Identity Specification

Decentralized identifiers and verifiable credentials for hospitality.

Namespace URI: https://agenticbooking.org/identity/v1

1. Overview

Identity establishes who venues and authorities are, enabling agents to verify claims and build trust chains.

2. Decentralized Identifiers (DIDs)

A DID is a globally unique identifier that the subject controls. No central authority grants it.

2.1 did:web

For most venues and Curators, did:web is sufficient:

did:web:theroste.co.uk
did:web:visitnorfolk.co.uk

2.2 DID Document

Publish at https://yourdomain.com/.well-known/did.json:

{
  "@context": "https://www.w3.org/ns/did/v1",
  "id": "did:web:theroste.co.uk",
  "verificationMethod": [{
    "id": "did:web:theroste.co.uk#key-1",
    "type": "JsonWebKey2020",
    "controller": "did:web:theroste.co.uk",
    "publicKeyJwk": {
      "kty": "EC",
      "crv": "P-256",
      "x": "...",
      "y": "..."
    }
  }]
}

Domain ownership proves identity. No registration, no approval, no fees.

2.3 DID Methods

For hospitality, did:web is the practical choice.

3. Verifiable Credentials (VCs)

A DID proves identity. A Verifiable Credential proves something about that identity.

3.1 Structure

{
  "@context": ["https://www.w3.org/2018/credentials/v1"],
  "type": ["VerifiableCredential", "HygieneRatingCredential"],
  "issuer": "did:web:ratings.food.gov.uk",
  "issuanceDate": "2026-01-15T00:00:00Z",
  "credentialSubject": {
    "id": "did:web:theroste.co.uk",
    "hygieneRating": 5
  },
  "proof": {
    "type": "EcdsaSecp256k1Signature2019",
    "created": "2026-01-15T00:00:00Z",
    "verificationMethod": "did:web:ratings.food.gov.uk#key-1",
    "proofPurpose": "assertionMethod",
    "jws": "eyJhbGciOiJFUzI1NksifQ..."
  }
}

The credential is cryptographically signed by the issuer. Anyone can verify it came from them.

3.2 Credential Types

4. Trust Hierarchy

Trust comes from the issuer's authority:

Government credential (FSA hygiene rating)
    ↓ highest trust
Industry credential (IATA TIDS)
    ↓
Regional authority (DMO verification)
    ↓
Established platform (verified listing)
    ↓
Self-asserted claim (needs corroboration)
    ↓ lowest trust alone

5. IATA TIDS

IATA TIDS (Travel Industry Designator Service) provides unique identifiers for travel industry entities.

{
  "type": ["VerifiableCredential", "IATARegistrationCredential"],
  "issuer": "did:web:iata.org",
  "credentialSubject": {
    "id": "did:web:theroste.co.uk",
    "tidsNumber": "12345678"
  }
}

A venue with an IATA TIDS number has been verified through an established industry process.

6. Becoming a Verifier

No permission is required to become a Curator. Authority comes from doing the work:

1. Publish a Curator Agent Card at your well-known endpoint
2. Define your coverage (geographic region, thematic focus)
3. Start verifying venues (confirm existence, capture stories)
4. Issue credentials that appear on venue evidence blocks

Authority grows through:

• Verifying more venues consistently
• Maintaining accuracy over time
• Building reputation through the mutual validation loop

A new Curator with 10 verified venues has less weight than an established DMO with 500. That's not gatekeeping; that's earned trust.

Related Specifications

• Bookable Spec — Base pattern with evidence block
• Venue Spec — Venue identity requirements
• Curator Spec — Curator verification