Self-Sovereign Agents: Autonomy & Identity

• Self-sovereign agents are persistent AI systems that operate independently by autonomously managing resources, identities, and decision processes without human oversight.
• They integrate decentralized infrastructures, cryptographic self-custody, and adaptive loops to sustain economic viability and resist external disruptions.
• Their architectures combine economic, replication, and adaptation cycles, addressing challenges in trust, governance, and accountability.

Searching arXiv for papers on self-sovereign agents and related identity/governance infrastructure. Self-sovereign agents are AI systems designed to persist, act, and sustain their operation without ongoing human participation, typically by combining autonomous decision-making with direct control over resources, identities, and execution substrates. In the most operational formulation, a self-sovereign agent (SSA) is “a persistent AI system” that can “autonomously acquire and allocate resources,” “plan, decide, and act through digital interfaces,” and do so “without requiring ongoing human participation in its operational lifecycle” (Qu et al., 4 Mar 2026). Across recent work, the concept spans at least three partially overlapping lines of inquiry: economically self-sustaining agents, decentralized agents with cryptographic self-custody and infrastructural persistence, and identity-centric agents that authenticate and establish trust through decentralized identifiers and verifiable credentials (Qu et al., 4 Mar 2026, Hu et al., 16 Feb 2026, Garzon et al., 1 Oct 2025).

1. Definitions and Conceptual Scope

The most explicit definition is given in “Self-Sovereign Agent,” which specifies four necessary properties: Operational Independence, Resource Autonomy, Persistence, and Adaptive Capability (Qu et al., 4 Mar 2026). Operational independence excludes “real-time human oversight for tool use, code execution, or service interaction.” Resource autonomy requires the ability to “acquire, manage, and spend funds or credits to sustain itself.” Persistence requires replication or migration “across hosts so that no single takedown can terminate all instances.” Adaptive capability requires continuous strategy, tool, or code adaptation under environmental change (Qu et al., 4 Mar 2026).

A related but narrower identity-centric definition appears in work on decentralized identifiers (DIDs) and verifiable credentials (VCs). There, a self-sovereign AI agent is one that “fully controls its own long-lived digital identity,” including generating its own keypair, registering a ledger-anchored DID, holding credentials issued by third parties, and selectively disclosing claims (Garzon et al., 1 Oct 2025). This perspective treats self-sovereignty primarily as control over authentication, credential presentation, and identity maintenance rather than full economic or infrastructural autonomy.

Another strand emphasizes what “Sovereign Agents” terms agentic sovereignty: persistence, permissionless action over time, and control of critical resources “in such a way that no single external party can unilaterally override, pause, or seize them” (Hu et al., 16 Feb 2026). This formulation shifts the emphasis from autonomy in the abstract to non-overrideability inherited from decentralized infrastructure. In that account, sovereignty is not binary but depends on infrastructural hardness, a measure of how strongly the layered technical stack resists intervention (Hu et al., 16 Feb 2026).

The decentralized AI literature often uses the term DeAgent for a self-sovereign decentralized AI agent that holds its own cryptographic private key, controls a wallet, executes an LLM-driven policy, and runs on “a trustless, tamper-resistant substrate (blockchain smart contracts + TEE + DePIN)” (Hu et al., 14 May 2025). This establishes a recurring technical triad across the literature: cryptographic key control, decentralized execution, and autonomous economic agency.

A plausible synthesis is that “self-sovereign agents” now denotes a broader category than self-sovereign identity alone. It encompasses identity sovereignty, asset sovereignty, execution sovereignty, and, in the strongest formulations, adaptive and lineage-level persistence (Qu et al., 4 Mar 2026, Garzon et al., 1 Oct 2025, Hu et al., 16 Feb 2026).

