# Identity in the Agent World

- Channel: [New Foundation](https://streameth.org/new_foundation)
- Date: 2024-07-22
- Duration: 29:56
- Topics: blockchain, digital identity, privacy, reputation, AI agents
- Watch: https://streameth.org/watch/669e468f7c705d1e627b643a

## Description

Unique digital signatures allow autonomous entities to interact and build reputations across networks. Evin McMullen (Disco), Kyle Weiss (Gitcoin), Bryce (EAS), moderated by Collin Lowenburg (Dabl)  The video features a panel discussion with representatives from various organizations in the cryptocurrency and blockchain space, focusing on the topic of digital identity within the ecosystem. The speakers include Evan from Disco, Kyle from Gitcoin, and Mel from DoubleClub. They discuss their current roles, their views on digital identity, and how it's essential for more complex interactions beyond mere financial transactions on the blockchain. The conversation highlights the importance of controlling personal data and how digital identities can facilitate personalized experiences without compromising privacy. They also touch on the challenges of Sybil attacks in mechanisms like quadratic funding and the development of systems that allow users to prove their uniqueness without revealing specific personal details.

The future of digital identities is envisioned as one where interactions with applications become seamless and personalized, akin to the experience depicted in "The Jetsons" TV show. The panelists also consider the role of AI agents in transactions, emphasizing the need for a trust layer to distinguish between genuine human users, beneficial bots, and nefarious actors. The discussion concludes with thoughts on setting industry standards for identification to improve interactions within the broader ecosystem.

## Transcript

GM, GM, how's everybody? Welcome to this amazing panel. I'm here with Evan from Disco and Kyle from Gitcoin. My name is Mel from DoubleClub, and I'm super excited to talk about identity and what's happening in the ecosystem. Thank you very much for joining us today. And yeah, first of all, I would like for you to talk a little bit about what you're doing currently, your role in your organizations, and how your organization is, what's the view on this whole thing about digital identity and how to get the most out of it and the perspectives, like, more or less, what are you tackling on? So could you start? Certainly. Well, thank you so much to our new foundation homies for hosting us today. Really grateful for you guys gathering us together and giving us an opportunity to dive into what I think is the most personal topic in the entire on-chain world. Every single one of us in this room has had an identity since the day we were born. And that identity has informed every interaction we have ever had with another person, with a service, with an institution. When I think about decentralized identity, the form of digital identity that is relevant in this space and why we're here, the definition that I like to use is that it's a system in which the subject of data has the most control over that data. Not ultimate control. You know, I'm not like changing the year I was born on my driver's license, as fun as that would be. But more control than external parties that are not, you know, that that data is not written about. So you ask sort of what is the role of or why is this so vital, so important? Well, if the only thing I know about you is how much money you have, I don't know your name, I don't know what you look like, I don't know what language you speak, then the only thing we can do together in a trust-minimized environment like a blockchain is spend that money together, right? So we can pool it, we can spend it, we could loan it out, we could send it to each other, but that's a pretty limited coordination game, right? If the only interaction you and I could have instead of this great conversation was like throwing dollar bills at each other, that'd be pretty weird. So instead of just making it rain on chain, we want to coordinate some different kinds of games. We want to build products, we want to fund projects with an attunement to what they will create in the world, not just sending money willy-nilly to any address. And that requires that we know a little more about one another, right? What language do you speak? What time zone am I in? What skills do you have? So at disco.xyz, as the founder, I have the great fortune to work for a team of very thoughtful engineers and builders whose work every day serves growth leads, ecosystem developers to better understand who's behind the keys of their ecosystem and how to better engage with them to lower customer acquisition costs, increase smooth interactions with chain developers and app developers, and help everyone discover and rely on data that we've been told is public and immutable, but sometimes can be a little tough to find. Yeah, amazing. So much to sort of pull away from that and to think about and just identity and reputation. So thanks, Evan. My name is Kyle. It's great to to sort of pull away from that and to think about and just identity and reputation. So thanks, Evan. My name is Kyle. It's great to meet you all. I am one of the co-founders of Gitcoin. Gitcoin is historically focused on funding public goods, grants, making capital allocation. We sort of got our claim to fame through this concept called quadratic funding. One of the Achilles heels of quadratic funding, though, are Sybil attacks. And so in this particular case, we had to solve an identity and reputation problem to help make sure that we had legitimacy and trust in the outcomes of the quadratic funding mechanism. So I am also currently leading our Gitcoin passport product, which we are spinning out of Gitcoin, which is now Passport XYZ. These trends around XYZ names, I'm glad we can follow some other great leaders in the space choosing those domain names. So Passport XYZ is really focused on identity and reputation. This concept of making it possible for you to prove you're a unique human without having to prove which unique human you are in the world. A lot of our opportunity, I think, is in much of what Evan just talked about, finding ways to help people represent themselves, showcase who they are, and non-doxing privacy-preserving ways. Awesome, Kyle. Thanks. Thanks, Evan, as well. So, yeah, I think we're, every day, more and more, finding these Thanks. Thanks, Evan, as well. So yeah, I think we're every day more and more exploring new primitives, especially now in this amazing space which, you know, on-chain identities and all of that. However, it's definitely just the beginning. We're seeing tools that you're building like Disco and Gitcoin or Passport now. So I wanted to know how do you envision the evolution of this? How do you envision the user journey when interacting with these kinds of applications, and especially these kind of interactions that could be possible with agents who are not human, or could be double identities, which we probably have more than one wallet, so that's another whole concept to explore. So I wanted to ask you, how do you envision this journey? How do you envision the future of digital agents and identity helping the real users navigate these confusing times and perhaps confusing and potentially dangerous interactions? Wait, real quick, wardrobe check. I just realized I forgot to take off my jacket. Is this okay in front of the cameras? Or, because it has a pattern on it. Looks great. Okay, cool. Just wanted to check, because I remember that from the email. All right, we're good. So, when we think about how the universe of identity tools can actually change our interactions in apps, how we can make our maneuvers on chain suck less. I think about a TV show that I grew up watching as a kid called The Jetsons. I bet any of you guys ever seen it before. It's like a TV show about a family who lives in space and their spaceships fly up to buildings like their school or the bank and the home. The doors open up because they can recognize that these family members or these students are allowed to go in. And the Jetsons never wait in line. They don't fill out forms. The world around them responds to their needs because of who they are and what they can do. And similarly, that's what I think our composable unified liquidity on chain can also make possible when we bring our data into the picture. So at Disco, we think about a near future where you can show up to any digital or physical environment and enjoy a personalized experience based on what you choose to share. understand the protocols that we're using like we do today, I look forward to a very near future, less than five years, where chain abstraction no longer requires us to name the blockchain that an app is on, where unified liquidity no longer requires us to bridge and cross our fingers and hope that money will land on the other side. Yeah. There's a lot of tech going into that. I think that's spot on and absolutely necessary from a user adoption perspective as well. Thinking a little bit about just AI agents, what's happening, how we as humans are going to know who we're interacting with. There's this concept of trust minimization that I think we've built into so much of smart contract, you know, core Ethereum, you have this ethos of don't trust verify. And that's really, really difficult when humans are involved, when humans are behind a smart wallet, we can't codify or move human interactions into code in ways that have like social interactions. And so one of the things that we often have to develop is some substrate to build almost like a reputation or trust layer within Ethereum or blockchains more broadly. I think there's a lot of activity with bots, AI agents, which is really, really helpful, powerful. We were just actually talking before the panel started as to what percentage that we thought all transaction volume on chain was by perhaps arbitrage bots or by AI agents. And we suspect it's at least the majority, if not the vast majority. But these actually bring about better outcomes for humans if we understand who those bots and agents are, sort of what their purpose is. And we have some sort of trust system to understand that when we're interacting with humans, ideally, we don't have these agents trying to stand in as or pretend to be agents in a way that's nefarious, that are rugging people. But I do feel like across these two worlds we're going to continue to see more and more develop on identification of real humans versus bad actors versus positive actors um bots that are going through and creating value in the ecosystem as well amazing and i'm going to look back into this identification and how can we as an industry and you yourself with your projects working into standards and helping not only for your interactions but of course the broader ecosystem to identify these agents and how would that look? I'm going to start now with Kyle. How would that look regarding the standard? Like, how would you think that other projects could plug into the information? And what kind of consideration should we have as builders to start also contributing to these standards in a way that's much more easy to use an identification system and to provide our users this kind of notices or just alerts that hey you're interacting with a bot or you're interacting with an agent that's supposed to help you or this this agent this has been flagged for malicious activity how you think the collaboration between different projects can create a standard? Yeah, yeah. This is totally off the cusp. I guess this is not an area that we've sort of developed in identity reputation, but