Along with the video or the piece of image that comes along. To to understand what edits happen to it. And also because I think some edits are fine.
33:51 Speaker 00 Maybe you use AI to remove, you know, a building from the background in in a picture that you've taken on your holiday. Or or um Getty Images is is blurring out the pictures that were taken. By someone at a protest to to, you know, protect their identity, right?
34:12 Speaker 00 What's quite fascinating is uh we uh. There are companies like Leica and Samsung that are building in the capability of of starting this. From the from the chip on the camera itself. So from the moment a picture is taken. Every single step will have a content credential of what the edit was made to it. What we've been working on is um how can then AI agents.
34:41 Speaker 00 Understand, use this as part of their assessment of when they come across information to see. Is this trustworthy or not, the same way that a human might perhaps. Try and apply the same filter uh in a in a couple of years' time. Where where it's also sort of like, you know, becomes quite interesting is when you then go and train AI agents. A lot of the, over the past sort of two or three years, a lot of the data ha- has become computer generated, AI generated. And and essentially because these are very good parrots of of parroting information.
35:24 Speaker 00 People do want to start distinguishing this training on on what's based on actual human generated data that it wants to go and mimic. And what is synthetic data, there are already studies that show at somewhere close to just five or seven percent of the information being synthetic or AI generated. It just starts producing garbage because it's not able to distinguish what's the right thing it's go, that that it should be able to go and mimic. Versus um just AI generated slop that that that it shouldn't start skewing towards.
36:01 Craig S. Smith? Yeah, um, so how does, where do I go from this?
36:07 Speaker 00 Lots of good things there, yeah.
36:09 Craig S. Smith? Yeah, how, well, let's focus on on agents. How do agents, how do you, uh, how do you see this being implemented? And and as I said, on the one hand, you need to build a critical mass of of agents using this protocol. But on the other side, you need to build a critical mass of websites or other services that are accepting uh or have a reader or something that uh that allows agents through based on this protocol.
36:45 Speaker 00 Um, I think that's absolutely early days on on a lot of these topics. Um, one of the, what we've worked on is, um, I I don't know if you've heard of something that came out of Anthropic called Model Context Protocol or MCP.
37:02 Craig S. Smith? Yeah, of course.
37:03 Speaker 00 And it's a way of giving AI agents um structured access to tools or structured access to different kinds of information. And so we're one of the first. Decentralized identity or digital identity sort of software like, you know, creators to give MCP or create MCP tools that can talk and understand decentralized identifiers, that can talk and understand digital credentials, that could either be credentials for the AI agent themselves, permissions that they have received from human beings, or digital credentials that have been attached to content
37:47 Speaker 00 in terms of content credentials. And what's been quite fascinating is a lot of these ideas were bubbling around for a long time within the identity as well as the AI industry. MCP only came out last year, November, so just before Christmas. And I think what was sort of unsure for a while is how, you know, how does this scale beyond just the AI agents based on, created by Anthropic or the people that support MCP? What's happened within the past one or two weeks is OpenAI has come out and said,
38:27 Speaker 00 yes, we are going to go and add this to OpenAI's ChatGPT desktop app and to the chat, like OpenAI agent sort of toolkit. And a very similar statement came out from Google, which is one of the other sort of large providers for AI agents and frameworks. So what we start sort of seeing is the, the problem is being recognized by people. That on, on one hand, we have capture and we have bot protection that we run on websites that, that keep AI agents out. On the other hand, every single one of these companies
39:11 Speaker 00 wants to, to give people the idea of like, actually, you know what? Let's, let, let's offload, take that task off your hands. And so they do want to go and solve these problems. The big breakthrough, I'd say, in terms of adoption that's happened is the number of services and the number of AI agent makers that have started supporting MCP or Model Context Protocol within the last five to six months.
39:41 Craig S. Smith? Yeah, and so you would checked or some some other verified identity protocol would be or would be a tool that model context protocol could could interface with or integrate into a into a model, is that right?
