Machine Identity

Machine identity is the general term for giving a non-human actor, a server, a piece of software, a physical device, an AI agent: a cryptographic identity of its own, one it can prove with a key it holds, separate from the identity of whatever human deployed or owns it. The underlying need is old and simple: a system that only trusts "the human who logged in" breaks the moment work starts happening without a human directly present, a scheduled job, an API-calling service, a GPU that processes requests from strangers, an autonomous agent acting on someone's behalf. All of those need their own way to prove "I am this specific thing" that doesn't depend on a person typing a password at that exact moment.

The oldest and most widespread form of this is the X.509 client certificate: a device or service holds a private key, and a certificate, signed by whoever issued it, vouches that the matching public key belongs to this identity. Every TLS-secured API call between two servers, and every mutual TLS (see mTLS) handshake between microservices, ultimately rests on some version of this. Modern cloud platforms layer their own variants on top, AWS IAM roles, Google Cloud's Workload Identity Federation, Azure Managed Identities, so a piece of code running inside their infrastructure gets a scoped, automatically-rotated identity without a human ever handling a long-lived credential for it.

Where it comes from

X.509 and the public-key-infrastructure conventions underneath it are ITU-T and IETF standards work going back to the 1990s, nobody owns it. The specific framing "machine identity" as its own named security discipline, distinct from human identity and access management, is most associated with network-security vendors; Venafi is widely credited with popularizing "machine identity management" as a market category. Every major cloud provider has since built its own workload-facing variant. Solidus originated none of this.

Solidus status

Solidus does not implement X.509 device certificates or any cloud provider's IAM workload-identity system. What it has, on testnet, is narrower and purpose-built: it issues its own did:solidus identifier, the identical identifier type a human credential-holder gets in Solidus Identity, to two kinds of non-human subject. An AI agent gets one through Solidus Agents, anchored alongside an optional ERC-8004 passport (see Agent Passport). A GPU compute-network operator node gets one through a self-certifying ComputeRegister transaction on Solidus's chain, where the registering account must cryptographically derive from the exact public key it's registering, a structural check, not a policy one, against someone registering a machine identity they don't actually control. Both are testnet-only, unaudited, and have not been used by a paying customer. Neither interoperates with an external cloud IAM system or an X.509 PKI: this is Solidus's own identifier space applied to non-human subjects, not a bridge into the standards named above.

Proof you can run yourself: an agent's live machine identity: curl https://agents.solidus.network/v1/agents/{id}/card. A compute operator's self-certifying registration check is visible in source, the ComputeRegister handler in the public solidusnetwork/protocol repository's solidus-txns crate requires the sender address to derive from the registered ed25519_pub, rejecting any registration where they don't match.