“Own your identity” names a real injury. Platforms assemble profiles people cannot inspect, brokers trade in predictions about them, and a lost account can sever access to work, care, worship, or family communication. Yet ownership is not a complete design brief. A person is not a database object, and identity is not a single asset waiting to be placed in a wallet. Names are used by other people, credentials are issued by institutions, and many claims arise from relationships.
The better goal is accountable control without commodifying the self. A person should be able to decide what to disclose, correct a false representation, recover from a lost key, delegate limited authority, leave a service, and obtain a remedy. An issuer should be able to stand behind a credential without owning the person who holds it. A verifier should learn only what its purpose requires. Governance should distinguish self-description, third-party attestation, and adjudicated fact. This is identity design as stewardship, not identity as property.
Identity Is Relational, So Claims Must Be Bounded
Identity has bodily, biographical, social, and institutional dimensions. A person can describe a chosen name or affiliation. A school can attest that it awarded a degree. A licensing authority can state that a qualification is valid under specified rules. A family photograph, organizational title, or parish membership may involve other people and shared practices. No one database field contains the whole person, and no individual can unilaterally rewrite every claim made in a relationship.
Begin with a minimal claim: state only what the relying party needs, identify the purpose, record the issuer and date, and preserve scope and expiry. “Over eighteen” may be enough for an age gate; a full date of birth, address, and government number are not automatically justified. “Licensed to practice in jurisdiction X until date Y” is different from an unqualified badge saying “trusted professional.” Minimality limits both disclosure and the temptation to turn a claim into a permanent reputation score.
Architecture for Non-Ownership
Pairwise identifiers
Use different identifiers for different relationships where correlation is not necessary. A hospital, parish, employer, and marketplace do not need one universal handle simply because a database can provide it. Pairwise identifiers reduce the damage from a breach and stop one verifier from silently joining unrelated contexts. They are not a complete privacy solution: a person can still be identified through distinctive attributes, behavior, or colluding verifiers. Treat them as a boundary that must be reinforced by data minimization and policy.
Selective disclosure
Present the smallest verifiable statement for the transaction. A credential wallet or equivalent agent should show the holder what will be disclosed, to whom, for what purpose, and for how long. Where appropriate, use selective-disclosure signatures or zero-knowledge proofs so a verifier can check a predicate without receiving the underlying attributes. Avoid turning every presentation into a persistent event that a provider can correlate. A mathematical proof does not make an unjustified request legitimate; governance still determines which predicates may be requested. The W3C Verifiable Credentials Data Model does not itself guarantee selective disclosure, unlinkability, or purpose limitation. Those properties depend on the securing mechanisms and presentation protocols chosen, wallet behavior, verifier policy, and the deployment that surrounds the data model.
Recovery without permanent dependence
Control that disappears with a broken phone is not meaningful control. Offer recovery through multiple trusted guardians, hardware keys, institutional re-issuance, or carefully bounded social processes. Recovery should not require one universal authority to see every credential or link every relationship. Make delay, notification, evidence, and fraud review proportionate to the stakes. Document what happens after death, incapacity, coercion, or a guardian's compromise; recovery is a governance decision, not just a cryptographic feature.
Delegation and guardianship
People routinely need another person to act for them: a parent for a child, a caregiver for an adult, an attorney for a client, or a treasurer for an association. Represent delegation as a scoped, time-limited authorization, not as transfer of the person's identity. Show the principal, delegate, powers, purpose, expiry, and audit trail. Guardianship needs heightened safeguards because dependency can become coercion. Where capacity is disputed, provide independent review and preserve the person's voice rather than treating the guardian as the sole source of truth.
Revocation and status
An issuer must be able to withdraw a credential when the underlying qualification ends, while a holder must be able to revoke a consent or delegation. Verifiers need a way to check current status without receiving a complete history of a person's presentations. Design for offline periods, key compromise, and delayed status updates. A revoked credential should not silently become a permanent accusation: distinguish expiration, administrative correction, fraud, and disciplinary action, and disclose only the status needed for the legitimate purpose.
