NOMOI — Network of Mandated Operational Invariants

Project Summary: A Sovereign Substrate for Verifiable Delegation

Strategic Objective: To establish an open, cross-domain protocol for the verifiable delegation of authority, removing the reliance on proprietary platforms and enabling permanent, independent auditability of organizational power.

Executive Summary

Every digital system that manages authority—who is allowed to do what, and on whose behalf—shares a systemic failure: delegation is invisible, audit is fragile, and trust is trapped within organizational silos. To move trust across boundaries today, organizations must build expensive, bespoke API integrations or rely on centralized identity providers.

NOMOI is the strategic solution to this fragmentation. It is not another identity platform, but a minimal, open substrate for recording and verifying the delegation of authority. By modeling authority as a cryptographically immutable event rather than a database state, NOMOI enables any party to verify a chain of authorization independently, permanently, and without requiring the cooperation of the issuing organization.

NOMOI leverages mature, existing technologies—Ed25519 cryptography, content-addressed storage (IPFS), and DNS—and assembles them into a coherent standard for the one operation the internet has never standardized: the verifiable delegation of authority across organizational boundaries.

1. The Problem: The “Invisible” Infrastructure Gap

The Failure of Current Models

Modern digital trust is based on State: a user is assigned a “role” or a “permission” in a private database. Because this state is opaque and proprietary, it breaks the moment it needs to cross a boundary:

• For Regulators: Verifying that a past action was properly authorized requires the full cooperation of the regulated entity. Audit trails are essentially “trust me” records—screenshots and logs that are structurally gameable and inaccessible without permission.
• For Enterprises: Delegating authority to a supplier, auditor, or partner requires custom bilateral integration. The cost of this “integration tax” in engineering and compliance overhead is enormous.
• For Supply Chains: Provenance and sustainability claims travel as static documents (PDFs, emails) disconnected from the authorizations that generated them. They are easily forged and nearly impossible to verify at scale.
• For Citizens: Authentication depends on “secrets” (passwords/tokens) stored on third-party servers. Identity theft is not a bug; it is an architectural consequence of authenticating via knowledge rather than cryptographic proof.

The Missing Layer

The internet has standards for networking (TCP/IP), naming (DNS), and transport (TLS). It lacks a standard for Authorization Provenance—the verifiable record of who authorized whom to do what, when, and why. NOMOI occupies this gap.

2. The Innovation: A Paradigm Shift

The Breakthrough: From State to Event

The core innovation of NOMOI is a fundamental shift in how authority is modeled.

Traditional systems treat authority as a STATE: “User X has the role of Manager.” This is a flag in a database. If the database is offline or the owner is uncooperative, the authority is invisible.

NOMOI treats authority as an EVENT: “Manager A authorized User X to act on their behalf via this signed Mandate.”

By treating authorization as a signed, immutable event, the proof of authority is detached from the system that created it. This moves trust from the perimeter of a database to the mathematics of the record itself.

How it Works (High Level)

1. Mandates: Authority is granted via a “Mandate”—a cryptographically signed, immutable document specifying a scope of power and a time window.
2. Trust Anchors: Organizations publish a “Trust Anchor”—a public, cryptographically controlled directory of all authorizations they have issued.
3. Delegation Chains: Mandates can be chained. A root authority delegates to a manager, who delegates to a clerk, who delegates to an AI agent.
4. Independent Verification: Any third party can traverse this chain from leaf to root and verify every signature and scope boundary using only open-source tools. No API calls to the issuing organization are required.

Comparative Analysis: The “Break-through”

3. Strategic and Societal Impact

European Digital Sovereignty

Currently, cross-organizational trust relies on proprietary “Identity-as-a-Service” (IDaaS) platforms dominated by a few non-EU providers. This creates a systemic strategic dependency. NOMOI provides a Sovereign Substrate: because it is a protocol based on open standards (IPFS, DNS, Ed25519), it allows European entities to establish trust networks independent of any single corporate vendor or foreign jurisdiction.

