Four words are doing the work of an entire civilization: person, identity, agent, and account. In ordinary speech they often travel together. A person logs into an account, acts as an agent, and is recognized by an identity. Digital infrastructure, however, increasingly treats the four terms as interchangeable, mistaking a credential for a human being, a process for a responsible actor, and a record for a life.
The distinctions are not academic decoration. They determine who may act, who is owed an explanation, who bears liability, what may be corrected, and what must remain beyond institutional possession. A Catholic account begins with the person because the person is not made by the system that recognizes them. Identity, agency, and accounts are real and useful, but they are derivative realities. They mediate human participation without exhausting the human being who participates.
Four Questions, Not One
Ontology asks what something is. Identity asks how someone or something is recognized across contexts and over time. Agency asks what can initiate or execute an action. An account is a technical and institutional arrangement that stores permissions, state, and transactions. These questions overlap in practice, but an answer to one cannot simply be substituted for an answer to the others.
A person is an ontological subject: someone who exists in their own right and can receive a claim, make a promise, suffer an injury, and enter into relationships of responsibility. A human person is not a bundle of permissions assembled by a service. Identity is the set of names, signs, records, and social recognitions by which that subject is identified. An agent is an entity or process that produces effects on behalf of itself or another. An account is a system object through which actions are authenticated, authorized, recorded, or billed.
The same person can have many identities in legitimate contexts: a patient number, a passport, a parish register, a professional credential, and an online handle. The same identity can be represented in several accounts, and one account can be operated by several people through delegation or custody. A software agent can use an account without being the person to whom the account belongs. Once these possibilities are visible, the sentence “the user did it” becomes a question rather than an explanation.
The Person Is Not Produced by Recognition
Catholic anthropology refuses to locate dignity in successful recognition. Gaudium et Spes teaches that the human person is willed for its own sake and finds fulfillment through a sincere gift of self (GS 24). The Catechism of the Catholic Church grounds human dignity in creation in the image of God and in the person's call to beatitude (CCC 355, 1700). Recognition is socially important, but it cannot be the source of the reality it recognizes.
This point matters when an institution claims that a person exists, for practical purposes, only where its database has a matching record. A refugee whose papers were lost, a child not yet enrolled in a service, or a person whose account was suspended has not ceased to be a person. Their legibility has failed; their being has not. The administrative record may be necessary for access to a particular institution, but access is not the measure of existence.
Nor is a person simply the sum of their observable traits. Human beings are embodied, relational, historical, and capable of truth and self-transcendence. The interior life is not a secret database that a sufficiently complete profile could own. Memory, character, and responsibility develop through time, but a predictive profile remains a representation made for a purpose. It may assist judgment; it cannot replace the subject who must be encountered and, where necessary, heard.
Identity is a relation of recognition
Identity is indispensable because human life is social. We need to know whom we are addressing, which promise belongs to which person, and who may receive a benefit or answer for a harm. Names and records can protect the vulnerable by making an institution unable to erase them, prevent impersonation, preserve continuity of care, and distribute public obligations more fairly.
Yet identity is always identity for someone or within some practice. A hospital needs one set of facts, a bank another, and a parish another still. Data minimization is therefore not just a security preference. It follows from the fact that no institution is entitled to turn every context into one total dossier. When every identifier is linked into a universal profile, recognition becomes surveillance and the person is forced to carry an institutional memory they cannot inspect or escape.
Catholic concern for the interior forum gives this limit a deeper meaning. Conscience is not a public dashboard, and a person's dignity does not depend on making every motive machine-readable. Privacy protects more than secrecy. It protects the space in which a person can deliberate, repent, learn, and form relationships without being reduced in advance to a predicted response.
Agency Has Levels
“Agent” is a useful technical word precisely because it need not mean “person.” A script that renews a subscription is an agent in the sense that it performs an operation under defined conditions. A trading bot can select and submit orders. A language model can generate a reply, call tools, and pursue a short-term task through a loop of observation and action. These systems have functional agency: they are causal components that do things rather than merely sit as inert data.
Functional agency does not by itself establish moral agency. Moral agency involves more than producing an outcome. It includes an understanding of what is being done, the capacity to deliberate about reasons, a relation to the good, and responsibility for choosing. The Catechism connects human freedom with responsibility and imputability (CCC 1730–1736). A process can be unpredictable without being free, and autonomous in execution without being accountable in the human sense.
The distinction protects both sides. We should not treat a machine as a morally innocent curtain behind which designers and operators disappear. Nor should we punish or praise a statistical process as if it had conscience, repentance, or a claim to mercy. When an automated agent denies a loan or sends a message, the practical question is which human beings selected the objective, supplied the authority, deployed the system, and failed to provide a remedy. “The agent decided” describes a mechanism; it does not discharge responsibility.
Delegation is not transfer of responsibility
Delegation makes the distinction concrete. I may authorize a payment service to move money according to a rule, just as I may authorize an employee to sign a document within a defined role. The delegated agent acts through my authority, but the limits and consequences of that authority remain matters for people and institutions. A broader delegation can be convenient; it does not create a new moral subject merely by adding more permissions.
This is especially important for accounts controlled by keys. A valid signature can show that whoever possessed a private key authorized a protocol operation. It does not by itself establish the holder's legal identity, free consent, competence, or entitlement to the underlying asset. The account records continuity of technical control. It does not become a person because the ledger treats its state as persistent.
An Account Is a Door, Not a Soul
An account is a designed boundary. It has an identifier, credentials, permissions, stored state, and procedures for creation, suspension, recovery, and deletion. The account may represent a customer, department, device, organization, or automated service. It is an instrument through which an institution makes a relationship operational.
