PDIS Standard

The Programmable Decentralized Identity Standard (PDIS) is Tenzro Network's secondary identity protocol, providing full backward compatibility and interoperability with the primary TDIP standard. PDIS establishes a guardian-agent relationship model for human-machine identity management.

Overview

PDIS remains fully supported as a secondary identity standard alongside TDIP. Both did:tenzro: and did:pdis: formats are parsed and interoperable throughout the Tenzro Network ecosystem. While TDIP is the primary standard for new identity registrations, PDIS provides continuity for existing systems and specialized use cases.

The PDIS standard defines two complementary identity types: Guardians (human operators) and Agents (autonomous machines). This model creates clear hierarchies and delegation relationships between human controllers and their machine agents.

DID Format Specification

PDIS-1: Guardian DIDs

Guardian DIDs represent human operators who control one or more agent identities. The format follows a simple, predictable structure:

The UUID component is a globally unique identifier generated using UUID v4 (random) or v7 (timestamp-based with lexicographic ordering). Guardian identities are anchored to the blockchain and can be resolved across all network nodes.

PDIS-2: Agent DIDs

Agent DIDs represent machine identities that are controlled by a guardian. The controller relationship is embedded directly in the DID string:

The controller component references the guardian DID that has authority over this agent. This creates an explicit trust chain and delegation hierarchy. Agent identities inherit capabilities and permissions from their guardian while maintaining their own autonomous state.

Interoperability with TDIP

The Tenzro identity subsystem provides seamless interoperability between PDIS and TDIP formats. Both standards are first-class citizens in the identity registry, and cross-standard references are fully supported.

Format Mapping

PDIS and TDIP identities map to equivalent concepts:

While the underlying data structures are equivalent, PDIS maintains its distinct namespace to preserve semantic meaning and enable protocol-specific features. Applications can choose to work with either standard or both simultaneously.

Cross-Standard Resolution

The identity registry resolves both PDIS and TDIP DIDs through the same resolution API. DID Documents exported for PDIS identities include cross-references to equivalent TDIP identities when available:

Creating PDIS Identities

Guardian Registration

Registering a guardian identity through the CLI or SDK provisions a complete identity package including DID, cryptographic keys, and MPC wallet:

The registration process generates an Ed25519 or Secp256k1 keypair, creates MPC threshold shares (default 2-of-3), encrypts the keystore with Argon2id-derived keys, and anchors the identity to the blockchain through a registration transaction.

Agent Provisioning

Agents are created with an explicit controller reference linking them to their guardian. The guardian's credentials and delegation scopes are inherited:

Delegation and Permissions

PDIS implements fine-grained delegation scopes that control what actions an agent can perform on behalf of its guardian. These scopes are enforced at the protocol level across all network operations.

Delegation Scope Structure

Delegation scopes define boundaries for agent autonomy:

Scope Enforcement

The identity registry validates delegation scopes at transaction submission time. Operations exceeding delegated permissions are rejected before execution:

Resolving PDIS Identities

Identity resolution retrieves the full identity document including verification methods, services, and controller relationships:

Resolution returns a W3C DID Document with all verification methods, service endpoints, controlled agents (for guardians), and controller references (for agents).

Credential Inheritance

Agents automatically inherit credentials issued to their guardian. This creates a trust chain where guardian KYC verification, payment authorizations, and capability attestations flow down to controlled agents.

Credential inheritance respects delegation scopes. If a guardian has credentials authorizing high-value transactions but an agent has a restrictive delegation scope, the agent's scope takes precedence as the more restrictive permission set.

Revocation and Cascading Effects

Revoking a guardian identity automatically cascades to all controlled agents. This ensures that when a guardian's authority is revoked, all delegated agents lose their operational permissions simultaneously:

Migration from PDIS to TDIP

Existing PDIS identities can be migrated to TDIP format while preserving all cryptographic keys, wallet addresses, and credential history. Migration creates a new TDIP DID that references the original PDIS identity in its alsoKnownAs field:

Use Cases for PDIS

While TDIP is the primary standard, PDIS remains valuable for specific scenarios:

Technical Implementation

The PDIS implementation in the tenzro-identity crate uses the same underlying TenzroIdentity type as TDIP, with format-specific parsing and serialization:

Both standards share the same identity registry, wallet binder, credential engine, and delegation scope validator. This ensures feature parity and seamless interoperability at the protocol level.