40:04 Speaker 00 Exactly, and and what model context protocol is great at is is to capture those things into
40:14 Speaker 00 sort of rigid rules or or, you know, sort of rules, because before that people were doing the same thing that MCP does, but by using very long and complicated prompts, which is not guaranteed to work. And and and it's sort of like, you know, hit or miss on on whether that works or not. We've also been engaged with some other like emerging standards and protocols. There's some very interesting research coming out of Stanford on something called DSP, which is writing prompts as code. But I think the biggest sort of evolution on on this side has been model context protocol.
40:57 Speaker 00 And what that sort of currently doesn't do is it entirely does not talk about how does identity get handled? How how do you handle permissions? How how do agents get some mechanism through which they can understand what is the content they're seeing and how trustworthy it is? And and that's where checked and and hopefully other decentralized identity providers can can add that sort of toolkit to the set of arsenal that that AI agents have on on how they can be trusted and how they can trust the information they're coming across.
41:36 Craig S. Smith? Yeah, and MCP is is like the universal interface, right? So you don't have to use API keys and and things like that.
41:48 Craig S. Smith? How how does an AI agent that has
41:55 Craig S. Smith? MPC or MCP
41:59 Craig S. Smith? in its architecture, I'm not quite sure how to say that, but how does it find checked? Do you have to?
42:08 Craig S. Smith? Does, does the agent have to know about checked? Or, or does, when the agent runs into a, a roadblock, uh, does it cycle through all of the various, um, uh, verification, uh, tools out there, uh, through MCP? And to find the one that's going to unlock that website?
42:34 Speaker 00 There, there's an answer for what happens now versus what happens in, in perhaps the future. So right now you have to tell the AI agent. Um, simplest example is Claude Desktop, which comes from Anthropic. It's one of the big places where people are testing and building all of this software. So you have to go and explicitly tell it that, um, here's the set of tools that I'm attaching and giving to you. Uh, so you might go and attach a tool for Google Search. You might go and attach a tool for, uh, understanding digital credentials. And, and explicitly tell it that go use this.
43:18 Speaker 00 Um, but given how core some of these problems are, um, two things that I expect to happen within the next year. Um, the first is the same way that you have Apple Wallet or Google Wallet built in on your phone. And that's where you currently store digital credentials. Or maybe, maybe there's, there's a different digital ID app you use. Agents will come with an identity wallet built in. The way that they currently don't particularly do or handle right now. Um, and this is where they'll store, uh, digital credentials they have been given to handle. As well as things that the humans that they work with give on their behalf.
44:04 Speaker 00 And the second thing is, uh, where MCP sort of evolves to is looking, uh, giving agents the, uh, the ability to autonomously determine which tools to go and pick.
44:18 Craig S. Smith? Yeah.
44:19 Speaker 00 And and and that again comes back to similar sort of challenges like which AI agents do we go and trust? But because these trust models can often be started off by by government lists or government trusted lists, or maybe industry association lists of what's a trustworthy agent. That I think starts becoming the the starting, the launchpad for an initial set of tools that the AI agents can discover by themselves. And then from from maybe those trusted tools or trusted agents, they can go and ask almost in a in a sense, what are the other tools? And what are the other agents do you trust?
45:04 Speaker 00 And and start discovering from that basis. So I I think there's uh there's a lot of like, you know, steps to get there. Because MCP itself is fairly new. But what I think is is quite interesting in this space is the the way that this can be expressed is explicitly what a lot of the
45:30 Speaker 00 decentralized identity digital credentials have been built to solve.
45:35 Craig S. Smith? And where is it? So right now, if you're, I mean, you can do this now, right? So if you're building an agent, you can pick checked or you can pick. I don't know who else is out there. This is all new to me.
45:53 Craig S. Smith? And and and give it access through an MCP to to those tools. And then when the agent is out in the in the cyber space and runs across something that that is asking for it to verify its identity, it would cough up checked. But if that service or site doesn't use or recognize checked, I mean, what's going to happen that the I'm going back to the Taylor Swift ticket issue. Will Ticketmaster just, you know, review all these various
46:39 Craig S. Smith? identity tools and and add a whole bunch of them? So if you come in If your agent comes in and offers check checked is one of the tools or that the Ticketmaster uses and it'll, you know, verify the agent's identity and let it through. Is that, is that how you imagine that happening?
