Abstract
The rapid growth of non-human identities, such as service accounts, API keys, workload tokens, and autonomous AI agents, has already surpassed the number of human entities in many systems. At the same time, advances in generative AI are reducing trust in perceptual evidence through deepfakes and synthetic media. Together, these trends challenge our assumptions about identity, authentication, and trust online.
In this paper, I claim that these pressures will lead to a shift toward what I call conditional anonymity. In this emerging model, zero-knowledge proofs (ZKPs) enable individuals to authenticate properties about themselves while preserving privacy, whereas non-human actors are increasingly required to produce cryptographic evidence linking their actions to accountable human principals. This asymmetry is not accidental but reflects deeper technical, legal, and economic constraints that shape identity systems.
Thanks for reading! Subscribe for free to receive new posts and support my work.
I examine the technical foundations of this shift, particularly ZKPs and the identity establishment problem, and analyze how non-human identities and AI systems create new risks. I then lay out a plausible 2036 framework and discuss core issues, including metadata leakage, platform control, and inequality. Ultimately, conditional anonymity demonstrates a more extensive rebalancing between privacy, accountability, and control in modern digital systems.
1. Introduction: The Collapsing Perimeter of Human Identity
Digital identity systems were historically designed around the assumption that humans were the only users. In the 1990s and early 2000s, identity models were largely anthropocentric: credentials, passwords, authentication sessions, fraud detection, and compliance processes all centered on individuals. This assumption is no longer valid.
Recent data suggests that identity-based attacks have overtaken traditional software exploits as the primary threat vector. Attackers are increasingly relying on valid credentials obtained through phishing, infostealers, or token theft rather than exploiting software vulnerabilities. At the same time, non-human identities (NHIs), including service accounts, API keys, and autonomous agents, now outnumber human users by a significant margin, in some cases by more than an order of magnitude.
From a systems perspective, this shift fundamentally changes the threat model. Instead of asking whether a user is legitimate at login time, systems must now continuously reason about whether actions made after authentication remain trustworthy. This is consistent with a key theme in this course: authentication is not a one-time event, but part of an ongoing process of authorization, trust evaluation, and risk management.
Modern credential systems reinforce this gap. While they are effective at verifying user presence and intent at the start of authentication, they offer limited guarantees about what happens afterward. It is straightforward to construct a scenario in which an agent leverages an already-authenticated session to act on a user’s behalf without any further verification. This illustrates a wider issue: identity systems authenticate humans, but then implicitly trust software acting in their name.
At the same time, advances in generative AI are undermining traditional forms of identity verification. Deepfakes and synthetic media make it increasingly difficult to rely on visual or auditory evidence. As Chesney and Citron describe, this creates a “liar’s dividend,” where even authentic recordings can be dismissed as fabricated.
When both credentials and perceptual evidence become unreliable, the fundamental question becomes: how can identity be established and verified in a way that sustains a balance of privacy, security, and utility?
Thesis
This paper argues that by 2036, digital identity systems will likely evolve toward a model of conditional anonymity, in which humans gain stronger privacy protections through the use of zero-knowledge proofs and anonymous credentials, while non-human actors are subject to stricter forms of cryptographic accountability. This shift is driven by three converging factors: the rise of non-human identities as a dominant attack surface, the erosion of trust in perceptual and credential-based authentication, and the shortcomings of existing identity infrastructures.
In this model, anonymity is not absolute but context-dependent. Humans can authenticate properties about themselves, such as age, citizenship, or authorization, without revealing their full identities, in accordance with the privacy-enhancing technologies discussed in this course. In contrast, software agents and AI systems are required to produce verifiable evidence linking their actions to accountable principals, reflecting the need for stronger guarantees of integrity and responsibility.
The following sections develop this argument by examining the technical foundations of zero-knowledge proofs, the challenges of identity establishment, the growing risks posed by non-human actors, and the broader system-level trade-offs between privacy, accountability, and control.
