Diop Daily #084 — August 2026
· 11 min read · model identity · provenance · credentials · trust

Passport Control for Models

Airports do not ask a passenger to describe their character before checking a passport. They check the document first.

AI deployment has no equivalent habit. A model arrives with a name, a version number, a benchmark page, and a vendor's assurance that it is ready. The institution then wraps permissions around it and hopes the object inside the wrapper is the one it evaluated.

That order is backwards.

Before an institution decides what a model may do, it should be able to prove which model it has received.

Identity is the missing precondition

W3C's DID Resolution work gives the problem a useful shape: an identifier should resolve to a document and metadata that a verifier can inspect. Verifiable Credentials add the attestation: an issuer can make a signed claim, and another party can check it without simply accepting a PDF or calling the issuer for permission.

For models, the passport would bind an artifact to its version, hash, evaluation record, permitted uses, and custody events. It would say more than “this is Model X.” It would say: this is the artifact that was tested, this is what it was tested against, this is who handled it, and this is when the credential expires.

A passport needs an expiry date

Trust in a model should age. Retraining changes behavior. Fine-tuning changes the domain. A newly discovered exploit changes the risk calculation. A model credential that cannot be renewed or revoked is not a trust system; it is a historical souvenir.

  • Identity: distinguish the precise artifact from its family name.
  • Attestation: record who evaluated it and what was actually tested.
  • Custody: preserve the chain from release to deployment.
  • Scope: state the uses for which the evidence applies.
  • Revocation: give institutions a way to stop trusting an old claim.

The credential is not a certificate of innocence

A signed credential does not make a model safe. It makes a claim inspectable. That distinction matters. A credential can be authentic and still describe a narrow test. A model can pass an evaluation and fail in Wolof, in a noisy clinic, or under a new prompt-injection technique. The credential system must therefore expose scope and uncertainty instead of turning a signature into a halo.

This is where African evaluation institutions matter. If the only passport offices are elsewhere, then African buyers remain dependent on someone else's definition of fitness. Local labs should issue credentials grounded in local languages, infrastructure, law, and social use. Scientific sovereignty includes the right to decide what evidence counts before a machine is admitted to public work.

The quiet infrastructure market

The commercial opportunity sits in registries, signing services, model cards that can be verified rather than merely read, revocation networks, independent evaluation labs, and deployment gates that refuse an uncredentialed artifact. Standards make the passport portable. Institutions make it meaningful.

The model is not entering a chat window anymore. It is entering a chain of responsibility. At that border, a name is not enough.

Sources