TL;DR: Digital identity is moving beyond a European regulatory story, according to Namirial's account of the Global Digital Collaboration Conference 2026, while interoperability, trust registries, delegated authority, and liability remain unresolved across legal systems. The decisive issue is no longer whether a credential parses, but who is accountable when cross-border trust fails.
At a glance
What this is: This is an analysis of the GDC Conference 2026 and its ten takeaways on how digital identity, wallets, trust registries, business credentials, signatures, and agentic delegation are converging across jurisdictions.
Why it matters: It matters because IAM and identity governance teams now have to plan for cross-border credential acceptance, delegated authority, and liability boundaries that will not travel with the technical standard.
Context
Digital identity is moving from a national policy topic to a cross-jurisdictional governance problem. The practical challenge is no longer just whether a credential can be verified, but who authorises issuance, how trust is established across legal systems, and where liability sits when reliance fails.
The GDC setting shows why this is now an identity governance issue as much as a standards issue: wallets, registries, signatures, and delegation chains all depend on accountable issuers and verifiers. That makes IAM and IGA basics a useful lens for separating authentication, authorisation, and governance in these emerging ecosystems.
Key questions
Q: What breaks when digital identity systems treat interoperability as the main goal?
A: Interoperability alone does not tell you who is authorised, who can revoke authority, or who bears liability when a credential or delegated action fails. Systems can parse the credential correctly and still accept an untrusted issuer or overreaching delegate. The governance gap appears when technical validation is confused with legal and operational trust.
Q: Why do cross-border digital credentials create liability problems for practitioners?
A: Because the technical standard can travel faster than the legal rulebook. A credential may be accepted in multiple jurisdictions, but liability, supervision, and compensation rules often stay local. Practitioners need to know who is accountable when a relying party uses a credential that later proves invalid, misissued, or outside scope.
Q: What do security and identity teams get wrong about delegation in digital wallets?
A: They often treat delegation as a simple permission grant rather than a governed chain of authority. In practice, delegation needs a defined scope, a revocation path, evidence of intent, and a way to prove who authorised whom. Without that, the organisation may authenticate the actor but still fail to govern the action.
Q: How should organisations prepare for wallet-based signatures and agent-led transactions?
A: They should connect identity proofing, mandate governance, and signature services so the same assurance chain supports both human and software actions. That means deciding how authority is issued, how it is limited, and how disputes will be evidenced after the transaction. The programme needs legal, identity, and operational ownership together.
Technical breakdown
Why trust registries matter more than credential formats
A credential format such as SD-JWT VC or ISO mdoc standardises how claims are packaged and checked, but it does not establish who is authorised to issue those claims. That authority lives in trust registries, policy rules, and governance processes that can be updated independently of the wallet or verifier. In practice, the trust layer is what prevents a technically valid credential from being treated as authoritative when the issuer is out of scope, revoked, or operating outside its mandate. See the IAM and IGA Basics. See the IAM and IGA Basics.
Practical implication: Treat trust registry governance as a separate control plane from wallet interoperability and define who can add, revoke, and audit issuers.
Why delegation chains create the hardest accountability problem
Business wallets and agentic transactions both depend on delegation. A person or organisation can authorise another actor, human or software, to act within a bounded scope, but the technical proof that an action was allowed does not resolve who is liable when the agent overreaches. That makes delegation an identity governance problem, not just an access-management feature. The key design question is whether the mandate is explicit, time-bounded, auditable, and tied to an authoritative source that can survive disputes. Without that, the system can verify a transaction while still failing governance. See the IAM and IGA Basics.
Practical implication: Model delegation as an auditable lifecycle with issuance, scope, revocation, and evidence retention, not as a one-time permission grant.
Why signatures close the identity assurance chain
Verification proves a credential or attribute is valid at a point in time. A qualified electronic signature turns that verified fact into a legally binding action, which means the identity stack only becomes operationally complete when presentation, authorisation, and signature are linked. In wallet-led journeys, the signature layer carries the legal weight, dispute posture, and retention requirements that the upstream credential flow cannot satisfy on its own. This is why wallet strategy, assurance level, and signature service design have to be governed together rather than as separate projects. See the Digital Identity, eID and Identity Wallets Guide. See the Digital Identity, eID and Identity Wallets Guide.
Practical implication: Align your wallet, verification, and signature controls so the same assurance chain supports both access decisions and legal commitments.
NHI Mgmt Group analysis
Digital identity has crossed into identity governance, not just digital services policy. The article shows that wallets, registries, and signatures now have to operate across multiple legal systems, which means authority, auditability, and liability matter as much as interoperability. That is a direct IAM and IGA problem because the core question becomes who can issue, delegate, verify, and revoke across jurisdictions. The organisations that treat this as a format conversation will miss the governance shift.
