did:web and did:key: identifiers for issuers and agents
Decentralized Identifiers (DIDs) are identifiers with an associated document of public keys. did:web publishes this document under a domain, did:key derives it directly from the key — two variants for two roles.
did:web for issuers
An issuer places its DID document at /.well-known/did.json; whoever controls the domain controls the keys. Mandact publishes its issuer key there, in addition to /.well-known/jwks.json.
did:key for agents
An agent needs no domain of its own: its identifier is the public key itself. Mandates bind to this key via cnf — whoever does not hold it cannot present the mandate.
Attested agents
Agent platform providers can attest their agents via did:web. Verifiers may admit only attested agents by policy (MD-502).
Status
Issuer DID at /.well-known/did.json; agent binding via did:key or did:web.