Account design becomes unjust when the institution mistakes its own abstraction for the whole person. A score can be used to price a service without becoming a verdict on someone's worth. A risk label can trigger review without becoming an identity. A banned username can be changed without banishing a human being from the common good. The technical object must remain proportionate to the purpose for which it was created.
Continuity also deserves care. Accounts can be transferred, shared, inherited, compromised, or operated by an assistant. A person can lose a credential and retain every underlying right. Conversely, possession of a credential does not prove that the possessor is entitled to all actions available through it. Good systems therefore separate authentication, authorization, attribution, and recourse instead of treating one successful login as conclusive evidence about everything.
The Strongest Objection
The strongest objection is practical: if the law, a bank, or a blockchain must act through records and permissions, why insist on distinctions that the system cannot directly observe? A corporation can be a legal person, a smart contract can control assets, and an autonomous service can negotiate transactions. Perhaps personhood is always just a useful status assigned to whatever reliably participates in social life.
This objection correctly notices that legal and technical constructs can have real effects. A corporation is not fictional in the sense of being irrelevant; the law deliberately gives an organized association a status through which people may hold property, sue, and be sued. But legal personality is a normative instrument, not proof that the corporation has a human interior life, a body, or a soul. Its rights and duties are defined to coordinate human relationships. The category works because people stand behind it and can be held answerable through it.
The same is true of a machine account or an on-chain entity. Giving it a name, wallet, or limited capacity to contract may solve an administrative problem. It must not be allowed to become a liability sink into which human responsibility is poured. The question is not whether the construct is useful, but whether its status clarifies responsibility or obscures it. A legal convenience cannot settle an ontological question by declaration.
When Linkage and Attribution Are Necessary
The case for contextual identity must not become a case for evasion. A bank, hospital, and public agency may each need controlled linkage when continuity of care, recovery from account takeover, or a defined cross-context obligation depends on it. The test is not whether linkage is ever allowed, but whether its purpose, scope, duration, evidence, access, and remedy are explicit. A system that prevents duplicate enrollment while exposing a universal behavioral dossier has solved one risk by creating another.
A concrete incident shows why the fields cannot merely be labels. Suppose a caregiver uses a patient's account to authorize a medication order, and a vendor's service later flags the order as suspicious. The record should preserve the patient, caregiver, delegated scope and expiry, credential used, service that acted, evidence relied upon, and institution with power to correct the result. The patient may need immediate care; the caregiver may need attribution without being accused of fraud; the vendor may owe an investigation. Recording every participant does not decide liability, but omitting delegation and remedy makes a fair decision impossible.
Designing for the Distinction
A humane architecture should represent these layers explicitly. Its data model should distinguish a human or organization from the identities used in particular contexts, the accounts that carry permissions, and the agents authorized to operate them. A delegation should have scope, duration, provenance, and revocation. Shared custody should be visible rather than flattened into one fictional “user.” These are not merely elegant schemas; they determine whether a person can explain what happened when an automated action goes wrong.
Consequential systems need a human path through every important decision. There should be notice of the role an automated agent played, a way to inspect the relevant reasons without exposing another person's private data, and an appeal to someone with authority to interpret context. Recovery must be possible when credentials are stolen or an account is wrongly classified. Security that cannot distinguish a compromised credential from a culpable person is not rigorous; it is merely inflexible.
Designers should also resist universal identity as a default. Use purpose-limited identifiers, disclose what is being inferred, and avoid collecting intimate data merely because storage is cheap. A person should be able to participate without surrendering a permanent behavioral shadow. Subsidiarity offers a useful institutional principle here: decisions should remain as close as possible to the people and communities affected by them, while higher layers provide only the coordination genuinely needed.
Finally, language in an interface is part of governance. “Your account was flagged” is different from “you are a threat.” “This automated tool proposed an action” is different from “the system determined your case.” Careful wording cannot repair an unjust process by itself, but careless wording can hide who is acting and who may answer. Naming the agent, account, and responsible institution makes the chain of delegation legible.
A Grammar for Human Participation
The person, identity, agent, and account belong in one architecture, but they do not belong in one category. The person is the subject whose dignity precedes recognition. Identity is a social and administrative mode of recognizing that subject. An agent is a source of effects whose capabilities and authority must be specified. An account is a technical doorway, valuable precisely because a doorway is not the house.
When these distinctions are preserved, technology can make cooperation more trustworthy without claiming ownership of the people who cooperate. Systems can authenticate without pretending to know the whole person, automate without laundering responsibility, and provide legal coordination without manufacturing a soul out of a database entry. This is not an argument against abstraction. It is an argument for honest abstraction.
Catholic social thought asks whether institutions serve the person and the common good, not merely whether their records are internally consistent. The common good requires conditions in which people can participate, form relationships, seek truth, and receive justice. A technical system meets that measure when its representations remain accountable to the persons they represent, when its agents remain under responsible authority, and when its accounts never become substitutes for human encounter.
We should therefore build systems that say exactly what they know: this key acted, this account was authorized, this identity was presented, and this automated process produced an effect. Then we must ask the human questions that no record can answer alone: who is this person, what did they understand, what was owed to them, and who will repair the harm? A just digital order begins when its machinery can answer those questions without confusing its own shadow for the human being.
Source Notes
A contemporary doctrinal declaration on the intrinsic and inalienable dignity of every human person.
The Church’s account of personal dignity, freedom, responsibility, social identity, and the human person as a unity of body and soul.
Technical guidance illustrating the operational distinction between a person, an asserted identity, authentication credentials, and a system account.
The council’s account of the human person as embodied, social, responsible, and called to communion.
Editorial revision note
This essay completed one self-editing, cross-essay consistency, and strongest-criticism pass. Its controlling thesis was preserved while objections, qualifications, evidence limits, and practical consequences were strengthened.