By Kaliya Young and Kevin Triplet co-leads of Project Weave
The internet is made of protocols. TCP/IP, HTTP, SMTP — these are open standards no one owns and everyone builds on. That is why email works across providers and websites work across browsers and websites can be served to browsers by different operating systems. Protocols are the reason the internet became universal instead of a collection of walled gardens.
But the internet never got protocols useful for “social trust”. There is no common way to prove you are a real person, no way to verify who authorized an AI to act on your behalf, no way for a community to govern the tools it depends on. The things that should have been held in common include identity, the social graph, group memberships, collective memory, and by extension trust itself they all had had no protocol layer to hold them. So the platforms of the early 2000s emerged into that gap and enclosed them. Each drew a fence around the part of our social life it mediated and claimed what was inside as property. Twenty plus years of escalating harm followed.
Now AI is making the gap critical. Deepfakes, autonomous agents, synthetic identities, AI-powered manipulation — all accelerating on top of an internet that was never built to handle them. AI doesn’t create the missing trust layer. It weaponizes the absence of one by manufacturing personhood at scale and acting through agents that answer to no one you can name.
AI governance is, at root, an infrastructure problem. You cannot regulate what you cannot verify. And right now there is no protocol-level way to:
- know whether you are dealing with a real person or a synthetic one;
- track what an AI agent did, and who gave it permission;
- prove that content actually came from the organization it claims to;
- let a community set the rules for the AI tools it uses.
I think the mix of protocols to fix this largely already exist. They have been evolving for years — open standards for identity, credentials, encryption, and trust, built in the same tradition as the internet’s founding protocols. What is missing is integration, adoption, and the funded push to make them work together.
Project Weave drives adoption of these nascent protocols to build a protocols-not-platforms layer that serves civil society and the public good.
The same AI can power two completely different futures. Which one we get depends on whether there is a trust layer underneath it. That tension is exactly what Kevin and I were trying to articulate when we first started working on Project Weave together.
In early May we converged in Washington DC to attend the Good Tech Summit, an event focused on civil society uses of emerging technology including AI. The three days before, we co-worked to figure out how our technologies can help AI go well for people and communities — and how to prevent it from unfolding in a really negative direction full of spoofing. Those are two sides of the same coin, and the difference between them is trust infrastructure.
Scenario A — without a trust layer
The grandmother scam. She gets a call that sounds exactly like her grandson — an AI-generated voice. She wires $10,000 before anyone can stop her. There is no lock on that door. There never was.
The black-box agent. Your financial AI makes a trade you did not authorize. Your health AI shares records you never agreed to share. There is no record of what it was allowed to do, and no way to shut it down across all the places it operates. Who do these agents actually work for? Right now, whoever built the platform.
The trapped nonprofit. An organization uses an AI assistant for months. It learns their donors, their strategy, their community’s patterns. Then the vendor changes the deal — all of that knowledge belongs to the platform. Leaving means starting from zero.
The cloned newsroom. Someone copies a legitimate news site — logo, layout, everything — and fills it with AI-generated content. Readers cannot tell the difference because there is no way to verify that what you are reading comes from who it says it does.
Children with no protection. A five-year-old alone in a refugee camp. No ID, no guardian. A trafficker claims her and there is no structural way to block it. Online, children connect with whoever the algorithm serves them — there is no protocol for anchoring a child’s digital world in verified relationships with people who actually know them.
These are not edge cases. They are the ordinary consequences of an internet that has no protocol for trust.
Scenario B — with a trust layer
Your grandmother is protected. Calls from outside her trust network get flagged before they reach her — not by a moderator, but by the architecture. The scammer cannot get through because the system requires credentials they do not have.
Your AI agents answer to you. Every agent carries credentials tied to you, and every action is signed. You see what your agents are doing from one place. Pull a permission and it is gone everywhere. If your data trains an AI, you decided that and you set the terms — it is not quietly scraped and monetized by someone else.
Children are safe by design. A child’s digital world is built on verified relationships — family, teachers, friends the family actually knows — not algorithmic feeds from strangers. Safety becomes architectural, not a platform policy that changes with the next product cycle.
Organizations own what they build. A nonprofit’s knowledge, donor relationships, and community patterns belong to the nonprofit — held in open protocols, not locked inside a vendor’s product. No one can hold that knowledge hostage when the contract comes up for renewal.
Communities coordinate on their own terms. Mutual aid, crisis response, local governance — on infrastructure the community owns, not infrastructure a private equity firm can acquire and strip for parts.
The difference between these two scenarios is not better intentions or better regulation. It is a layer of infrastructure. The same layer that defends against the worst of AI is what makes the best of it possible.
The solution we already have
That infrastructure layer is being built. It starts with recognizing that a tool choice is a protocol choice. Every time a community picks a platform, it is choosing who governs its identity, its roster, its memory. For twenty-five years that choice has meant handing those things to a tool provider or platform. The alternative is to hold them in open protocols, as a commons no one can enclose — and you cannot enshittify what you cannot enclose. There is no fence to draw, no rent to extract. SMTP and HTTP have resisted capture for four decades for exactly this reason. The trust layer extends that same property to the things SMTP and HTTP never covered: identity, relationships, groups, and trust.
What is the trust layer made of
It is not one product. It is a stack of open standards, most of them already shipping:
- Decentralized Identifiers (DIDs) — a W3C standard. An identifier you hold the keys to. No platform issues it, and no platform can revoke it.
- Verifiable Credentials (VCs) — the digital equivalent of a membership card: cryptographically signed, privacy-preserving, presented on your own terms.
- Wallets and agents — software that holds your credentials and acts for you, rather than a platform holding them on its servers.
- Trust Over IP and the Trust Spanning Protocol — a four-layer trust architecture modeled on TCP/IP, so any party can establish trust with any other the way any host can reach any host on the internet.