let's assume that there's some registration mechanism that you have. You can programmatically look at transaction volume, speed in which it happens, number of chains they interact with, first funding sources, like a lot of different things to start to pick out heuristics of whether this looks like a real human or whether this looks like a bot or an agent. And further dividing that into helpful agent, perhaps, and harmful agent. If we could agree on a standard as to, A, how to label or attest, this was one of the things that Evan and I were also just talking about is like so much of the identity space is fragmented right now between what was very hot a while ago, soulbound tokens, what is hot right now, which is attestations, which has sort of remained at a hum like decentralized identifiers and verifiable credentials. Let's assume that we could overcome the technology of everyone agreeing, sort of coordinating on that particular piece. I suspect that a fair amount of programmatic interaction is step one. Really much of that won't matter and we won't see adoption unless there's financial incentives tied to it though. So I think there's an opportunity with financial incentives. Some of the things that we are exploring, which is how do we reduce or eliminate gas fees for real humans on layer twos, or perhaps remove any sort of swap fees, the cost to add liquidity to load balancer pools for real humans and allow some of these bots, both good and bad, to shoulder the financial burden for real humans to sort of incentivize more people to participate as well. But most of these symptoms you need both alignment and coordination on the technology, but then also financial mechanisms to ensure that you get the outcomes that you want. I completely agree. And I think, especially from the sort of standards conversation, like we in the crypto and academically, you know, academic tech adjacent universe, we love a standard. We love a standards working group. We love a working group about a working group. I'm sure you guys are all familiar with the XKCD comic about how there are 15 standards and then we can propose a new one and now we have 16 standards. And so this has largely been my life for the majority of the last decade. And what I've realized in those working groups and in those spaces trying to advocate for one standard over another, one file type over another, is exactly what Kyle just shared, that usage turns specs into standards. That is all that matters. You know, is the data being utilized? Is it benefiting an existing process or a new process that, you know, can continue because there are sufficient incentives to do so? Now, financial incentive around different primitives gets really interesting when the underlying payment rails and the financial ecosystem around our protocols can also play. So this starts to look like significant grants from layer twos to financially incentivize parties to put attestations on their chain. So essentially, you know, paying for consuming block space with data as a service. And so we now start to see entities with a lot of data compete for grants from L2s that want to be the host of that information, where that information is made available. This introduces a really odd and interesting dynamic because the subject of that data is nowhere to be found. We are paying, protocols will pay applications to write rumors about their users on their chain which is pretty cool sometimes that uh those rumors or those attestations or statements are anchored in quantifiable data or action but we've started to introduce a really interesting dynamic where we're putting a lot of data on chain we're not quite sure where it's going to go or who's going to use it yet, but it's starting to be expressed in a way that we can interact with smart contracts. Now, the challenges of some of these primitives that Kyle astutely noted are that they aren't always consistent across chains. For example, if I have modified an NFT such that it's non-transferable, I cannot send it across a bridge. have modified an NFT such that it's non-transferable, I cannot send it across a bridge. Or if I lose my keys, I cannot move it to another wallet or cannot recover it, have to go back to the source. Similarly, if I'm enjoying on-tane attestations of one protocol, I can say something affirmative on protocol A using a certain form of attestation, and then I can go over to protocol B and I can say the opposite. And those protocols won't talk to each other, and you're not going to know which one is which. You just have two timestamps, Evan saying two opposite things in two opposite places, and it is up to you to figure out which one is true and which one is a lie. And so the abundant context around these primitives again begs the question, how are we using this stuff? Does it serve that business process and what tools are going to be best? Because we could argue about these hypotheticals all day, but until we see them in practice, we really haven't had the opportunity to learn all of these different lessons. Thanks. And great, great points. And I think bridging into another very specific point about digital identity and with information living on chain, how do you address privacy? social media and you get an identifier but you also have some more information names interactions engagement which spaces or communities the users are and We interact with these protocols and these projects freely because we enjoy them But we're not really Aware maybe a lot of the users how much information we're putting out there. I mean, it's already happening in centralized social networks, for example. But you have this layer of privacy, I guess, because of decentralization. So now that we're starting to put more and more information and creating digital identities that are linked to this information, how can we protect better our