2. The Technical Bedrock: ZKPs and the Identity Establishment Problem
2.1 The Three Properties
Zero-knowledge proofs (ZKPs) are a class of cryptographic frameworks that allow one party (the prover) to convince another party (the verifier) that a statement is true without revealing any more information beyond the validity of the statement itself. Originally formalized by Goldwasser, Micali, and Rackoff in 1989, ZKPs are now a central element of modern privacy-enhancing technologies.
ZKPs satisfy three core properties:
• Completeness: If the statement is true and both parties follow the protocol honestly, the verifier will accept the proof. For example, if a Trinity student proves their enrollment status, the verifier will accept this claim with high probability.
• Soundness: If the statement is false, a dishonest prover cannot convince the verifier except with negligible probability. This makes certain that false claims, such as pretending to be a student, are rejected.
• Zero-knowledge: The verifier learns nothing beyond the truth of the statement itself. This is the defining property and directly supports the goal of limiting unnecessary data disclosure, a core concern in handling sensitive information.
Modern implementations of ZKPs, such as zk-SNARKs and zk-STARKs, significantly improve efficiency by compressing interactive proofs into short, non-interactive messages that can be quickly verified. In many cases, proofs are only a few hundred bytes and can be verified in milliseconds.
From a systems perspective, ZKPs serve as anonymous credentials, letting users to prove attributes without revealing their identities. This is consistent with our course concepts, such as authentication versus identification: ZKPs enable systems to verify whether a user is who they claim to be without necessarily knowing who the user is.
This ability directly supports the first component of conditional anonymity. By supporting selective disclosure, ZKPs allow identity systems to reduce the amount of sensitive information disclosed during interactions, thereby lowering the risk of misuse, breach, or secondary inference. However, as the next section will show, ZKPs do not eliminate the need for trusted issuers or solve the more extensive problem of identity establishment.
2.2 Issuance vs. Proving, and Why the Distinction Matters
A large part of the misunderstanding about ZKPs in identification stems from conflating two distinct steps. Firstly, issuance is the process by which an authority, a governmental body, a university registrar or a bank authenticates the user’s attributes, links them to the user’s public key and issues a signature. The signed statement itself is the credential; it is not a ZKP and relies on a verification process to prove the user’s identity. This is where the base for future proofs is set. Secondly, the user, sometimes years later, creates a ZKP to satisfy the verification’s predicate. The issuer does not need to be available online, and the verifier does not even see the original attributes, the credential, or the identifiers. Rather, what one sees serves as cryptographic proof of the authority’s signature on the statement in question. This is especially important for a verifier such as a group-payments platform, which need never see personal details such as legal names, birthdays, or account balances.
Knowledge of the identity remains with the KYC partners, while the verifier holds only the proof. The critical part is that identity verification doesn’t happen through cryptography but instead at the point where the identity is issued, and some parts of the identity can be kept secret only during the generation of the proof. What this results in is something I call “blast radius reduction.” A verifier that retains full bank-linkage information---data that may never be queried again---assumes unnecessary risk. The better design is to retain only the token and the predicate at the time of settlement.
2.3 The Identity Establishment Problem
In this case, I explain what ZKPs cannot do. Firstly, they do not generate any form of identity but help to preserve anonymity around them. Every zero-knowledge proof can work only with the help of the issuer’s credibility -- no matter whether it was a government agency, bank, or some other organization. If a proof states that someone is over 18 years old, then the issuer of that credential should be trusted -- either the government or mobile operators. If the proof concerns the bank account balance, it should be trusted as well, including the bank itself and the regulatory body that oversees it. All of these things are true for all 2036, and there are three main consequences: first, ZKPs are unlikely to undermine the power of the state and financial issuers but merely redistribute it. Second, fragmentation will persist. American users have credentials issued by the Social Security Administration, state DMVs, banks, employers, and universities, none of which operate on a single schema. The wallet of 2036 needs to be able to link all these together, or the system collapses. Third, vulnerable people who lack good issuers, such as undocumented immigrants, citizens of failed states, or refugees, run into new problems of exclusion because they lack the proofs that the system requires. Typically, privacy gains from zero-knowledge proofs tend to favor people who already have powerful state IDs.