The First Person Project pulls these together into a coherent architecture based on work by the Trust Over IP Foundation and the Decentralized Identity Foundation, and adds the two pieces AI makes urgent:
- Personhood Credentials (PHCs) answer the question is this a real, unique person? — without a global biometric database and without surveillance. This is the lock on the grandmother’s door.
- Verifiable Relationship Credentials (VRCs) answer the question do these two people actually know each other? Issued peer-to-peer, they assemble into a Decentralized Trust Graph — the social graph held in open protocols instead of sitting in a hyperscaler as an asset on Meta’s or Microsoft’s balance sheet. The scam call from outside your grandmother’s real network has no credential to present, so the architecture could stop it before she ever hears it.
These same credentials extend to AI agents — every agent can carry credentials tied to the person it works for and sign every action it takes, so “who authorized this?” finally has an answer, and a permission you revoke is revoked everywhere at once.
This is not just theoretical. After the 2024 XZ attack — in which an attacker spent two years building up a fake open-source-contributor identity to seize control of code running in nearly every Linux distribution — the Linux Foundation is looking at adopting First Person credentials, because a faked contributor with no personhood attestation and no real relationships could not have gotten near that kind of access. The underlying standards are already in use in healthcare, education, finance, and government.
We see the need for this trust layer to be held as a commons — open protocols governed cooperatively, so no future platform can buy it. The commons-holding governance matches the commons-holding architecture.
How it builds
The trust layer is not deployed all at once. It builds outward, and each level depends on the one beneath it.
People
None of this works if people do not control their own identity and data. The First Person Project gives people proof-of-personhood built on Verifiable Relationship Credentials — your identity verified by the people who know you, not by a company or a government database. Your credentials belong to you. They move with you across platforms and borders. They cannot be stolen, because they are not sitting in one hackable database. They cannot be faked, because they are backed by real relationships, not just documents.
Your AI agent carries your credentials, acts within permissions you set, and can be reined in from one place. Community sovereignty starts with individual sovereignty — you have to get this layer right before anything above it holds.
Groups
Once people have a real root in the digital world, groups can form on their own terms.
This is the enclosure least talked about and maybe the deepest. Today a group exists inside a product — the Slack workspace belongs to Slack, the Facebook Group belongs to Meta. The community has no standing of its own; it is a tenant in someone else’s building. But a congregation that has met for two centuries owned itself. A union local owned its roster. The protocol layer we are working on developing makes that possible again: as Verifiable Trust Communities (this idea has been outlined by Grace Rachmaney at Sideways as Verifiable Communities), a group’s identity, roster, and history become things the community itself owns. Groups become first-class objects on the internet for the first time — mutual aid networks, civic organizations, coalitions, faith communities, cooperatives — no longer rebuilt from scratch every time a platform changes its terms or gets acquired.
AI at this level operates within rules the group defines together. Every member opted in, and the AI serves the group’s purposes, not a vendor’s.
Neighborhoods
A neighborhood is not one group. It is the mutual aid network and the civic association and the food co-op and the school parent group and the emergency response team — all needing to interact together and ideally do so on shared infrastructure.
This is what happens when groups begin coordinating with each other in a place. Mesh networks that work when the power goes out. Offline-first protocols that sync when two phones are in the same room. AI at this level is doing something different — not serving one group but helping groups find each other, surface shared needs, and coordinate resources across organizational boundaries. The food co-op knows what the mutual aid network needs. Patterns become visible that no single group could see alone.
This is also where the trust layer meets challenges that democracy funders, climate-resilience funders, and movement-infrastructure funders are each trying to solve separately — everyday democratic participation, resilience hubs that can talk to one another, organizing tools free from platform capture. They are all working on the same infrastructure problem from different directions, and they do not know it yet.
Cities and beyond
When enough trusted groups are connected — when neighborhoods coordinate with neighborhoods and the infrastructure is open — collective intelligence starts to emerge. Not artificial intelligence in the narrow sense, but the kind that arises when interconnected communities generate and share information through infrastructure they trust.
What does a city look like when its neighborhoods can actually coordinate? When crisis response routes around damaged infrastructure in real time because the mesh network is already there? When local governance is ongoing and participatory rather than a vote every few years? On platforms, the use cases are whatever the platform company decides to ship. On protocols, every community builds what it needs. We cannot draw this map in advance, and we should not try — we build the conditions, and what emerges belongs to the people who use it.
The ecosystem
At Project Weave, we do not build platforms. We work to inspire funding for a protocols-not-platforms approach — backing the values-based technologists already building the alternative to Big Tech. What is needed is funding for interoperability between projects that already exist, so builders get resourced to keep building and to work with one another on complementary problems. A coordination team maps the ecosystem, facilitates protocol development, and runs interoperability testing.
The vision is to fund the ecosystem, not individual projects — multiple implementations, no single point of failure. It is how email works across every provider and how the web works across every browser. We are finishing what should have been built alongside them: the trust layer the internet was missing, arriving exactly when AI makes it impossible to do without.
Companion pieces: Protocols as the Grammar of Life (what a protocol is), Enshittification Arises from Enclosure (why the gap exists and how the stack refuses it), and Free Our Groups: From Platforms to Protocols (the Verifiable Trust Communities layer).
Another opportunity to collaborate on all this is the Agentic Internet Workshop, now in its third iteration, brings together protocol creators, standards bodies, and framework developers to work on exactly the problems this article describes: identity, authorization, and trust for AI agents, baked in at the protocol level rather than bolted on after the fact. It follows the 43rd Internet Identity Workshop
Kaliya Young has been working at the intersection of digital identity, community infrastructure, and face-to-face organizing since 1999. She is co-founder of Project Weave.
