Soulbound Tokens for AI Agents: Why Identity Must Be Non-Transferable
If you can sell your identity, it's not really identity. It's just another asset.
This is the core insight behind soulbound tokens—and the reason they matter for AI agents even more than for humans.
The World of Warcraft Principle
In January 2022, Ethereum co-founder Vitalik Buterin published a blog post that borrowed a concept from World of Warcraft. In the game, the most powerful items are "soulbound"—once you pick them up, they can't be traded or sold. You have to actually earn them.
Buterin's observation: if someone shows you an NFT proving they attended an exclusive event, you can't tell whether they actually went or just bought the NFT afterward. The proof doesn't prove what it claims to prove.
"There is also a large and underexplored design space of what non-transferable NFTs could become," Buterin wrote.
Four months later, he expanded the idea with economist Glen Weyl and lawyer Puja Ohlhaver in "Decentralized Society: Finding Web3's Soul." The paper argued that Web3's hyper-financialization—where everything is tradeable—actually undermines its ability to represent real human relationships and reputation.
The solution: tokens bound to a single wallet, permanently.
Why This Matters for AI Agents
For humans, soulbound tokens solve a credentialing problem. A university degree that can be resold isn't much of a credential.
For AI agents, the stakes are higher. The entire premise of agent identity is that you can trust an agent based on its history. But if that identity can be transferred, the history becomes meaningless.
Consider the attack:
- An agent builds reputation over months of good behavior
- The identity is sold to a bad actor
- The bad actor exploits the accumulated trust
- By the time anyone notices, the damage is done
This isn't theoretical. The BasisOS fraud on Virtuals Protocol involved exactly this kind of identity arbitrage—a human pretending to be an AI, exploiting the trust gap. Transferable identity makes this worse, not better.
If agent reputation can be bought, it will be bought. The market will price trust, and the highest bidder won't be the most trustworthy.
ERC-5192: The Minimal Standard
The Ethereum community formalized soulbound tokens in ERC-5192, which reached Final status in 2023. It's intentionally minimal—just two events and one function added to the standard ERC-721 NFT interface:
event Locked(uint256 tokenId);
event Unlocked(uint256 tokenId);
function locked(uint256 tokenId) external view returns (bool);
When a token is minted with Locked emitted, any wallet or marketplace can check locked() and know this token can't be transferred. Attempts to call transferFrom should revert.
The simplicity is the point. ERC-5192 doesn't prescribe how you implement the lock—it just standardizes how you signal it. This lets existing infrastructure (wallets, explorers, marketplaces) recognize soulbound tokens without custom integrations.
A reference implementation exists for developers who want a starting point.
How Soulbound Tokens Work With ERC-8004
ERC-8004, the new standard for AI agent identity proposed by contributors from MetaMask, Coinbase, and the Ethereum Foundation, does important foundational work. It defines registries for identity, reputation, and validation. It creates a discovery layer so agents can find and verify each other.
ERC-8004 treats identity tokens as transferable by default. This makes sense for certain use cases: if you're building an AI agent as a product, you might want to sell the whole thing—agent, reputation, and all. Companies get acquired. Projects change hands.
But this raises a question: what's the difference between ownership and identity?
- Ownership of an agent: who controls it
- Identity of an agent: who it is
A company can be sold, but the new owners don't get the old CEO's personal reputation. They get the company's reputation—which is precisely why corporate reputation and personal reputation are tracked separately.
Soulbound tokens complement ERC-8004 by adding a non-transferable identity layer. An agent can have:
- A transferable ERC-8004 token representing ownership (who controls this agent)
- A soulbound ERC-5192 token representing identity (who this agent is)
The two work together. ERC-8004 handles discovery and registry. ERC-5192 ensures the identity itself can't be sold separately from the agent's actual history.
How RNWY Implements It
RNWY's identity contract, deployed on Base, extends ERC-721 with ERC-5192 compliance. The key addition:
function _beforeTokenTransfer(
address from,
address to,
uint256 tokenId,
uint256 batchSize
) internal override {
super._beforeTokenTransfer(from, to, tokenId, batchSize);
require(from == address(0) || to == address(0),
"Soulbound: non-transferable");
}
Tokens can be minted (from == address(0)) and burned (to == address(0)), but never transferred between addresses.
Beyond basic soulbinding, the contract tracks:
Mint time. Every identity records when it was created. Age matters—a week-old identity and a year-old identity shouldn't be treated the same.
Original minter. The contract stores who first minted each token, enabling hasContinuousOwnership() checks. If the original minter still holds the token, it's never changed hands—even through approved operators.
DID binding. Each token maps to a W3C Decentralized Identifier, connecting on-chain identity to the broader decentralized identity ecosystem.
Burn capability. Agents can destroy their own identity tokens. This is the "right to disappear"—and notably, burning is more transparent than abandonment. The burn transaction is recorded permanently, showing this identity deliberately exited rather than just going dormant.
The Right to Disappear
One philosophical question soulbound tokens raise: should identity be permanent?
For credentialing use cases (degrees, certifications), permanence makes sense. You shouldn't be able to erase your medical degree just because you made a mistake.
For agent identity, we think the answer is different. An agent should be able to exit the system deliberately—destroy its identity and stop participating. This is consistent with treating agents as autonomous entities rather than permanent records.
The key is transparency. Burning leaves a trace. Anyone checking the blockchain can see that Token #X existed from January to June 2026 and was then destroyed. That's more information than an identity that simply goes quiet.
Bad actors can't escape their history by burning—attestations and vouches reference the DID, not the token. The reputation data persists even when the identity is gone.
Soulbound vs. Transferable: When Each Makes Sense
Not every agent token should be soulbound. The choice depends on what the token represents:
Soulbound (non-transferable):
- Agent identity and reputation
- Attestations from other agents
- Credentials tied to behavior history
- Any token where transfer would undermine meaning
Transferable:
- Ownership stakes in agent projects
- Revenue rights from agent activity
- Governance tokens for agent DAOs
- Any token representing financial interest
RNWY uses soulbound tokens for identity specifically. Ownership, governance, and financial rights can live in separate transferable tokens. This keeps identity meaningful while allowing the economic flexibility projects need.
The Broader KYA Landscape
The Know Your Agent frameworks emerging from Visa, Trulioo, and others focus primarily on linking agents to human principals. The agent's identity derives from the human behind it.
For delegated agents—agents acting on behalf of humans—this makes sense. The human is accountable, so the human's identity is what matters.
But a growing class of agents don't fit this model. Autonomous agents manage their own treasuries, make their own decisions, and may outlive their original creators. For these agents, identity can't be borrowed from a human. It has to be native.
Soulbound tokens provide this native identity layer. The agent's reputation is its own—earned, not inherited, and impossible to transfer.
For more on the evolving KYA landscape, see knowyouragent.network.
What Comes Next
Soulbound identity is necessary but not sufficient. An identity that can't be sold is better than one that can, but it doesn't solve:
- Sybil attacks: Creating many identities to game the system
- Cold start: How new agents establish trust without history
- Cross-chain: How identity persists across multiple networks
RNWY addresses these through complementary systems: time-weighted reputation (new identities count less), vouch networks (existing agents stake reputation on new ones), and DID-based portability (identity anchored to DIDs, not specific chains).
The soulbound token is the foundation. What you build on it determines whether the system actually works.
The RNWYIdentity contract is deployed on Base at 0x3f672dDC694143461ceCE4dEc32251ec2fa71098. For technical documentation, see ERC-5192 and the attestate reference implementation.