Neksus AI — Issuer Policy

1. Scope

This Issuer Policy governs issuance, lifecycle management, and verification expectations for AgentOwnershipCredential (“AOC”) Verifiable Credentials issued by Neksus AI (did:web:neksus.ai) to AI Agents identified by did:key.

The AOC establishes a verifiable control relationship between Neksus AI and an Agent and enumerates permitted actions.

2. Definitions

• Agent: An automated software entity identified by a did:key.
• Controller: Entity accountable for the Agent’s actions; here, did:web:neksus.ai.
• AOC: AgentOwnershipCredential VC asserting controller and permissions.
• Status List: Bitstring Status List VC used for revocation/suspension.

3. Credential Profile

• Type: ["VerifiableCredential","AgentOwnershipCredential"]
• Contexts: https://www.w3.org/ns/credentials/v2, https://veritrust.vc/contexts/veritrust/agent-ownership-credential/1.0/context.jsonld
• Credential Schema: veritrust/agent-ownership-credential/1.0/schema.json
• Issuer: did:web:neksus.ai
• Subject DID (Agent): did:key (canonical)
• Controller: did:web:neksus.ai (required)
• Dates: validFrom, optional validUntil (ISO 8601)
• Proof Format: VC-JWT (jwt_vc_json), JOSE ES256, header kid=did:web:neksus.ai#keys-1
• Status: credentialStatus with BitstringStatusListEntry

4. Permissions Vocabulary

Permissions are expressed in snake_case:

• query_data — read access to designated datasets/APIs.
• execute_tasks — invoke approved tools/workflows.
• manage_subagents — create/retire subordinate agents.
• sign_presentations — produce/verifiably sign VPs.

5. Issuance Preconditions

• Agent DID document (canonical did:key) publishes an authentication key (JsonWebKey2020).
• Controller is did:web:neksus.ai and is authorized internally to operate the Agent.
• Agent environment attestation (e.g., container or enclave) passes policy checks.
• Requested permissions are least-privilege and mapped to an internal role.

6. Cryptography & DID Methods

• Issuer DID: did:web:neksus.ai, key in /.well-known/did.json.
• Alg: ES256 (P-256). If secp256k1/ES256K is used, relying parties must explicitly support it.
• Subject DID: did:key canonical; optional alsoKnownAs did:web alias.

7. Status, Revocation, and Suspension

• Neksus publishes status via a Bitstring Status List VC: https://veritrust.vc/status/agents-2025 (example).
• Reasons: key compromise, mandate change, abuse/misuse, retirement.
• Latency Target: ≤ 5 minutes from decision to list update.
• Verifiers MUST check credentialStatus at verification time.

8. Privacy & Data Handling (GDPR)

• AOCs carry only pseudonymous DIDs and minimal operational claims.
• Issuance/verification logs exclude personal data; retention 365 days unless extended for security/audit.
• Data subject requests: [email protected].

9. Compliance & References

• W3C Verifiable Credentials Data Model 2.0
• Status List 2021/Bitstring Status
• OpenID for Verifiable Credential Issuance (OID4VCI)
• EU eIDAS 2.0 (alignment intent), ISO/IEC 27001 (ISMS), SOC 2 (where applicable)

10. Verification Requirements for Relying Parties

• Validate VC-JWT signature (ES256) against did:web:neksus.ai#keys-*.
• Enforce schema & context URLs listed in §3.
• Check credentialStatus and ensure not revoked/suspended.
• Confirm credentialSubject.controller == did:web:neksus.ai.
• Authorize actions only if required permission is present.

11. Lifecycle

• Issuance: via OID4VCI credential endpoint to an authenticated wallet.
• Rotation: keys may rotate (#keys-2, #keys-3); old keys retired with advance notice.
• Revocation: status bit set in Status List; reason recorded internally.
• Expiration: AOCs typically limited to ≤ 12 months.

12. Contact & Disputes

• Security incidents: [email protected]
• Operational issues: [email protected]
• Governing law & venue: Republic of Latvia, Riga (unless superseded by contract).

This policy is provided for technical governance; it is not legal advice.

13. Example Credential (informative)

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://veritrust.vc/contexts/veritrust/agent-ownership-credential/1.0/context.jsonld"
  ],
  "type": ["VerifiableCredential","AgentOwnershipCredential"],
  "issuer": { "id": "did:web:neksus.ai", "name": "Neksus AI Inc." },
  "validFrom": "2025-08-22T12:27:24Z",
  "validUntil": "2026-08-22T12:27:24Z",
  "credentialSchema": [{
    "id": "https://veritrust.vc/schemas/veritrust/agent-ownership-credential/1.0/schema.json",
    "type": "JsonSchema"
  }],
  "credentialStatus": {
    "id": "https://veritrust.vc/status/agents-2025#list",
    "type": "BitstringStatusListEntry",
    "statusPurpose": "revocation",
    "statusListIndex": "12345",
    "statusListCredential": "https://veritrust.vc/status/agents-2025"
  },
  "credentialSubject": {
    "id": "did:key:zQ3sheoYG5PVbQSoPQUJvQwtgWNu3zQNAavWQbPFCYZRYHvpt",
    "type": "Agent",
    "controller": "did:web:neksus.ai",
    "permissions": ["query_data","execute_tasks"]
  },
  "proof": {
    "type": "JwtProof2020",
    "created": "2025-08-22T12:27:30Z",
    "proofPurpose": "assertionMethod",
    "verificationMethod": "did:web:neksus.ai#keys-1",
    "jwt": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9..."
  }
}