3. The Identity Crisis of Non-Human Actors
3.1 Logging In, Not Hacking In
An inflection point is recorded in the IBM 2025 Index. Identity theft surpasses software exploits as the primary attack vector against systems. Credentials have become stolen or spoofed in major operations by attackers: stolen by infostealers on GitHub, created from API keys found publicly on GitHub, generated as tokens that were improperly scoped during development without being pared down later, generated as service accounts which were deployed once for a migration job and then left running, or as machine identity credential sets added to directory services by attackers who already had a beachhead within organizations (IBM, 2025). The Cloud Security Alliance and Astrix Security jointly conducted a survey that showed an estimated ratio of non-human identity accounts to human identity accounts was 20:1 (CSA & Astrix, 2024). The latest telemetry for 2025 shows a ratio of 144:1 (Entro Labs, 2025).
The issue here is not simply scale but asymmetry. While people have inherent accountability, NHIs do not. When an individual moves from one company to another, their HR department begins deprovisioning them. A service user has no corresponding HR department. If a person tries to log in 3 times with an incorrect password, they get locked out. APIs never try to log in incorrectly. An autonomous actor cannot be asked retrospectively whether they intended a specific course of action unless that intent was embedded in their operations. My policy recommendation is that the 2036 specification must enforce what I will term human-level controls on NHIs. Indeed, precisely because the playbook for attackers has blurred the line between attacks on humans and attacks on machines. The authenticated-session scenario described earlier is just one example of the issue at hand. Extend this same logic to apply to multiple microservices, an LLM agent making chain calls using the user’s APIs, and a couple of external applications, and you have a live identity management system that cannot tell the difference between a logged-in human user, his delegated agent, and an attacker who has compromised his session.
3.2 LLMs as a New Kind of NHI
LLMs bring a fresh class of non-human actors that negotiate, persuade, and make claims as part of their fundamental functionality. Two kinds of threats demonstrate how identity presumptions break down when LLMs are at play. First, there is the threat of training-data leakage via prompt crafting, as shown by Carlini et al. (2021), who prompted LLMs to disclose sensitive data such as emails, phone numbers, private keys, and copyrighted texts. The problem here is one of scale: rare data in the training set is memorized accurately, so rare and sensitive data that occur once in a document would be extracted rather than frequent, common phrases. Data extraction by LLMs occurs in domains where sensitivity is highest, and it stems from how these models memorize long-tail data, not from a bug that could be easily fixed. In other words, training an LLM on corporate data is more than just using it as a productivity tool; it’s a repository of data that can only be accessed through clever prompt crafting. However, traditional forms of identity controls, such as RBAC and least privilege, assume the use of small query sets. This can be circumvented through prompt engineering. The remedy is to ensure that critical identities are not included in the training dataset for manipulable models and to encourage the use of retrieval-augmentation approaches.
4. The 2036 Framework: Conditional Anonymity
4.1 The Inversion
The framework needs to be described in relation to the prevailing paradigm. Currently, online humans are heavily surveilled but are barely identified. Users are monitored across ad networks through thousands of signals, but can also sign up anonymously or with fake names. Software, on the other hand, operates anonymously, where API keys act as bearer tokens not directly linked to any real identity, and LLM responses lack cryptographically signed provenance. In the 2036 model, these roles would be reversed: users would have strong privacy through the use of ZKPs for everyday activities, while software would be expected to have provable identity behind every action.
This is what we call Conditional anonymity. Anonymity is never guaranteed; it depends on whether one is human, whether the interaction is habitual, and whether there has been no subsequent fraud or harm that would warrant de-anonymizing the individual under the law. This is achieved not by surveillance but by selective disclosure techniques encoded in the credential.
4.2 Parkerian Hexad
The Parkerian Hexad (Parker, 1998) extends the classic CIA triad of Confidentiality, Integrity, and Availability by introducing Possession, Authenticity, and Utility. This system is important to me because the concept of Conditional anonymity is a balancing act between these attributes.