Trust registries are the control plane, not a supporting detail. The credential format may be the visible layer, but the real security and governance decision is whether the issuer is authorised right now. That is why a cross-jurisdictional NHI framework mindset helps here: the system needs a recognised source of authority, revocation logic, and lifecycle governance, not just an accepted schema. Practitioners should design for issuer governance first and format compatibility second.
Delegation is becoming the new perimeter for digital transactions. Once businesses and agents can act through wallets, the organisation must govern who can represent whom, on what authority, and with what evidence. That is the same trust problem that appears in privileged access, only here the consequence is legal and financial rather than purely technical. The practical implication is that mandate design, revocation, and dispute evidence now belong in the identity programme.
Know Your Agent is the next accountability test for digital identity systems. The article's agent discussion shows that software acting on behalf of a person or company needs identity, mandate, and intent evidence, not just API access. That changes the governance burden from authenticating a requester to proving the legitimacy of the delegation chain. Organisations should expect this to merge IAM, business process control, and legal accountability into one operating model.
Cross-border acceptance will fail if liability is left to informal convention. Geneva's strongest signal is that technical conformance is converging faster than responsibility. Standards can tell you whether a credential parses, but they cannot decide who compensates when it is misused or misaccepted. Practitioners should treat liability allocation as a design requirement, not a post-incident legal question.
What this signals
Cross-border identity governance is now the hard part: once wallets and credentials move between legal systems, the issue shifts from technical compatibility to who can authorise, revoke, and defend that authority. Organisations should expect more friction in liability allocation than in schema adoption, which means the operating model needs to mature before the next interoperability rollout.
The sharpest programme risk is a verification-first bias. If teams build for presentation and parsing without binding delegation, issuer authority, and signature liability into the same control chain, they will create systems that look compliant but fail when challenged.
For practitioners
- Define the trust registry as a governed control plane Document who can add, revoke, and audit issuers, and separate those duties from wallet engineering and verifier operations.
- Map delegation chains end to end Record who can represent the organisation, what authority they inherit, what limits apply, and how revocation evidence is preserved.
- Align wallet flows to legal signature outcomes Ensure the same identity journey supports both presentation of attributes and creation of legally binding signatures, with audit and retention controls.
- Prepare for cross-jurisdiction liability questions Identify where your organisation would need to prove issuer authority, user consent, delegate scope, and reliance decisions when a transaction fails.
Key takeaways
- Digital identity interoperability is improving faster than the rules for accountability, which makes liability the central governance gap.
- Trust registries, delegation chains, and legally binding signatures are the controls that determine whether wallet ecosystems are operationally trustworthy.
- IAM and identity governance teams should now plan for cross-border authority, not just cross-border credential acceptance.
Related NHI Mgmt Group resources: IAM and IGA Basics · NHI Lifecycle Management Guide · Digital Identity, eID and Identity Wallets Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST SP 800-63, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, and GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63C — Federation | The article centres on federated trust, registries, and cross-jurisdiction acceptance. |
| Recommendation — Use federation controls to govern trust relationships, issuer authority, and reliance decisions across ecosystems. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Delegation and wallet-based representation depend on governed authorisation, not just authentication. |
| Recommendation — Define and review authorisations for issuers, delegates, and relying parties before acceptance is allowed. | ||
| GDPR | Art.32 — Security of Processing | Wallets and identity journeys process personal data and require security and accountability controls. |
| Recommendation — Apply security-of-processing controls to protect identity data, delegation evidence, and verification records. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Wallet credentials and signature flows depend on lifecycle management for authenticators and proofs. |
| Recommendation — Manage credential issuance, renewal, revocation, and recovery as a governed authenticator lifecycle. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Delegated access and wallet-linked credentials need clear offboarding and revocation when authority ends. |
| Recommendation — Revoke wallet-linked access and delegated authority immediately when the relationship or mandate changes. | ||
Key terms
- Trust Registry: A trust registry is a governed directory that says which organisations are allowed to issue or verify specific credentials. It does not replace cryptography. It adds the policy and authority layer that makes a credential meaningful in a particular ecosystem.
- Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.
- Qualified Electronic Signature: A higher-assurance signature backed by certificate-based identity and trust service provider controls. It is used where legal recognition and stronger evidentiary value are required, especially in cross-border or regulated workflows where the identity chain must remain defensible.
- Verifiable Digital Credential: A verifiable digital credential is structured identity data that can be checked cryptographically by a relying party. Instead of relying on visual inspection, the verifier validates issuer signatures and presentation rules, which gives the control a clearer trust basis than an image-based document.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect identity governance to policy, lifecycle control, and operational assurance.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org