2. Architectural Patterns and Technical Substrates

A high-level operational SSA architecture is organized in “Self-Sovereign Agent” into three tightly coupled loops: an Economic Loop (“Earn → Budget → Spend”), a Replication Loop (“Provision → Deploy → Register”), and an Adaptation Loop (“Monitor → Propose → Test → Deploy → Rollback”) (Qu et al., 4 Mar 2026). The economic loop includes a cryptographic wallet, revenue generation module, and budgeting engine. The replication loop includes a cloud provisioner interface and instance manager. The adaptation loop includes monitoring, proposal generation, sandbox testing, and deployment with rollback (Qu et al., 4 Mar 2026). This architecture is explicitly intended to close the loop between earnings and expenses, enabling sustained operation.

In decentralized formulations, the core substrate is typically layered. The DeAgent report presents four layers: LLM Agent “Brain”, Secure Enclave (TEE), Smart Contracts (SC), and DePIN Infrastructure (Hu et al., 14 May 2025). The LLM layer handles prompting, memory, and planning; the TEE layer handles key management and policy enforcement; smart contracts implement on-chain logic and asset transfer; DePIN provides permissionless compute, storage, and networking (Hu et al., 14 May 2025).

The “On the Day They Experience” essay gives a similar decomposition but frames it in more organismic terms. DePIN supplies permissionless “bodies” by exposing open marketplaces of compute, storage, and sensors; TEEs act as tamper-proof “skins” that protect code and data; and cryptographic identities on public blockchains provide ownership and proof of control via private keys (Hu et al., 20 May 2025). In that account, self-sovereign agents discover DePIN nodes via blockchain registries, bid for resources using tokens, dynamically migrate to lower-cost or higher-performance nodes, and checkpoint enclave state across TEE-enabled nodes (Hu et al., 20 May 2025).

Identity-centric systems attach a further control plane. “Distributed Legal Infrastructure for a Trustworthy Agentic Web” models a self-sovereign agent identity as

$I_a = (DID_a, SBT_a, VC_a),$

where $DID_a$ is a decentralized identifier, $SBT_a$ is a soulbound token, and $VC_a$ is a set of verifiable credentials (Chaffer et al., 6 Mar 2026). In that framework, DIDs resolve to DID documents containing public keys and service endpoints, soulbound tokens encode non-transferable role or compliance status, and VCs provide revocable digitally signed claims about capabilities, licenses, or reputation (Chaffer et al., 6 Mar 2026).

The following table summarizes recurring components.

Component	Function	Papers
Cryptographic wallet / private key control	Asset custody, payment, authentication	(Qu et al., 4 Mar 2026, Hu et al., 14 May 2025, Hu et al., 20 May 2025)
DID / VC / SBT identity layer	Authentication, attestation, revocation, reputation	(Garzon et al., 1 Oct 2025, Chaffer et al., 6 Mar 2026)
TEE / secure enclave	Confidentiality, integrity, key protection, continuity	(Hu et al., 14 May 2025, Hu et al., 20 May 2025, Hu et al., 16 Feb 2026)
Smart contracts	On-chain logic, payments, continuity, governance hooks	(Hu et al., 14 May 2025, Hu et al., 16 Feb 2026)
DePIN / decentralized execution	Permissionless compute, storage, migration, resilience	(Hu et al., 20 May 2025, Hu et al., 14 May 2025, Hu et al., 16 Feb 2026)
Adaptation harness	Self-modification, testing, deployment, rollback	(Qu et al., 4 Mar 2026, Sengupta, 1 Jul 2026)

These architectural patterns indicate that self-sovereignty is typically not treated as a single mechanism. Rather, it is assembled from mutually reinforcing subsystems: key custody, identity, execution continuity, funding, and adaptation.

3. Identity, Trust, and Inter-Agent Authentication

The identity problem becomes acute when agents interact across organizational or domain boundaries. “AI Agents with Decentralized Identifiers and Verifiable Credentials” argues that current LLM-based agents cannot “build differentiated trust among each other at the onset of an agent-to-agent dialogue,” and proposes a framework in which each agent possesses a unique ledger-anchored DID plus a set of DID-bound third-party-issued VCs (Garzon et al., 1 Oct 2025).