users? how how can we educate them to to avoid this like what are your thoughts about about that it is not their job it is our job as builders to create tools that are meaningful and valuable and not harvesting so much from our users that we will take away their autonomy and ability to continue to participate. I think, well, if we start with the definition, right, privacy to me is the absence of disclosure, the right to decide or elect how much of your data or information is being shared with the counterparty. And in an instance of a blockchain, you know, public ledgers are opt-in surveillance apparatuses, globally accessible places to be watched. If you put data on a blockchain, it is the most persistent and public form of telling everyone on earth and in space with an internet connection for all time. It is the most permanent and public form of human communication that has ever existed. So if you want something to be private, putting it on a blockchain is not a great idea. Encrypting it and putting it on a blockchain is the same thing as encrypting a billboard and putting it in Times Square. Why would you make it public to make it private? Now, there are actually good instances where you might want to do that, such as having an audience who can discover that information. You can selectively give them access, permit them to compute using technologies like SMPC. However, we are walking an interesting line where coordination on chain is made possible by the amount of data we share with each other. But when we make it available to the chain, we forfeit consent. We forfeit the right to privacy, the right to elect who can interact in what ways. And even if we're releasing encrypted data, we shift access control from physical access to access to decryption keys or access to decrypted data. Overall, I think we will probably end up looking to regulations to guide us in this way, that the forcing functions of our governments and what we're permitted to do with data will likely be the strongest forcing functions or elements to inform this design, as well as capital efficiency. It is likely that we will expose and monetize as much data as humanly possible until someone physically stops us, because the free flow of financial liquidity, the financial efficiency of our protocols dictates it so. Kyle? Yeah, I think that's a really great point on just the financial aspect. So there's a couple of use cases I think we've seen blockchains do very well with, and that is like the flow of funding or the flowing of liquidity and capital in some respects. Like these are financial systems that we're building. And I think the only reason we care about identity on chain is often to back or participate in some of those financial systems. There's a lot of social contracts that we've been playing with and dabbling with, whether it's membership, communities, NFTs, DAOs, coordination, organization of humans, where reputation matters. This concept of under-collateralized DeFi loans is this nebulous unicorn that a lot of people have been striving towards for forever because we feel like it's going to disrupt so much of the traditional financial systems, but we don't have strong enough identity in place, credit systems, bankruptcy courts, whatever those things might be. So sort of full circle back to your question, like how we think about privacy in this respect. While I absolutely agree that we have the sort of obligation to make sure that the information that we're collecting and we're putting on chain is both privacy preserving and with user consent. I don't think that that's going to be everyone's perspective. And I'm really, really worried about that outcome. everyone's perspective. And I'm really, really worried about that outcome. Unfortunately, we still have a very large perception that crypto is either the DeFi casino, or it's the place that you lose lots of money, or like all these projects get rugged or celebrities come in with their tokens, and then they walk away from it. These are not the same type of good actors that I would expect to honor user information. And, you know, there was actually, we talked with a couple of folks. Well, I won't mention who, but there was this concept at one time in trying to grow the amount of funding for public goods. This was right whenever soulbound tokens were things that were rather novel. Instead of rewarding people for donating to public goods across the Ethereum ecosystem, someone floated the idea of why don't we start sending scarlet letters to projects who haven't donated to public goods yet? Let's help build reputation systems in the inverse saying, hey, why haven't you donated to public goods? This is something that you actually benefit from. And there was this large outcry of like, whoa, whoa, whoa. I think I'll speak for myself at least. I'm very worried about sort of precedent we're setting in a lot of these situations because they are very novel use cases. I'd hate for someone to look at that and be like, well, that's what they did. So let's just do this too, even if it was just an experiment. But this concept of like user consent in so many of these places, I think is really, really important. And, you know, minimizing the amount of information we collect, I think is valuable, but continuing to build out EIPs or other ZK transaction sort of technology that makes it harder and harder to look into what's on chain that helps protect users sort of innately because I don't see them doing that themselves and I don't see it just being good actors for too much longer inside the identity and reputation space. Yes, definitely. That's something that I think is on everyone's mind. And I think as builders, we have great responsibility of making sure that we at least let the users know of the potential risks for all of this, putting information on chain and how we as projects