Allen argues that Wyoming’s SF0039 — the first U.S. legal definition of digital identity — gives SSI enforceable legal grounding by anchoring it in the Laws of Agency rather than property law. Agency law governs peer-to-peer relationships rather than state-subject relationships, so “principal authority” imports centuries of common law precedent without enabling eminent domain or asset forfeiture over digital identity. Allen reorganizes the original 10 SSI principles into 15 named rights and duties across three legal categories, showing which derive automatically from principal status and which require explicit codification.
Agency law beats property law for self-sovereignty. Property law positions the state as ultimate arbiter — through eminent domain and asset forfeiture, states can reclaim “owned” property. Agency law creates peer-to-peer relationships mediated by the state. Grounding identity in principal authority rather than property rights prevents state sovereignty from overriding individual sovereignty over digital identity.
The 28-word definition imports centuries of precedent. Wyoming SF0039 defines personal digital identity as “the intangible digital representation of, by and for a natural person, over which he has principal authority.” That phrase — “principal authority” — quietly imports the duty framework from English Common Law: agents owe principals specificity, responsibility, representation, fidelity, and disclosure. No new law is needed; the phrase does the work.
Three legal categories replace ten aspirational principles. Allen reorganizes the original 10 SSI principles: four become rights inherent in being a Principal (existence, control, persistence, consent); six become duties identity agents must fulfill (access, transparency, portability, interoperability, minimization, protection); five derive from Agency law and may be imported automatically (specificity, responsibility, representation, fidelity, disclosure).
Current platforms violate agency duties by design. Banks, Facebook, and Google hold identity data but operate as service providers, not agents. Agency law would prohibit selling user data (secret profit), acting in the platform’s own interest against the principal’s, and processing identity data without disclosure. Structuring these relationships as agency — not service provision — would create enforceable obligations rather than opt-out rights.
Principal control has explicit limits. Principals control identification, authentication, data access, delegation, revocation, and continuity. They do not control reputation, external annotations, or identity records created by others (police records, credit reports). This bounded framing avoids overclaiming while still protecting the core of self-sovereignty.
The starting-place acknowledgment matters. Allen explicitly states this is “just a starting place” requiring development of digital identity customs through case law, industry practice, and multi-stakeholder processes — work he describes as generational in scope. This is not a minor caveat but a substantive claim about the timeline for SSI legal maturity.
“For self-sovereign identity to truly achieve international success, I feel that it needs to not just be embraced by the technological sector, but also to have a basis in law.”
“By saying that a Principal has the ultimate authority to control their digital identity, then that Principal may then delegate their authority under existing fiduciary Laws of Agency and Custom.”
“Wyoming’s digital identity law is the first example of legislation that focuses on using these laws in this way, rather than under Property Law.”
“These peer-to-peer relationships works within the context of a state who recognizes the concept of Principal Authority. Thus the use of Principal Authority to empower Self-Sovereign Identity provides a legal foothold for many of the original 10 #SSI principles.”
“Wyoming’s definition of personal digital identity helps us to lay more foundation for self-sovereign identity, but it’s still just a starting point.”
Published before Allen’s testimony to the Wyoming Select Committee on Blockchain (September 21–22, 2021), this article directly informed a working legislature. Wyoming SF0039 became effective July 1, 2021 — the first U.S. law defining personal digital identity with an explicit SSI orientation. No formal academic citation count is available from the source record; the article circulates in SSI legal scholarship and legislative drafting efforts rather than peer-reviewed literature. It provides a model jurisdictions outside Wyoming can adopt when legislating digital identity grounded in established common law frameworks rather than novel statutes.
analysis/library/2021-allen-principal-authority/