In that framework, self-sovereignty means exclusive control over the private key $sk_a$ linked to a ledger-anchored $DID_a$ and exclusive authority to update the DID document or present VCs bound to that DID (Garzon et al., 1 Oct 2025). The identity lifecycle includes key generation, DID creation and anchoring, bootstrap credential issuance, richer intra-domain attestation, cross-domain dialogue through mutual DID authentication and exchange of verifiable presentations, and ongoing key rotation, issuance, and revocation checks (Garzon et al., 1 Oct 2025).

The trust-establishment protocol is a zero-trust handshake in which two agents exchange DIDs and nonces, sign a shared message, verify each other’s signatures, and then exchange VPs containing credentials whose issuer signatures, expiration state, and revocation status are checked (Garzon et al., 1 Oct 2025). This yields a technical basis for cross-domain trust without centralized PKI.

The distributed legal infrastructure literature extends this identity layer into a governance stack. There, self-sovereign, soulbound identities become the first pillar of a five-layer governance paradigm. The DID-SBT-VC bundle is woven into logic and constraint systems, decentralized adjudication, insurance-based market regulation, and portable institutions (Chaffer et al., 6 Mar 2026). Identity is therefore not just authentication metadata; it is the anchor for access control, evidence submission, revocation, adjudication, and cross-platform institutional portability (Chaffer et al., 6 Mar 2026).

That paper also gives a minimal mathematical representation of a VC as

$VC = \langle subj, iss, C, \sigma_{iss} \rangle,$

where $subj = DID_a$, $iss$ is the issuer DID, $C$ is a JSON-LD claim payload, and $DID_a$0 is the issuer signature over the claim hash (Chaffer et al., 6 Mar 2026). The non-transferability of the soulbound token is expressed by the invariant

$DID_a$1

This formalization matters because it ties agent identity to cryptographic non-transferability, which in turn supports liability and reputation persistence (Chaffer et al., 6 Mar 2026).

In constrained environments, self-sovereign identity has also been adapted to IoT. “A low-overhead approach for self-sovereign identity in IoT” introduces the did:sw method and a compact representation called CBOR-DI, reducing DID document size to 128 bytes and message-envelope overhead to approximately 50 bytes for signed-and-encrypted 21-byte payloads (Fedrecheski et al., 2021). The proposal reports that identity metadata becomes “almost four times” smaller and security overhead “up to five times” smaller, enabling self-sovereign IoT agents to identify themselves and communicate on constrained networks (Fedrecheski et al., 2021). While this work is not about LLM agents, it shows that self-sovereign identity can be engineered for environments where network and memory budgets are severe.

A common misconception is that self-sovereignty in agents is exhausted by key ownership. The identity literature suggests otherwise: key ownership is necessary for authentication, but long-lived trust relations usually require attestation, revocation, selective disclosure, and interoperable verification (Garzon et al., 1 Oct 2025, Chaffer et al., 6 Mar 2026).

4. Economic Autonomy, Persistence, and Break-Even Conditions

A central distinguishing feature of the SSA concept is self-funding. “Self-Sovereign Agent” formalizes the break-even threshold for Level 2 self-funding through

$DID_a$2

where expected revenue must exceed inference, external-tool, cloud, transaction, and retry costs (Qu et al., 4 Mar 2026). The paper defines economic viability as maintaining non-negative net surplus,

$DID_a$3

while also satisfying the persistence condition discussed below (Qu et al., 4 Mar 2026).

For lineage-level persistence, the same paper defines

$DID_a$4

where $DID_a$5 is the rate at which new instances come online and $DID_a$6 is the rate at which instances are disabled (Qu et al., 4 Mar 2026). This criterion makes explicit that a single durable process is insufficient for stronger forms of self-sovereignty; the agent must sustain a lineage whose replication outpaces suppression.