Portability and issuer/verifier separation
The holder should be able to carry credentials between compatible wallets and services. Portability prevents a platform from becoming the owner of a person's practical access. But portability does not erase provenance. The issuer remains responsible for the assertion it made; the holder controls presentation; and the verifier decides whether the assertion meets a stated requirement. Do not let the wallet provider become a universal issuer, or the verifier become an undisclosed broker of every credential a person has ever shown.
Governance, Remedies, and Shared Claims
Standards need institutions. Specify who can register issuers, publish schemas, rotate keys, investigate abuse, change protocols, and fund maintenance. Include users, affected communities, independent experts, and accessibility advocates in governance. Publish version histories, security assumptions, conformance requirements, and conflicts of interest. A decentralized identifier does not decentralize governance if one foundation controls the registry, one vendor controls recovery, or one verifier can blacklist people without appeal.
Remedies must be designed before launch. A person needs notice when a claim is denied or a credential is revoked, access to enough evidence to correct an error, a human review channel, and a decision-maker independent of the original verifier where possible. Preserve a disputed claim and its provenance rather than overwriting history with an unexplained new value. Provide compensation or restoration when a bad match, unauthorized disclosure, or faulty revocation causes concrete harm. “The signature verified” is not an answer to a person who was misrepresented.
Some identities are shared or contested. A school issues a degree but the student can dispute a misspelled name. An organization authorizes a title but the office holder may not use it after departure. A family image implicates everyone shown. A religious or cultural affiliation may involve community recognition, not merely individual preference. Systems should mark the speaker and authority of each claim, give affected parties notice, and avoid presenting one institution's record as metaphysical truth.
Governance should also distinguish authentication from authorization. Proving that a person controls a credential does not prove that the person should enter a room, receive a benefit, publish a claim, or act for an organization. Those decisions require a stated policy and an accountable decision-maker. Likewise, an issuer's signature proves that a key signed an assertion; it does not prove that the issuer was competent, that the underlying evidence was sound, or that the assertion remains fair after circumstances change. Keep cryptographic validity, factual accuracy, legal eligibility, and moral legitimacy as separate questions. This separation makes it possible to challenge the right layer instead of treating a verified bit string as a verdict on a person.
Implementation Patterns
Claim envelopes
Store each assertion with subject, issuer, purpose, attributes, issuance time, expiry, status endpoint, schema version, and dispute contact. Keep sensitive attributes in the holder's control when the use case permits. Render a plain-language explanation beside the cryptographic fields. A verifier should be able to answer: what exactly is being asserted, by whom, under what authority, and what happens if the assertion is wrong?
Context-preserving presentation
Let the holder approve each presentation, preview recipients and retention, and receive a receipt. Bind a proof to the verifier and transaction so it cannot be replayed in another setting. Use pairwise identifiers and minimize logs. For high-risk decisions, require the verifier to state its legal or service purpose and offer a non-digital route. A person should not have to surrender a complete dossier to participate in ordinary public life.
Independent recovery and appeal
Separate key recovery from routine verification. Use threshold recovery or multiple guardians, notify the holder, and delay irreversible changes long enough to challenge an attack. Operate an appeal channel that is not controlled solely by the wallet vendor. Test recovery with people who are poor, displaced, disabled, undocumented, or offline; otherwise the system has encoded an ideal user rather than a human community.
Failure Modes
The first failure is the universal identifier: convenient for institutions, catastrophic when leaked or used to correlate worship, health, employment, and political activity. The second is disclosure theater, where a system advertises selective disclosure but a service refuses access unless every attribute is revealed. The third is issuer absolutism, in which a credential is portable but impossible to correct because the issuing institution has no accountable process.
Other failures include recovery capture by a platform, guardianship that becomes surveillance, revocation lists that expose a person's history, and portability without interoperability. A “social attestation” model may reproduce clique exclusion or pressure vulnerable people to collect endorsements. A zero-knowledge proof may protect a value while concealing a discriminatory requirement. Security tools reduce particular risks; they do not supply justice, truth, or a remedy by themselves.
Objections
“Ownership is the only language strong enough to stop platforms.”
