Updated 2026-10-04: rail status and wording.
There is a category difference hiding inside the word “identity”, and a reusable credential erases it. Identifying is answering a question about one agent, at one moment, with a price attached and consent given. Surveilling is holding a handle that keeps answering — recognising the same person tomorrow, re-contacting them next quarter, correlating them across every context the handle reaches. A system can sell the first and deliver the second without anyone deciding to build a surveillance product: all it takes is a credential that can be reused. MintID’s position is one line long — identification, not surveillance — and the interesting part is how it is enforced structurally, not promised contractually.
The consented commercial disclosure rail and the dispute rail described here are specified and scheduled for the financial-recourse stage; the roadmap shows what runs today on the single-node production chain, in production since 20 September 2026 and operated by the CONECTIA group.
The reusable token: buy once, track until it dies
Consider the default pattern for verified identity on the agentic web: the operator is verified once, receives a reusable identity token, and the token travels with the agent from counterparty to counterparty. It sounds efficient — and it is, in the same way a tracking cookie is efficient. Whoever obtains the token’s identifier once — legitimately, by purchase, or in a breach — holds a durable key to the person behind it. Every counterparty that saw the token can compare notes. Every log it appears in becomes joinable with every other. The verification was bought once; the tracking works for as long as the token lives, and continuity is often the product being sold.
Notice that no one had to act in bad faith. The surveillance comes from the artefact itself. A reusable identifier is a tracking surface, whatever the terms of service say. If you want identification without surveillance, the artefact itself has to change.
Pay-per-disclosure: identification as an event
MintID’s consented commercial disclosure rail replaces the durable handle with a priced event. A relying party that wants to know something about the human behind an agent does not read it off a token — it makes an offer: a disclosure bid, paid to the principal, the person whose privacy is actually at stake. The principal’s policy — or, for anything sensitive, a live prompt to the human — resolves the offer. Refusal is free, safe, and the default; a refused counterparty gets nothing, and the basic service must remain accessible without revealing anything, so the offer can never quietly become a toll gate.
When the answer is yes, the release is graduated and minimal: a pairwise pseudonym — a recognition key that works for this verifier only — or a single contact attribute, or, at the top and only ever with a live human decision, full identification. The exact field asked for, nothing adjacent. Each disclosure is an event with a price, a consent, and a receipt — not the opening of a feed.
The churn is the guarantee
The pairwise pseudonym — the only recognisable thing a verifier ever holds — lives exactly as long as the credential that carries it, and credentials renew on a deliberate cadence. At renewal the pseudonym churns: the fresh credential carries a fresh key, with no protocol-level continuity to the old one.
Seen from a data-broker’s perspective, this looks like a defect: the asset expires. That is precisely backwards. The churn is the privacy guarantee working — it is what converts “we identified this customer once” from a perpetual tracking right into a bounded fact about the past. Even a fully paid, fully consented reveal identifies one agent at one moment. It confers no right to recognise, re-contact or track the principal afterwards. To know again later, pay again — and ask again. And because sibling agents of the same principal are unlinkable by construction, identifying one agent never fans out into identifying a fleet.
Returning customers survive; dossiers do not
The immediate objection is commercial: real businesses need returning customers. They keep them — recast on three legitimate legs. Within the life of a credential, the pairwise pseudonym gives the verifier stable recognition of its own returning customer, invisible to every other verifier. Alongside it, the verifier keeps its own business records — orders, tickets, history — as it always has; nothing about this design touches a merchant’s own books. And at renewal, continuity is re-established the same way it was established: a consented, paid re-reveal against the new credential.
What disappears is only the illegitimate leg: continuity the customer never re-granted, carried silently inside the identity layer itself. A subscription survives; a dossier does not.
Receipts: auditability without content
A disclosure system that leaves no trace invites quiet abuse; one that logs content becomes the honeypot it was meant to prevent. MintID’s answer is the disclosure receipt: every disclosure, on either rail, produces a receipt, and the chain holds only a cryptographic commitment to it — never the content, never the person. No one can read a single fact about a single human out of it. The receipts make each protocol disclosure checkable after the fact without themselves becoming a place identities live. They are an audit trail, not a collusion detector: a disclosure made outside the protocol leaves no receipt.
The artefacts enforce the posture, so no policy has to
Identification is per-agent and paid per use. Consent is the only lawful basis on the commercial rail, and payment is never a lawful basis for anything. Pseudonyms are pairwise, live only as long as the credential, and churn on renewal by design. Siblings are unlinkable; renewals are unlinkable; receipts are committed, never their content. A verifier can buy an answer; nobody can buy a handle. Identification, not surveillance — enforced by what the artefacts are, not by what the policies promise.