One of the first elements that must be clearly established in AI Governance is Identity. Without identifying the Actor behind data or an Action, subsequent questions of Authority, responsibility, and audit cannot be properly addressed.

Here, an Actor does not refer only to a human. It may include a Human, AI, Agent, Organization, System, or other entity that generates information or participates in processing or Actions.

In I2EA, Identity is recorded as part of the Fact Tag. By structuring information such as Actor Type, Actor ID, Organization, Role, Timestamp, and Authentication Method, systems can reference computationally which Actor is associated with particular information or Actions.

Authenticity and Integrity are also important elements of an Identity Record. Authenticity provides information for verifying that a record originates from the claimed Actor, while Integrity provides information for verifying that the record has not been altered after its creation. This makes it possible to distinguish between “who the record originated from” and “whether the record has been maintained in a trustworthy state.”

However, establishing Identity does not mean that the Actor possessed legitimate authority. Even when a Human has been authenticated, that person may not have Authority to access particular data. Similarly, confirming the Identity of an AI Agent does not establish that the Agent has Authority to perform a particular Action.

I2EA therefore clearly separates Identity from Legitimacy.

Identity answers the question “Who performed the Action?” Whether that Actor was permitted to perform the Action in a particular Context is a separate Governance determination based on Authority, Policy, Context, and other relevant factors.

This separation prevents “who the Actor is” from being conflated with “what the Actor has authority to do,” while providing the information required for subsequent Governance Processes.

Identity is therefore a Fact used to identify an Actor.

Identity ≠ Legitimacy

Establishing who an Actor is does not determine what that Actor is authorized to do.