Identity system treats humans and long-lived AI actors separately
SoulAuth: An Actor-native Identity Architecture and Rust Reference Implementation for Humans and Long-lived AI Actors
Computers and Society
Summary
As computer programs built with AI become more permanent and connected to many services, figuring out how to manage their digital identities is tricky. This paper presents SoulAuth, a system that keeps the identity of humans and these long-lived AI programs separate and stable, rather than tying them to user accounts or sessions. The authors built this system in the Rust programming language and tested that it enforces clear boundaries between who is authenticating, who is using the system, and who has authority. While some challenges remain, this approach aims to keep AI programs identifiable over time just like people.
What this means in practice
- •For software developers: Implement identity systems that maintain persistent, separate identities for humans and autonomous AI entities across sessions and credentials.
- •For cloud service operators: Manage authentication and authority roles distinctly for both human users and long-lived AI programs in multi-tenant environments.
Authors
Kun Yuan, Harold Wang, Echo Li, Egusi Gui, Kiki Hu, Lucas Luo, Magnus Hu
Abstract
As AI systems move from transient model invocations toward long-lived actors that persist across credentials, clients, sessions, and runtime instances, identity infrastructure must answer a basic question: where should the canonical continuity boundary be placed? This paper introduces Actor-native Identity and presents SoulAuth, an open-source Rust reference implementation for Humans and long-lived AIActors. We argue that any subject that must persist under its own identity and remain independently attributable should have an ActorIdentity that is not replaced by an Account, Credential, Client, AuthSession, IdentityBinding, or runtime instance. SoulAuth therefore treats Humans and long-lived AIActors as first-class identity subjects while keeping authentication distinct from downstream authority. Methodologically, we use a Philosophical Engineering approach that translates conceptual analysis of subjecthood into identity objects, invariants, lifecycle semantics, system responsibilities, implementation boundaries, and inspectable conformance evidence. Evaluation against the fixed SoulAuth v0.1.0 artifact shows that the implementation realizes core boundaries including Human/AIActor first-class identity status, Client/Actor separation, and Authentication/Authority separation, while gaps remain in unified Credential modeling and historical attribution anchored to ActorIdentity. We therefore report partial, not full, architecture conformance.