01 · The legal company
Whose name is this?
The Corporate Digital Name states its legal or governance basis. Rootz uses a Delaware DBA that references its cryptographic address.
Who authorized it?
Your company's authority, checkable by anyone who receives your work.
When work arrives from your company — a contract, a payment, an agent's result — the person receiving it, or their AI, will ask who authorized it. CorpID is where that answer leads: your company's own digital name, and a public record of who and what it has authorized and revoked, and when.
Live reference specimen
Rootz Corp.Corporate Digital Name
Rootz Corp.
0xD36AAf65a91bB7dc69942cF6B6d1dBa4Ef171664
Corporation→Digital name→Board governance→Authorize / revoke→Signed actions
Legal entity
Referenced
Digital name
Asserted
Authority record
Public
What's missing today
Companies already make their own keys. Strangers can't tell whose they are.
For decades a company could run its own certificate authority and declare its own root inside its walls. What it could not do was give an outsider a way to connect that root to the legal company. CorpID is that connection.
02 · Root control
The company holds the root
Board-governed keys or a smart account control the name. Microsoft, Google, a CA, Rootz itself or any other vendor is infrastructure or evidence underneath it.
03 · Authorize and revoke
Say who may act — and when that ends
Publish which credentials, providers, people, machines and agents may act for the company, and when that authority ends.
Why blockchain
Blockchain is not the authority. The corporation is.
The chain is simply a place the company controls, that anyone can read, and that outlasts the vendors and credentials it may later replace or revoke. Don't take our word for it: the Rootz specimen's root is a 2-of-3 Safe on Ethereum, and its acts are shown live at /verify/rootz. Open the transaction.
The company stays in charge
Shareholders govern through the board. The board sets the authority policy . The policy controls the Corporate Digital Name and the keys or smart account that can change it. The company can rotate directors, officers, cloud providers and credentials without changing its name.
Why not make Microsoft, Google or a CA the root?
Because each is replaceable infrastructure. A self-declared enterprise PKI root, a Microsoft tenant, a Google organization, a domain or an externally issued CA certificate is a credential, claim or infrastructure binding under the corporation. None becomes the authority over the corporation.
Who may act — now, and then
The Corporate Digital Name is the stable place to find current and past authority: which company PKI root is recognized, which identity provider is bound, which agent has scope, and which key or credential has been revoked.
Why does history matter?
The person relying on an old message needs to know whether the signer was authorized at that moment, not merely whether they are authorized today. So CorpID keeps every authorization and revocation as a lasting record, not a checkbox that can be quietly flipped.
Keep what you have
Your existing systems sit underneath the company's root.
Enterprise PKI, Entra, Google, AWS, Okta, hardware credentials, HSMs, external CAs and Epistery can all contribute credentials or evidence. None becomes the authority over the corporation.
Legal corporation
ACME Corporationlegal person and registry evidence
Principal
Corporate Digital Name
corp:acme:0x8A…41F2durable cryptographic name
Root
Board authority policy
Digital Authority Policy v3who may authorize, revoke, rotate and delegate
Governed
Enterprise PKI root
Self-declared corporate root certificateauthorized infrastructure beneath CorpID
Authorized
External CA claim
DigiCert / other certificatethird-party issued evidence; optional and subordinate
Evidence
AI evaluation agent
gpt-eval-prodscope: test Rootz endpoints · expires in 60 minutes
Delegated
Old signing key
0x74…91C0historically authorized; no longer valid
Revoked
Illustration. ACME is an example company, not a customer.
Three acts
Register. Authorize. Revoke.
Each is a company act, governed by the board's rules and leaving a record anyone can check.
Register
This corporation adopts this Corporate Digital Name.
The company creates its name and states the legal and governance evidence that connects it to the corporation.
Authorize
This actor or system may act within this scope.
Bind enterprise PKI, cloud identity, people, machines or agents under explicit company authority.
Revoke
This authority has ended.
Publish the end of authority without depending on the provider or credential being revoked.
The person who signs
Every company act is signed by a person holding a title.
The title is what makes the act bind the company. It is also the one thing in business nobody can check. People don't do business — companies do, through authorized employees.
A business card, checked by nobody
The most widely used authority credential in business carries your name, your title and your company. It is company-issued, asserts authority to strangers, never expires, and is revoked by nothing. You leave, and the card keeps working.
The title is already required by federal rule — and never checked
The FinCEN beneficial-ownership certification completed when a company opens a bank account (31 CFR 1010.230, Appendix A) asks for the title of the person opening the account in box 3a. The entire evidentiary basis is the sentence “I hereby certify, to the best of my knowledge, that the information provided above is complete and correct.”
Name, title, signature. There is no mechanism anywhere to check it. This is not a missing standard — it is a mandatory field with no evidence behind it.
The same card, checkable
The employee creates their own address. The company authorizes it — title, scope, valid from, valid to — and can revoke it. The authorization expires. The key does not.
Why the employee creates the key, and not the company
Identity is created, not issued. Because the person generates the address themselves, the corporation never holds their key — so there is no custody to unwind at separation, and nothing to hand back.
When they leave, the authorization ends and the address remains theirs. They keep accruing authorizations from other companies against the same key, and can prove their own employment history without asking any former employer.
Subject
0xEEEE…00FFcreated and held by the person, not by the employer
Self-held
Title
Treasurerscope: sign:contracts · the box 3a field, with evidence behind it
Authorized
Identity grade
signed-message · examined · [document]how we came to hold it, whether anyone else can re-verify it, what issuance required
Measured
Period
2024-01-01 → 2026-01-01authority ended on separation
Revoked
A contract signed in 2025
still checks out, as of its own daterevoking authority ends it going forward; it does not rewrite the past
Valid then
The question
Was this person authorized, with this title, on the day they signed?
Today the honest answer is a photocopy in a filing cabinet and a business card still in circulation. Authority is always checked as of the moment of signing — never as of today.
The grade
It starts low, and the climb is the point
A day-one employee grades asserted / self-asserted with no factors — the company simply says so. It climbs as real evidence binds: a document examined, a credential whose issuer signature anyone can re-check, a device-bound credential with an activation factor.
The limit
We are never the grader of record
The company asserts its own grade. The recipient checks the evidence beneath it and may disagree. The grade measures the check the company performed — it is not a rating of the person.
For people and their AI
People won't check who authorized it. Their AI will.
So every page works twice: plain explanations for the person, and the same model in machine-readable form for their AI. The recipient decides — proceed, refuse, or send for review.
For a person
Every unfamiliar term has an (i): what it means, why it matters, what to do, what proves it, and how to recover or revoke it.
For their AI
Start at /.well-known/corpid.json, follow the schema, and read the same evidence the person sees. Do not infer company authority from a credential alone.
Part of the Rootz family: CorpID answers who authorized it; Rootz Receipts attaches the answer to an agent's result; Rootz Data Centers carries it in every exchange.
Start with the company's root
You already have identity systems. Give them one root the company controls.
Create the corporation record, establish the Corporate Digital Name, protect root control, publish governance, then authorize and revoke the systems and agents you already use.