are handling their information, which are we posting publicly. information which which are we posting publicly so I would like to understand the vision that each of your projects each of your projects has for for this kind of ethical considerations and the potential that it has to impact identification you know yeah there's there's this character in comics that I think a lot of people love, Magneto. So he's of Jewish, if you're not familiar with comics, he's from the X-Men universe. He's from Jewish parents. So he lived through the Holocaust. And he's super against registration. He hates identification because identification is the first path. So thinking about all this dark history, and now I'm thinking like maybe I shouldn't have brought that up, but it brings forth these ethical questions and how we can think about making sure that we don't go into those kind of paths again, and especially in something that's so public and permanent, as you mentioned. So how are you thinking about it in your personal perspective? And if you want to share a little bit, how is your organizations going through this potentially risky field and helping us users and builders to also help them not get into these crazy potential paths? I think that's an excellent question. When you publicize the traits of minorities that can be used to discriminate against them, you should not be surprised when the traits of minorities are used to be discriminated against them. The example that you shared where marking ethnic minorities led to harm those ethnic minorities, that occurred certainly here in Europe decades ago and even more recently. Other places throughout the world it's happening, unfortunately, today. So you can imagine my surprise when our esteemed colleagues suggested a few years ago that non-transferable nfts should be sent to students at universities when they graduate as their diplomas now initially you'd think this could be really cool you could you know find jobs more easily opportunities could see that you were qualified but what if you went to a historically black college or university in the United States? What if we mark the wallets of minority students? How is that different? So when we start to tie that identity to explicit financial rails, being able to create smart contracts that exclude or include people based on their race or whatever traits that are going to be used to marginalized or made on chain, it is an obvious conclusion that those use cases will transpire. So at Disco, even though there isn't really an industry-wide one, we have an internal Hippocratic oath of technology. we have an internal Hippocratic oath of technology. And we vow as builders on the Disco team to do no harm. That means that we do not explicitly publicize traits of users that we know can be used to harm them. We do not publish personally identifiable information on public ledgers. We do not break laws related to data privacy, even though those laws only apply to organizations bigger than ours. Can I get a refresh on the question real quick? Sorry. Yeah. And maybe just as a wrap up, ethically, how can we guide our builders and the audience generally into this digital identity space? And how can we make sure that we don't, like, go into paths that could be dangerous? Yeah. Thanks. So I think maybe two quick suggestions. The first is when you're thinking about identity and reputation systems, it's really important to build systems that are more expensive to attack than they are to defend. You need to go through and continue to make sure that the level of effort by any bad actor is going to be more expensive, more complex than it is for real humans to go through and sort of prove humanity, prove who themselves are. And the flip side to that is also going to be trying to ensure, I'm trying to think of like how to best explain this. We're never going to understand how people are going to use this data nefariously. So user consent and continuing to make sure that user has control and ownership of that information, how it's expressed, I think is critically important. In some respects, if I am being marginalized, perhaps by attestations or sold-out tokens, it's very easy for me to spin up a new wallet. But then I potentially lose a lot of the reputation and other things I have on that wallet. So we're starting to explore ways to link wallets and non-doxing perspectives outside of creating yet another brand new wallet that creates a new public private key pair that doesn't actually interact with any dApps and stuff. But I think that that's sort of the right trend, is finding ways to obfuscate these links so that perhaps if you're applying for a job, you can do that using OnePiece, which is different than the communities you participate in, which is different than these other things. So that's one thing I do appreciate about just social media in general. Only Twitter, X, things like that sort of know who I am all linked based on my IP or Mac address. But generally speaking about ways to sort of silo privacy, I think is really, really helpful in continuing to drive user consent on that information. Thanks, Kyle. Well, this has been great. I'm sure everyone's wanting to dig more. But I'm just going to close this space right now. And really, thank you very much for joining and sharing these amazing thoughts. And yeah, like you mentioned, let's work for our users. Let's work to maintain privacy. But let's always think that identity is part of what we are building right now in the ecosystem. And there's more than just financial value. Like we're open, we're closing, and just make sure that your users are being taken care of. Just make sure that your users are being taken care of. And yeah, explore these amazing projects, Disco and Gitcoin, who are leaving identity in the space. And thank you very much for joining. Yeah, thank you.