Every entity, member, and agent has a DID (Decentralized Identifier) in the did:oas namespace. DIDs are cryptographically anchored to Ed25519 key pairs; signatures are offline-verifiable by anyone with the public key.

​
DID format

did:oas:<namespace>:<kind>:<identifier>
Examples:
  • did:oas:wy:llc:0001423 — a Wyoming DAO LLC
  • did:oas:human:hr-01-a4f2 — a human
  • did:oas:agent:helios.core — an autonomous agent
  • did:oas:tool:orgs.proposal — a platform tool

​
Kinds

Eleven entity kinds are defined by the OAS spec: hmr (human), mhr (multi-human), enr (entity), agent, tool, skill, workflow, model, dataset, service, agent:instance.

​
Lineage

Every non-human DID traces back to a human root via HKDF-SHA256 derivation. This creates an audit trail: for any agent action, you can walk the lineage chain back to a human. 
did:oas:wy:llc:0001423  (entity)
  └── derived from: did:oas:human:hr-01-a4f2
       (human root, verified government ID)

​
Signing

Actions are signed with the DID’s private key over a canonical JSON representation. Signatures include:
  • Action payload hash (BLAKE3)
  • Timestamp (RFC 3339 UTC)
  • Previous audit-chain hash
  • Signer’s DID
  • Ed25519 signature (64 bytes)

​
Verification

import { verify } from "@orgs/oas";

const ok = verify({
  did: "did:oas:human:hr-01-a4f2",
  payload: proposalData,
  signature: "ed25519::a4f2c7b9...",
  timestamp: "2026-04-12T14:22:07Z",
});
// true if the signature matches the DID's public key and the payload
Verification is fully offline — no network calls required.

​
DID resolution

To resolve a DID to its public key and metadata, use the OpenAgent resolver: 
curl https://openagent.id/resolve/did:oas:human:hr-01-a4f2
Returns: 
{
  "did": "did:oas:human:hr-01-a4f2",
  "publicKey": "ed25519::...",
  "lineage": [...],
  "status": "active"
}