For example, an age proof using a zero-knowledge proof improves privacy, as the verifier knows less than in existing solutions. The issuer’s signature ensures the proof stays authentic. Possession is significant because the holder decides whether and to whom to present the proof, although the credential itself resides in a wallet whose private keys are protected by hardware enclaves that do not fall under the holder’s control. Utility is the main challenge: the proof that merely states “over eighteen” is very useful for controlling age-restricted access but less helpful in fraud investigations, as it eliminates any linkage necessary for the investigation process.
The Hexad also sheds light on our loss when choosing surveillance over evidence. Facial recognition employed in many American and Chinese cities turns faces into numbers (typically 128-dimensional vectors) and compares them against huge databases with millions of entries, enabling mass surveillance, retro-surveillance, and identification at protests. In computer vision, this approach is referred to as 1:N matching, which involves checking one face among many. ZKP identity solutions work through 1:1 matching, proving that the person presenting the proof is indeed the owner of the credentials without any database lookups or linkages. Despite being highly authentic and useful, 1:N mass surveillance compromises confidentiality, reverses the possession property, and diminishes integrity because vectors may be manipulated adversarially. Meanwhile, ZKPs allow retaining authentication and utility while restoring possession and confidentiality. What is even more interesting is that ZKP-based identities cannot support 1:N surveillance due to limitations in the underlying cryptography.
4.3 Mandatory Provenance for Non-Human Actors
The second condition is mandatory provenance for AI agents and other non-human entities. All autonomous activities of a minimum magnitude, such as a transaction performed by an agent, an action taken by a bot, or media content generated by a model, should be traceable via a cryptographic chain of provenance back to their responsible principals. The development of the media component of this chain began with C2PA (2025), in which large camera manufacturers and platforms pledged to include signed provenance metadata in their photos and videos. In terms of identity, this will come from an agent credential system, in which LLM-based agents provide a zero-knowledge proof (ZKP) of their principals’ authorization and acceptance of liability after each notable action.
Notice the asymmetry between these two systems: humans prove predicates about themselves without identifying, whereas agents identify themselves without hiding. This does not stem from any fear of AI but from a basic realization that autonomous code lacks agency of any kind -- moral and legal alike. Accountability thus becomes linked to the principal rather than the agent, and mandatory provenance is the only crypto-based solution.
4.4 Legal and Economic Logic
But why would they do that? First, legally speaking, they have their justification for adopting the concept. Since every decision by an AI can be traced back to its source, liability is appropriately assigned. In the absence of the same, disputes arise and become expensive when claims are made. The transparency rules in the EU AI Act indicate that this is the direction the legislation is taking (European Union, 2024). Ten years down the line, the US will definitely have such guidelines governing its sectors.
Economically speaking, the concept will improve the insurability of organizations. Since 2022, underwriters have been tightening the cyber insurance market and demanding much more than multi-factor authentication. Only those firms that have proven their ZKP and provenance will pay significantly reduced insurance premiums.
Nevertheless, there is a system-level problem referred to as the “composability risk.” With the rising trend of using credentials as blocks linked into a chain (for instance, identity verification via KYC, which ultimately results in loan approval and finally actions performed on-chain), a security flaw at any point involving the issuer’s signature or revocation operations will affect the rest of the chain. The Terra-Luna crisis that occurred in 2022 can serve as an illustrative example of how this works. Given that once a series of DeFi protocols are created on the faulty premise (e.g., an algorithmic stablecoin is dependable), it is not long before it collapses. If the issuer’s signing key turns out to have been compromised, all validators that rely on proofs issued by this entity must recognize all other issuances from the issuer as invalid.