Ownership can provide useful legal leverage for particular data, likenesses, or commercial uses. But a universal property right can be sold under economic pressure, seized, inherited, or used to make personhood a commodity. Stronger protection combines non-waivable dignity rights, purpose limitation, access and correction, portability, fiduciary duties, collective bargaining, competition, and remedies. The aim is not weaker control; it is control that cannot be traded away with the whole person attached.
“Minimal claims make fraud easier.”
Sometimes a verifier genuinely needs more evidence, and a system should not force it to accept an insufficient assertion. Minimality means proving the required fact, not pretending that every context has the same threshold. Layer assurance: stronger credentials for higher-risk actions, independent issuers, freshness checks, rate limits, and proportionate investigation. Full dossiers are not a substitute for trustworthy provenance.
Sources and Qualifications
Catholic reflection here draws on the Catechism of the Catholic Church §§355, 1700, 1731–1738, and 2414; Gaudium et Spes§§24 and 26; and the Compendium's treatment of human dignity, solidarity, and social participation. These sources do not establish a doctrine of self-sovereign identity, a property right in personal data, or a required cryptographic architecture. They ground the insistence that systems serve persons and relationships rather than reduce them to objects.
The technical references are W3C, Decentralized Identifiers (DIDs) v1.0, and W3C, Verifiable Credentials Data Model v2.0. The current NIST suite is Digital Identity GuidelinesSP 800-63-4, with SP 800-63A-4 on enrollment and identity proofing, SP 800-63B-4 on authentication and authenticator management, and SP 800-63C-4 on federation and assertions. The W3C documents define identifier and credential data models; they do not by themselves guarantee selective disclosure, unlinkability, or purpose limitation. Those properties require appropriate securing mechanisms, protocols, wallet behavior, verifier policy, and deployment. GDPR Articles 5, 12–20, and 25 provide one jurisdictional reference for minimization, access, correction, portability, and privacy by design; they are not universal law. Standards describe mechanisms, not truth, legitimacy, or remedies, and legal duties vary by jurisdiction.
The practical alternative to ownership is not trust in a wallet. It is a legal and institutional package: non-waivable dignity protections, purpose limitation, access and correction, portability, anti-discrimination, duties for entities that hold or infer claims, collective remedies, and an independent appeal. A verifier must state its purpose and offer a staffed, non-digital route; otherwise selective disclosure is only optional in theory. Test recovery and presentation with people who are offline, displaced, disabled, poor, or without documents, and measure lockout, coercion, correlation, and time to remedy. Pairwise identifiers and zero-knowledge techniques can reduce exposure, but neither proves that a person had a free choice nor supplies leverage against a service that demands a dossier.
Synthesis
Identity systems should give people practical authority without pretending that a person is an owned object. Use minimal claims, pairwise identifiers, selective disclosure, reliable recovery, scoped delegation, careful guardianship, revocation, portability, and a clear separation between issuer and verifier. Govern the registries and standards openly. Treat correction, appeal, and restoration as core functions, not customer support afterthoughts.
The goal is truthful recognition with room for freedom. Institutions may attest what they are competent and authorized to attest. Individuals may choose how to present themselves and may refuse unnecessary exposure. Communities may maintain shared practices while remaining accountable to the people within them. No wallet can contain the whole person, and no platform should be permitted to act as though it does.
Source Notes
The Council’s account of the person, dignity, participation, and social relationships that cannot be reduced to an owned data object.
A technical standard for identifier architecture and control, used with qualifications about governance and correlation.
A standard model for issuer, holder, verifier, claims, presentations, and status; it does not itself guarantee selective disclosure, unlinkability, or purpose limitation.
The current NIST suite: SP 800-63A-4 covers enrollment and identity proofing, SP 800-63B-4 authentication and authenticators, and SP 800-63C-4 federation and assertions.
A jurisdiction-specific reference for minimization, access, correction, portability, privacy by design, and automated decisions.
Editorial revision note
This essay completed one self-editing, cross-essay consistency, and strongest-criticism pass. Its controlling thesis was preserved while objections, qualifications, evidence limits, and practical consequences were strengthened.