On the ninth of May we sat down to answer a question that sounds simple until you actually try to answer it for a system meant to connect dozens of others: what is an identity?
Not a philosophical identity. A practical one. If a mining cooperative, a bank doing know-your-customer checks, and a climate registry all need to talk about the same person, the same location, the same event, what exactly is the thing they are all pointing at, and what is merely the role that thing is playing in one particular conversation?
We drew one distinction that turned out to matter more than any other decision made that day: role does not belong to identity. It belongs to the assertion identity happens to appear in. The same person can be the author of one record and merely its source in another, without becoming two different people, without the system needing two different records of them. Collapse that distinction and you get a data model that has to invent a new identity every time someone plays a new role, or a role so overloaded it stops meaning anything precise. Keep it separate and identity stays clean: reusable, stable, the same underneath whichever conversation it is currently part of.
We fixed the shape of what an identity even refers to. Two kinds: a system identity, scoped to a particular tenancy, the account a person or organisation holds inside one deployment; and a data identity, scoped to the real-world entity itself, independent of which system happens to be recording it. And we fixed how registration works: the act of registering an identity is the act of linking a real-world entity to a system, and consent lives inside that act rather than as a separate checkbox bolted on afterward. You cannot register someone without their participation being the thing that created the record.
We also fixed what everything, in the end, has to be described as. Every subject any system connected to this protocol will ever need to talk about reduces to five top-level classes: a stakeholder, a location, an event, a document, an asset. Not because reality only has five kinds of things in it, obviously, but because a cross-system protocol has to draw its boundaries somewhere, and five classes, each carrying a universal structural layer beneath whatever a particular system wants to add on top, is where we drew ours. A mining cooperative's registry, a bank's KYC system, and a climate registry are describing wildly different domains. Underneath the domain-specific detail, every one of them is talking about stakeholders, locations, events, documents, assets, in some combination. That is the layer we exist to make legible across all of them.
None of this shipped as code that day. It was roughly thirty decisions, made in one sitting, about what a word means before anyone had built anything the word would apply to. That is an unusual way to build a protocol, deciding the vocabulary before the implementation, and it is deliberate: get the vocabulary wrong and every system built on top of it inherits the wrong shape permanently, because nothing that talks to a lot of other systems gets to casually rename its nouns later. Three months on, none of it has needed to move. The identity model, the role-belongs-to-the-assertion rule, the five-class taxonomy: all still standing, unchanged, underneath everything since built on top of them. That is what a sitting like that is actually for. Not speed. Not code shipped that week. A vocabulary precise enough that everything after it can simply build, instead of arguing about what the words mean.