Digital identity is fragmenting faster than trust models can adapt

At a glance

What this is: This is a guide to digital identity, reusable identity and the market forces shaping adoption, with the key finding that governance, infrastructure and interoperability are still uneven.

Why it matters: It matters because identity teams cannot treat verification as a one-time event when trust is expected to extend across industries, borders and reuse models.

Context

Digital identity is a governance model for proving who someone is online and then deciding how that proof is reused across systems, jurisdictions and business flows. The fragmenting issue is not authentication alone, but the gap between initial identity verification and the trust model that follows it.

For IAM, IGA and digital onboarding teams, the challenge is that centralized, federated and decentralized models do not create the same operational burden. The article frames reusable identity as a possible direction of travel, but the surrounding infrastructure, privacy, security and interoperability questions still shape whether that direction is workable.

Key questions

Q: How should organisations govern reusable digital identity across multiple services?

A: Treat reusable digital identity as a governed trust decision, not a convenience feature. Set assurance thresholds for the original proofing event, define which relying parties can accept reuse, and require revocation and monitoring rules that match the risk of the transaction. Without those controls, reuse spreads a weak trust decision instead of reducing friction.

Q: What breaks when trust signals are treated as proof of identity?

A: Trust signals are useful for prioritisation and risk scoring, but they are not a substitute for cryptographic proof. If teams treat reputation, verified-brand cues, or relationship history as identity assurance, they create a path for social engineering and impersonation. Strong programmes separate trust decisions from authentication decisions and keep the proof layer enforceable.

Q: When should teams choose federated identity instead of decentralized identity?

A: Choose based on governance and ecosystem fit, not fashion. Federated identity works when trusted institutions can exchange assertions under shared policy, while decentralized identity fits cases that need stronger user control and portability. The right choice depends on assurance, interoperability and regulatory expectations.

Q: How can security teams tell whether reusable identity is actually safe?

A: Look for evidence that claims are bounded, revocation is actionable and relying parties understand what they are accepting. If identity reuse depends on informal trust, ambiguous policy or inconsistent partner controls, the model is not yet safe enough for scale.

Technical breakdown

Centralized, federated and decentralized identity models

Digital identity schemes differ in where identity data lives, who controls it and how trust is asserted. A centralized model concentrates records and policy in one place, federated identity relies on assertions exchanged between parties, and decentralized identity shifts more control toward the user or wallet model. Those differences matter because the operational risks change with each model, especially around data sharing, revocation, assurance and reliance on third-party trust anchors.

Practical implication: Map each identity journey to the model it actually uses before deciding which controls, trust agreements and assurance checks apply.

Reusable identity and the trust boundary problem

Reusable identity aims to let a verified identity be accepted across multiple services without repeating the whole onboarding process. The security challenge is that the original verification decision and the later relying-party trust decision are not the same control point. If reuse is not governed tightly, organisations can confuse proof of identity with ongoing entitlement to trust, which creates policy drift across ecosystems.

Practical implication: Separate initial identity proofing from downstream trust decisions so that reuse does not become an unreviewed assumption.

Infrastructure, privacy and interoperability as governance constraints

The article treats infrastructure, privacy, security and interoperability as the practical constraints that determine whether digital identity can scale safely. Standards alone do not solve adoption if relying parties, regulators and identity providers do not align on data handling, assurance and exchange rules. In practice, the governance model has to define what is shared, what is retained and how trust survives across organisational boundaries.

Practical implication: Treat interoperability planning as a governance exercise, not just a technical integration task, and test privacy and security assumptions early.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Digital identity fails when verification is treated as the same thing as trust. The core governance mistake is assuming that a verified identity remains trustworthy across every later use case, jurisdiction and relying party. That assumption collapses once reusable identity enters the picture, because the original proofing event no longer carries the full context needed for every downstream decision. Practitioners should separate proofing, trust and authorisation as distinct control decisions.

Reusable identity is not an identity shortcut, it is a governance burden shifted downstream. The promise of proving once and trusting everywhere sounds efficient, but it increases the need for consistent assurance, revocation logic and relying-party accountability. Without that structure, reuse can spread uncertainty as quickly as it spreads convenience. For identity programmes, the real question is whether the ecosystem can sustain shared trust at scale.

Fragmentation is the market signal, not a temporary implementation problem. Centralized, federated and decentralized approaches are coexisting because different sectors have different risk tolerances, privacy expectations and regulatory pressures. That means practitioners should not wait for a single universal model to emerge before acting. The stronger pattern is to design for controlled interoperability and explicit trust boundaries now.

Trust portability: the idea that a verified identity can move across services without losing assurance is becoming the defining design problem. That concept is attractive because it reduces repeated onboarding, but it only works when governance defines which claims are portable and which must be revalidated. The implication for identity architects is that portability must be scoped, not assumed.

What this signals

Portability only works when trust is scoped. Identity teams should expect reusable identity to increase the need for explicit claim boundaries, revocation rules and partner accountability. A portability model that is not governed at the relying-party level simply shifts uncertainty from onboarding into downstream access decisions.

Digital identity strategy should be built around the operating model that actually exists, not the one the market is promoting. That means separating federation, decentralisation and centralised trust into distinct journeys and making interoperability a policy decision as much as a technical one.

For practitioners

• Define the trust boundary after verification Document where identity proofing ends and where relying-party trust begins. Use different policy controls for onboarding assurance, step-up checks and continued access decisions.
• Classify identity flows by operating model Separate centralized, federated and decentralized journeys in your architecture inventory so that controls, retention rules and exchange expectations are not applied uniformly by mistake.
• Test interoperability before rollout Validate how credentials, claims and revocation events move across partners, regulators and internal systems before treating reusable identity as production-ready.
• Align privacy and security governance early Set explicit rules for data minimisation, assurance evidence, and cross-border handling before scaling digital identity into onboarding or trust reuse programmes.

Key takeaways

• Digital identity is expanding, but the operational problem is still how to govern trust after the first proofing event.
• Reusable identity can reduce repeated onboarding, yet it only works safely when trust claims, revocation and relying-party rules are explicit.
• IAM and digital onboarding teams should model identity as a lifecycle of trust decisions, not a single verification transaction.

Key terms

• Digital Identity: Digital identity is the set of attributes, credentials, and access relationships used to authenticate and authorize a person, service, workload, or automated system. In security operations, it becomes the control layer that determines what can act, where it can go, and how far compromise can spread.
• Reusable Identity: Reusable identity is a verification model that allows an identity proof to be used again across multiple platforms or journeys. It can reduce repeated document collection, but it also requires clear governance for revalidation, revocation, and jurisdictional boundaries so trust does not become portable without control.
• Federated Identity: Federated identity lets one organisation trust an external identity provider so a user can access another service without creating a separate account. It simplifies access, but it also expands the trust relationship that must be monitored. Weak federation settings can turn a single compromise into cross-domain access.
• Trust Boundary: A trust boundary is the point where one system’s authority should stop and another system’s authority should begin. For internal automation, weak trust boundaries let monitoring, remediation, and execution share privileges that should have remained separate.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.