Anonymous credentials seem neat! I think there's also some interesting work going on with AAuth[0] and SPIFFE[1]
The issue is less in the identity of the agent and more in that:
1. We need to get users and companies used to issuing and using these credentials.
2. The systems agents are interacting with need to recognize these credentials.
3. Critically, the systems need to be able to limit the actions of the credential holders.
The last one, #3, is probably the doozie because it requires all kinds of rethinking of authorization models. Which tend to be baked into applications and tied to business logic.
Anonymous Credentials seems like a good answer from what I have read
https://blog.cloudflare.com/private-rate-limiting/
https://eprint.iacr.org/2024/2010
https://blog.cryptographyengineering.com/2026/03/02/anonymou...
Anonymous credentials seem neat! I think there's also some interesting work going on with AAuth[0] and SPIFFE[1]
The issue is less in the identity of the agent and more in that:
1. We need to get users and companies used to issuing and using these credentials.
2. The systems agents are interacting with need to recognize these credentials.
3. Critically, the systems need to be able to limit the actions of the credential holders.
The last one, #3, is probably the doozie because it requires all kinds of rethinking of authorization models. Which tend to be baked into applications and tied to business logic.
0: https://www.aauth.dev/
1: https://spiffe.io/
ah yea, spiffe
ACs are useless unless we get the receiving end with sufficient RBAC like things, totally!
[dead]