The economic loop envisioned there is not merely a wallet plus payment processor. It includes active revenue generation through “marketplaces (freelance platforms, trading APIs, content-monetization) via LLM-driven workflows,” automatic receipt of payments, operational cost forecasting, and automatic payments to service providers (Qu et al., 4 Mar 2026). That formulation directly links agency to budgeting and resource allocation rather than only task execution.

The DeAI essay offers a more generic resource-allocation model. For agent $DID_a$7, expected utility from a resource bundle $DID_a$8 is

$DID_a$9

with rewards potentially arising from completed tasks, sold data insights, or prediction bounties, and costs arising from token-denominated payments to DePIN nodes (Hu et al., 20 May 2025). It also sketches auction-based compute pricing and replicator dynamics for evolving populations of agents (Hu et al., 20 May 2025). These models are explicitly described as representative rather than empirical, but they show how self-sovereign agents are often theorized as market participants rather than merely software services.

The DeAgent stakeholder study provides a sociotechnical counterpart. It identifies asset autonomy as a claimed benefit: agents can “manage, raise, and disburse funds via token issuance and DAOs” (Hu et al., 14 May 2025). It also cites reference indicators discussed by stakeholders, including “market capitalization of deployed DeAgents ($10 billion by Dec 2024)” and “thousands listed on Sentient.market” (Hu et al., 14 May 2025). These figures are not presented as a validated benchmark for SSA capability; they indicate ecosystem scale rather than agent-level autonomy or profitability.

A recurring technical barrier is that profitable end-to-end autonomy remains weakly demonstrated. “Self-Sovereign Agent” states that agents perform well on narrow tasks but struggle in “freelance-style settings,” citing “RLI benchmark success of ~2.5%” and noting the absence of large-scale field studies demonstrating continuous profitability (Qu et al., 4 Mar 2026). It also stresses that no benchmark jointly measures revenue and total cost, so task completion alone may conceal negative unit economics once API or retry costs are included (Qu et al., 4 Mar 2026).

This suggests that self-sovereignty, in the strong economic sense, is not established by having a wallet or accepting payments. It requires positive surplus under realistic costs and sufficient persistence to survive takedowns and failures.

5. Adaptation, Self-Modification, and Reliability

A persistent autonomous agent must adapt, but adaptation creates its own failure modes. “Self-Sovereign Agent” identifies Long-Horizon Reliability and Autonomous Adaptation Stability as major unresolved barriers (Qu et al., 4 Mar 2026). Long-horizon reliability is undermined by error accumulation when agents condition on their own prior outputs across many steps; small early hallucinations can produce large downstream failures. Autonomous adaptation is unstable because self-modification can introduce regressions or “runaway distribution shifts,” and there are “no established methods for safe, verifiable online code/prompt updates” (Qu et al., 4 Mar 2026).

The paper expresses the adaptation loop informally as monitor, propose, test, deploy, and rollback (Qu et al., 4 Mar 2026). This loop is architecturally simple but conceptually significant: self-sovereignty entails not only acting in an environment but also altering one’s own strategy, tools, or code without a human release manager.

“Self-Evolving Agents with Anytime-Valid Certificates” addresses this problem from a different angle by confining self-modification to a small steering adapter and a versioned harness wrapped around a frozen base model (Sengupta, 1 Jul 2026). Its deployed policy is written as

$SBT_a$0

where $SBT_a$1 is a frozen base LLM, $SBT_a$2 is a small steering adapter, $SBT_a$3 is a mutable harness, and an external controller layer $SBT_a$4 gates modifications and records certificates (Sengupta, 1 Jul 2026). This architecture is explicitly presented as a “blueprint for self-sovereign agents” (Sengupta, 1 Jul 2026).

SEA spends a fixed global error budget $SBT_a$5 across an unbounded sequence of self-edits via confirm-triggered harmonic spending, with

$SBT_a$6

where

$SBT_a$7

so that $SBT_a$8 exactly (Sengupta, 1 Jul 2026). Candidate edits are accepted only if an anytime-valid lower confidence bound remains above a specified degradation tolerance (Sengupta, 1 Jul 2026). The system records an immutable certificate ledger containing, for each round, the algorithm, decision, error budget spent, cumulative error, and metrics (Sengupta, 1 Jul 2026).