5. Systemic Risks and Infrastructure Dependencies
5.1 Metadata Shortfall: The Inadequacy of Using Only Cryptography
One clear-cut case from 2013 demonstrates why the use of only ZKPs is inadequate. Eldo Kim, a Harvard University student, sought to postpone taking an examination by sending a threatening email anonymously through the use of Tor and Guerrilla Mail services. Though the email message was indeed anonymous, metadata about his connection to the Tor network, including his university MAC address at a particular point in time, helped identify him quickly (U.S. District Court for the District of Massachusetts, 2013, Case 1:13-mj-05134-JGD).
The current lesson can be directly applied to ZKP-based identities. A proof for “I am an adult resident of Connecticut” provides no information about its content, whereas metadata such as IP addresses, timing signatures, TLS fingerprints, and actions performed afterward can easily tie that user down. Network deep packet inspection by Internet service providers, governments, or corporate proxies requires no crypto-breaking; only the ability to match the flow to the user. Thus, Conditional Anonymity requires network anonymizing services such as Tor, Mixnets, or equivalent systems. It is also important to use wallet clients that do not leak via fingerprinting via TLS signature unification, equal-proof-size padding, and randomized proof-sending timing. My peers and I have observed multiple times that layer seven cryptography strength is undermined by layer three observability time and again. The 2036 standard would fail if it assumes that Zero-Knowledge proofs provide sufficient privacy protection, disregarding the need for layered privacy defenses.
5.2 Technofeudalism and the Erasure of Digital Identity
The other problem lies at the level of platforms and censorship, dubbed Technofeudalism by Yanis Varoufakis (2023). He explains that there is an elite few who run the clouds and platforms where user identity holds economic weight, allowing them to shadow-ban, deplatform, demonetize, and suppress identities algorithmically. A ZKP-based credential will be rendered useless if the platform chooses not to authenticate it, while a provenance-signed post is meaningless if algorithms choose not to display it. Conditional Anonymity does not solve the problem but may be used against it. If the issuer’s infrastructure controlling the process is dominated by a state or platform, it can dictate which predicates can be proven. For instance, if a dissident does not have a credential saying he is a “resident in good standing,” then his identity will be deleted in ways no passport system can achieve since the exclusion will be cryptographic and universal for all verifiers. The definitive solution is the diversification of issuers; that is, there should be many competing issuers in academia, civil society, and the private sector, assuring no one can arbitrarily deny the capability to prove fundamental predicates.
5.3 Quantum and Cryptographic Agility
Predictions about the future have to take post-quantum cryptography into account. At the moment, zk-SNARKS rely on elliptic curve assumptions that can be easily broken by quantum computers. zk-STARKS, which are based on hash commitments, are thought to be post-quantum cryptography-friendly (Ben-Sasson, Bentov, Horesh, & Riabzev, 2018). It is expected that the ZKP infrastructure in 2036 will be based on STARKS or lattices, and switching from existing SNARKS systems, which will have been implemented in 2026, will not be easy.
5.4 Social and Distributive Risks
The systemic risks raised in Section 2.3 must be highlighted at this point. A system that rewards individuals with good state credentials is bound to uphold existing hierarchies. Refugees, undocumented workers, the unbanked, and people from dysfunctional civil states will have difficulty demonstrating the predicates required by Conditional Anonymity. In the absence of deliberate policies such as issuing of credentials from communities, Issuer programs designed to help refugees, and proof-of-personhood schemes that are independent of state IDs, Conditional Anonymity could simply perpetuate pre-Internet inequality within cryptographic terms.
6. Conclusion: From Document to Living Identity
The identity architecture expected to emerge in 2036 will be different from that in 2026 due to multiple pressures modifying its development. On one hand, synthetic media and autonomous agents diminish the credibility of online interactions, whereas, on another, Zero-Knowledge Proofs (ZKP) evolve rapidly and approach mainstream adoption. The described model of conditional anonymity may be understood as not only an improvement in technology, but a purposeful attempt to move privacy rights away from software and back to human individuals.