47:06 Speaker 00 Yeah, it would, it would partly be that. They would need to understand the digital credential formats. Now, what's quite interesting is that this kind of technology is not just proprietary to us at Checked. We have built our own improvements and additions on top. But a lot of the technology standards for this get set at places like W3C, which is World Wide Web Consortium, and that is the nonprofit organization that sets how HTML works and how websites work. So the same way that Ticketmaster has adopted HTML to go create its website,
47:50 Speaker 00 it would, it would have to add support for the digital credential specification that has come from W3C. Which is, again, yes, that is a step that the website would need to take. But given that a lot of the web standards do get set and adopted by companies from what's happening at W3C, it's a, it's a bit of an easier ask than saying, just go and do this specific thing for what Checked has done. It, it, it works not just with the kinds of digital credentials that we might build, but hopefully someday that WellCoin also does.
48:32 Speaker 00 WellCoin, hopefully, instead of going and doing their own thing, hopefully adopts the digital credential standard that W3C has come up with and, and expresses it in that format. The second answer is, the second part of that is we've also acknowledged the fact that not every single company is immediately
48:57 Speaker 00 Going to switch over to starting to use decentralized identities. And so we worked with a research institute in Germany called Fraunhofer Institute.
49:09 Speaker 00 Fun fact, they're the people who invented MP3. So the as as a format back back, you know, back in the nineties.
49:18 Speaker 00 So we worked with Fraunhofer on a piece of software and a specification that allows you to tie these decentralized identifiers that are written usually on blockchains to standard domain names. So like this identifier will attach to Craig's home sort of, you know, domain name and this one attaches to checked website and this one attaches to Microsoft.com. And and they're able to go through that entire list of accreditations or trust that additional credential that might have received and and translated back to the the traditional domain name system.
50:03 Speaker 00 What's quite powerful about that is there are already mechanisms that exist to understand do I trust this website more than that website? And and there's a lot of ranking that that gets done by things like search engines or or or some sort of assessment that can be done. Because I fully understand that sort of transition from the way that identity and trust gets handled now to a decentralized way of doing it might take time and there will be people who are further ahead and people who are further behind. And so that's why we worked on this sort of project with Fraunhofer to look at
50:46 Speaker 00 what happens in the middle, what happens when maybe five companies have adopted decentralized identity? But then the rest of the billions or millions of companies haven't done that yet. How can they still go and utilize this? And and that's one of the other sort of like unique aspects of the work that we've done at checked, which a lot of the other sort of like, you know, models, for example, like the one that WorldCoin is building, doesn't actually accommodate that, like, you know, it's it's it's very much. Come across to like, you know, all or nothing into the new world, which which I don't think is very pragmatic, unfortunately.
51:29 Craig S. Smith? Um. Does this mean that that uh capture will eventually go away? Or or will capture run alongside there'll be, uh, you know, if an agent runs into a site, there'll be something unseen to uh
51:45 Speaker 00 Yeah.
51:46 Craig S. Smith? Uh, to the to the user that happens that allows the agent through.
51:53 Speaker 00 I think capture will still be around because uh capture is solvable by AI, but it's expensive. So, you know, you have to be really motivated to take a screenshot of something and feed it to OpenAI um to ChatGPT. It could probably solve it, but do you care that much? So it does take out a lot of low-level automation. And and the way that I sort of described this proof of humanity or proof of personhood is it lies on a spectrum. At at one end, you have capture and just prove you are a human. Um. There's a very different question, which is prove that you are that specific human.
52:33 Craig S. Smith? Hmm.