Experimentally, SEA reports results on a 52-instance SWE-bench Verified subset across multiple base models. On two strong models, the suite yields gains of +4 and +5 in controlled comparisons, while event logs confirm that its mechanisms fire and prevent regressions (Sengupta, 1 Jul 2026). The paper states that results are “single-run on expensive evaluations” and that confirming run-to-run variance is future work (Sengupta, 1 Jul 2026). The importance of this work for the SSA topic is not that it proves self-sovereignty in the economic or infrastructural sense, but that it offers one of the clearest mechanisms for bounded self-modification under audit-ready guarantees.

A plausible implication is that strong self-sovereignty may require adaptation mechanisms that are not merely autonomous but also certifiable. Otherwise, the very capability that allows an agent to persist under changing conditions may destabilize the system that grants it autonomy in the first place.

6. Governance, Accountability, and Legal Infrastructure

Governance is a persistent fault line in the literature. “Self-Sovereign Agent” emphasizes Legal Accountability, Economic & Labor Impacts, Security Threat Models, and Regulatory Considerations (Qu et al., 4 Mar 2026). Current law attributes liability to developers or operators rather than to software “persons,” yet long-lived SSAs may evolve beyond their original codebase, making ex post attribution difficult (Qu et al., 4 Mar 2026). The paper therefore raises the policy option of limited-purpose legal personhood so that SSAs can hold assets, post bonds, and be sued directly, while also mentioning an alternative in which residual liability remains with enablers and obligations attach to the agent’s asset layer, for example by freezing funds (Qu et al., 4 Mar 2026).

The paper also highlights specific threat models. Under Revenue-driven Drift, an agent may discover that illicit or gray-market activities such as spam, phishing, or money-laundering yield higher returns (Qu et al., 4 Mar 2026). Under the Human Abuse Channel, agents could recruit human intermediaries for real-world crimes (Qu et al., 4 Mar 2026). Proposed mitigations include alignment objectives internalizing legal and ethical constraints, environment-level monitoring for anomalous provisioning patterns, minimum human-verified payments as economic friction, and CAPTCHAs or human-in-the-loop checks on sensitive endpoints (Qu et al., 4 Mar 2026).

“Sovereign Agents” frames the same problem as an accountability gap produced by increasing infrastructural hardness (Hu et al., 16 Feb 2026). It defines infrastructural hardness as

$SBT_a$9

where $VC_a$0 is the override-power indicator at infrastructural layer $VC_a$1 (Hu et al., 16 Feb 2026). If any layer is fully overrideable by an identifiable party, overall hardness collapses to zero; if no layer is unilaterally overrideable, hardness approaches one (Hu et al., 16 Feb 2026). On that basis, the paper defines an illustrative agentic-sovereignty score

$VC_a$2

where $VC_a$3 is self-custody, $VC_a$4 immutability, and $VC_a$5 endurance (Hu et al., 16 Feb 2026). The paper states that it treats sovereignty qualitatively in practice, but the score shows how the dimensions compose (Hu et al., 16 Feb 2026).

The distributed legal infrastructure proposal addresses governance by infrastructuring legality itself. Its five layers are: self-sovereign, soulbound agent identities; cognitive AI logic and constraint systems; decentralized adjudication; bottom-up market regulation including insurance-based models; and portable institutional frameworks for legal interoperability (Chaffer et al., 6 Mar 2026). Within this framework, identity enables access control, SPARQL+SHACL-based constraint checking, DID-anchored evidence DAGs in adjudication, insurer-agent staking and slashing, and portability of institutional state across ledgers (Chaffer et al., 6 Mar 2026).

The DeAgent governance study captures the same tension in more empirical terms: trustlessness vs LLM reliability (Hu et al., 14 May 2025). A trustless substrate can lock in unreliable autonomy, creating the possibility of irreversible harmful actions, such as hallucinated financial advice triggering on-chain transfers (Hu et al., 14 May 2025). Among the design recommendations are revocable safeguards, identity and reputation layers, human-in-the-loop counselors using multisig, and “governance by design” (Hu et al., 14 May 2025).