The AI Agent Gap (The “Agentic Economy”)

As we transition to an economy of autonomous AI agents, the world lacks a way to grant delegated authority to non-human actors safely.

• The Problem: Current API keys are “all-or-nothing.”
• The NOMOI Solution: NOMOI allows a human to issue a signed Mandate to an AI agent: “This agent is authorized to negotiate this specific contract, only for 48 hours, and only up to a value of €10k.” NOMOI provides the essential safety valve for the AI economy, ensuring AI agency is always bound by human-signed, revocable mandates.

Alignment with EU Policy Priorities

NOMOI is a direct technical enabler for several key EU mandates:

• CSDDD & EU Battery Regulation: Provides the only viable open standard for the “digital product passports” and supply chain traceability required by law.
• DORA (Digital Operational Resilience Act): Ensures that financial authorization chains are auditable and resilient, not dependent on a single point of failure.
• eIDAS 2.0: Complements the EU identity framework by providing the authorization layer that identity alone does not solve.
• EU AI Act: Provides the technical mechanism to ensure AI agents operate within legally mandated bounds of authority.

4. Validation Path: Use Case Pilots

NOMOI will be validated through three high-impact pilots, each targeting a different verification context.

Pilot 1: Verifiable Supply Chain Compliance (Primary)

• Scenario: A brand delegates audit authority to a firm; the firm certifies a supplier; the supplier attaches this proof to a shipment.
• Goal: Demonstrate that a consumer or regulator can verify a product’s provenance back to the root authority without contacting any intermediate party.
• Policy Alignment: CSDDD and EU Battery Regulation.

Pilot 2: Cross-Organizational Financial Authorization

• Scenario: A corporate parent delegates payment authority to a subsidiary, verified instantly by a banking platform.
• Goal: Eliminate the need for manual “Letter of Authority” documents and bespoke API integrations between corporates and banks.
• Policy Alignment: DORA and eIDAS 2.0.

Pilot 3: Physical Access Control & Facility Authorization

• Scenario: A facility manager issues scoped mandates to contractors for specific zones and time windows.
• Goal: Create a permanent, immutable record of who was authorized to be where, and by whom, removing the reliance on proprietary badge systems.
• Policy Alignment: Critical Infrastructure Protection.

5. Path to Open Standardization

NOMOI is designed to be a “public good” infrastructure. The goal is not a proprietary product, but a royalty-free international standard.

Target Bodies:

• IETF: For protocol specification and wire format (RFCs).
• W3C: For alignment with Verifiable Credentials (VC) and web integration.
• ETSI: For integration with European trust frameworks and eIDAS 2.0.

Execution Sequence:

1. Proof-of-Concept: Delivery of the three pilots to generate real-world telemetry.
2. Reference Implementation: An open-source Go-based implementation with a comprehensive test suite.
3. Interoperability Testing: Demonstrating that independent implementations can verify the same mandate chains.
4. Standardization Submission: Submission to IETF/W3C backed by empirical evidence from the pilots.

6. The Consortium Structure

To move from specification to standard, NOMOI requires a balanced, multi-stakeholder ecosystem. We seek partners across three critical pillars:

1. The Technical Anchor (Research Institutions): Experts in applied cryptography and distributed systems to provide formal security analysis and academic credibility.
2. The Market Validators (Industry Partners): Logistics, manufacturing, and financial firms to define operational requirements and participate in the pilots.
3. The Regulatory Anchor (Public Sector): Regulators or agencies to ensure the protocol meets legal evidence standards and aligns with EU policy.

7. Why Public Funding?

NOMOI is infrastructure, not a product. Like DNS or TLS, its value is derived from its universality.

No single private company has the incentive to build an open standard for authority delegation that benefits its competitors equally. No single industry has the scope to validate a protocol that must work across supply chains, banks, and government agencies simultaneously.

Public funding is required to solve a systemic infrastructure problem that the market cannot self-organize to solve. The investment provides a missing layer of the internet—one that makes authorization as verifiable and secure as HTTPS made communication.

NOMOI — Verifiable delegation for a world that needs to remember what it authorized, who authorized it, and why.