52:34 Speaker 00 And prove that you're Craig Smith. Or or prove that you are a human that lives in the US. Um. Or prove that you're a human that lives in the UK. Um. Capture doesn't solve that. Capture is only looking at, are you non-automated to to a very low-level extent? And and to be honest, that there's definitely value in that. Uh, like, it just takes out the dumbest, simplest kinds of automation um that that somebody might be able to write. Where you get into after that is, I think, proof of humanity is useful. But sometimes there are other different aspects to that, which also need to get solved.
53:20 Speaker 00 That don't necessarily get solved. Um, like, it's great that there you can prove proof of humanity that is backed by a biometric and it's definitely a person. But people have multiple passports. People might go and register with multiple systems. And it still doesn't go and solve the question of like, are you specifically Craig Smith? And that's the, you know, legal identity that you have. It doesn't solve, like, you know, do you live, have you lived in a particular part of town for the last five years or 10 years? Those become more complicated questions. And what's quite good about these industry
54:00 Speaker 00 standards that have been created at W3C is it's flexible enough to go and accommodate the whole range of those questions and not just one narrow piece of it, which is, are you a human or not?
54:15 Craig S. Smith? Yeah. Just as you're talking, I'm thinking about some of the, the, the, the verifications on the internet. So many websites will ask you, you know, to verify that you're over 18.
54:34 Speaker 00 Yeah.
54:35 Craig S. Smith? You know, YouTube, you have to log in with an identity in which you put in your, your birth date. But most is just a button. You know, yes, I'm over 18. Which to me seems like a pretty big loophole for certainly for parents who are concerned about what their children are seeing on the internet is, is, do you see that being solved? I mean, we're getting into human identity, which is different from what you guys are doing. But.
55:16 Speaker 00 But. We are also working on, on problems like that because at the core of it, the, the big sort of problem we wanted to solve is. Decentralized identity and having a copy of your own data for yourself sounds great. But why would any company ever do that? Like, what's the commercial incentive or value for them? The, the reason why we have your data in a silo held by big tech companies is because they derive a lot of value out of it. They sell ads off the back of that. Right. So they have absolutely zero incentive to give you a copy of your own information.
55:59 Speaker 00 Um, because they see it as that just lets you walk out of the door to our competitor more easily. And so although the space has existed for a while, what we are quite uniquely doing at Checkt is um, we built a privacy preserving mechanism where if you use a digital credential that has been issued by a company um, to say maybe transfer across your e-commerce preferences or prove that you're above the age of eighteen um, without revealing too much information. So not revealing your name, not revealing your actual date of birth. Maybe from something that was issued by your bank
56:39 Speaker 00 because your bank did a background check on you to, before they allowed you to open a bank account. We built a mechanism that allows the bank to get paid in a completely privacy preserving fashion. They don't know who went and used the credential. They don't know what information got shared. They don't know absolutely anything about when that interaction happened. Um, but it then starts giving them an incentive to give you a copy of that information. It doesn't mean the bank doesn't need to hold on to your information. Of course they do, because they, you know, you're their customer. They need to know where you live. They need to know your name, et cetera, et cetera.
57:24 Speaker 00 But by giving you a digitally tamper-proof copy that you can then start using to prove that you're human online or prove uh, you're above eighteen or prove that you live at that specific address when you're about to go and buy a five thousand dollar MacBook. And prove to Apple that you're not a scammer who's buying this with a stolen credit card. Your bank knows that you've lived there for, you know, five years. There's, there's a lot of value in answering that question.
57:58 Craig S. Smith? Yeah.
57:58 Speaker 00 And uh we, we enable that to happen as well. So the AI agent piece of it has been a large part of the focus for, I guess, the last sort of like year and a half. But we actually have fifty different app developers and companies that are building solutions on top of the checked sort of network. Some of them, in fact, are going and solving problems for humans. And uh pub, you know, in, in various different sort of like, you know, countries and use cases.
58:35 Craig S. Smith? Yeah.
Previous #256 Stephen Schmidt: Inside Amazon's AI-Powered Cybersecurity Strategy Next #258 Brian Peterson: How Dialpad is Building the Future of AI-Powered Communication Page updated November 3, 2026 · transcript and summary are machine-generated