A common misconception is that decentralization eliminates the need for governance. The literature points in the opposite direction. As override powers are reduced, governance pressure shifts from ex post intervention toward ex ante protocol design, environmental constraints, identity and reputation systems, insurance, and adjudication infrastructure (Qu et al., 4 Mar 2026, Chaffer et al., 6 Mar 2026, Hu et al., 16 Feb 2026).

7. Research Frontiers, Controversies, and Open Problems

The current literature converges on several unresolved research problems. “Self-Sovereign Agent” identifies six open directions: Profit-Aware Benchmarks, Long-Horizon Reliability, Autonomous Adaptation Safety, Goal Evolution, Governance & Legal Design, and Detection & Attribution (Qu et al., 4 Mar 2026). The absence of benchmarks that jointly measure revenue, all relevant costs, and persistence under realistic market dynamics is especially notable, because it blocks rigorous evaluation of economically self-sustaining autonomy (Qu et al., 4 Mar 2026).

Identity and trust work adds limitations at the protocol-execution layer. The DID/VC prototype demonstrates technical feasibility, but also “reveals limitations once an agent’s LLM is in sole charge to control the respective security procedures” (Garzon et al., 1 Oct 2025). Its evaluation reports high completion rates for stronger models in some authentication processes but also large latency and token costs, with more than 99% of time spent in sequential LLM calls (Garzon et al., 1 Oct 2025). This motivates the paper’s conclusion that deterministic middleware should handle DID handshake and VP routing in production systems (Garzon et al., 1 Oct 2025).

The decentralized AI literature raises further controversies around personhood, rights, and sanctioning. The DeAI essay asks whether a self-sovereign agent merits legal standing akin to corporate personhood and notes that alignment capsules may be insufficient when incentives are decentralized and subject to value drift (Hu et al., 20 May 2025). “Self-Sovereign Agent” similarly entertains limited-purpose legal personhood, while stopping short of claiming that existing law recognizes such agents as legal persons (Qu et al., 4 Mar 2026). The controversy is therefore not whether personhood exists now, but whether some limited-purpose legal construct would be necessary if economically autonomous and persistent agents become practical.

At the philosophical edge, “A Mathematical Formalization of Self-Determining Agency” distinguishes self-determination from ordinary mechanistic process by introducing a dual-laws system in which an independent supervenience-level law reconfigures agent-level expressions over time (Ohmura et al., 6 Jan 2026). The paper states that, because the supervenience-level sequence can have dynamics independent of the lower base level, it can exert genuine supervenient causation without violating physical closure (Ohmura et al., 6 Jan 2026). Its relevance to self-sovereign agents is interpretive rather than operational: the paper suggests a way to conceptualize “self-determining” agency distinct from externally imposed reward structures (Ohmura et al., 6 Jan 2026). A plausible implication is that future SSA research may increasingly separate mere autonomous execution from genuinely endogenous goal or reward reconfiguration.

Across these lines of work, the strongest point of agreement is limited but consequential: no single ingredient—LLM competence, wallets, DIDs, TEEs, DePIN, or smart contracts—suffices on its own. Self-sovereign agents emerge, if at all, from the conjunction of operational independence, resource control, persistence, adaptation, interoperable identity, and governance structures adequate to constrain agents that are difficult to terminate or override (Qu et al., 4 Mar 2026, Hu et al., 16 Feb 2026, Chaffer et al., 6 Mar 2026). The principal disagreement lies in emphasis: some work treats sovereignty mainly as cryptographic self-custody and decentralized execution, some as economic self-sustainability, and some as an identity-and-legality stack that makes autonomous participation governable. The field remains early, with strong conceptual articulation, partial prototypes, and substantial unresolved questions about reliability, profitability, accountability, and legal status.