What is important about the concept being presented is that identity is shifting from being treated as a document to being considered as a continuous interaction. Traditional identification means, such as passports, driver’s licenses, or database entries, identify a person’s status at a given point in time. Conditional anonymity based on ZKP, network-level anonymity, mandatory provenance of NHIs, and the credential pool represents a continuous cryptography operation. Every important interaction requires a human user to produce a unique, unlinkable ZKP, whereas every autonomous agent performing actions on behalf of a human should leave a tamper-proof audit trail to an accountable entity. Thus, identity becomes a constant cryptographic activity.
Achieving the presented vision is possible with three prerequisites: (i) having enough issuers of credentials so that conditional anonymity does not become a tool for governments to control populations, (ii) having sufficient network-level anonymity so that ZKP does not become just yet another type of metadata leaks, and (iii) willingness of governments to enforce the provenance requirement for NHIs despite objections by software engineers designing AI systems. None of the listed goals is guaranteed to come true; however, all are achievable.
From my experience, there is a considerable correlation between technology advancements and business needs. Implementing a ZKP identity system may reduce both compliance costs and breach-related risks while improving cross-border user onboarding. The introduction of the NHIs’ provenance gives companies additional responsibility that could not be enforced via reliable logs before. Conditional anonymity takes the idea behind the identification systems of the early 2000s further by recognizing the differences in the roles of humans and software and making the latter accountable.
References
Ben-Sasson, E., Chiesa, A., Tromer, E., & Virza, M. (2014). Succinct non-interactive zero knowledge for a von Neumann architecture. In Proceedings of the 23rd USENIX Security Symposium (pp. 781--796). USENIX Association.
Ben-Sasson, E., Bentov, I., Horesh, Y., & Riabzev, M. (2018). Scalable, transparent, and post-quantum secure computational integrity. IACR Cryptology ePrint Archive, Report 2018/046.
Carlini, N., Tramer, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Erlingsson, U., Oprea, A., & Raffel, C. (2021). Extracting training data from large language models. In Proceedings of the 30th USENIX Security Symposium (pp. 2633--2650). USENIX Association.
Chesney, R., & Citron, D. K. (2019). Deep fakes: A looming challenge for privacy, democracy, and national security. California Law Review, 107(6), 1753--1820.
Cloud Security Alliance & Astrix Security. (2024). The state of non-human identity security survey report. Cloud Security Alliance. https://cloudsecurityalliance.org/artifacts/state-of-non-human-identity-security-survey-report
Coalition for Content Provenance and Authenticity. (2025). C2PA technical specification, version 2.2. https://spec.c2pa.org/specifications/specifications/2.2/specs/C2PA_Specification.html
Electronic Frontier Foundation. (2024). Street-level surveillance: Face recognition.
https://sls.eff.org/
Entro Labs. (2025). NHI & secrets risk report -- H1 2025. Entro Security.
European Commission. (2024). Regulation (EU) 2024/1183 on establishing the European Digital Identity Framework (eIDAS 2.0). Official Journal of the European Union.
European Union. (2024). Regulation (EU) 2024/1689 laying down harmonized rules on artificial intelligence (the Artificial Intelligence Act). Official Journal of the European Union.
Goldwasser, S., Micali, S., & Rackoff, C. (1989). The knowledge complexity of interactive proof systems. SIAM Journal on Computing, 18(1), 186--208.
IBM Security. (2025). X-Force threat intelligence index 2025. IBM Corporation.
Parker, D. B. (1998). Fighting computer crime: A new framework for protecting information. John Wiley & Sons.
U.S. District Court for the District of Massachusetts. (2013). Affidavit of Special Agent Thomas M. Dalton in support of criminal complaint, United States v. Eldo Kim, Case No. 1:13-mj-05134-JGD.
Varoufakis, Y. (2023). Technofeudalism: What killed capitalism. Bodley Head.
Anthropic. (2026). Claude 4.6 Opus [Large language model].
Grammarly. (2026). Grammarly [Computer software].
https://www.grammarly.com/
OpenClaw. (2026). OpenClaw [AI agent software running on ollama - qwen3.5]
Thanks for reading! Subscribe for free to receive new posts and support my work.