What happens before an agent gets an identity

Picture a small accounting firm in Nashik. It files GST returns for local shopkeepers, and last year it built an agent to do the dull part. The agent reads a client's sales sheet, prepares the monthly return and, once a partner says go, sends it to the tax office's filing system.

One morning a return arrives from that agent. The tax office's system has a few seconds and a handful of questions. Is this agent a real one? Which firm sent it? If the figures turn out to be wrong, who do we ring?

At the moment the system can't answer. It sees a login and a file. We're setting up a non-profit to make the answers checkable, and this piece walks through the part that happens before any office gets involved: how an agent gets its identity in the first place.

The firm comes first

The agent isn't the first thing we'd look at. The firm is.

In our plan, Saakshya registers the individual, company or institution behind each agent. So the firm would tell us who it is: how it's registered, who its partners are, and who is allowed to speak for it. Then we'd check its documents.

The reason for that order is plain. An identity that names nobody is worth very little to an office. The tax office doesn't want to know that "an agent" filed the return. It wants a person or a firm it could write to, one that agreed in advance to answer for what the agent does.

A sole practitioner and a firm with a hundred staff are both possible applicants. We haven't decided whether they'd go through the same checks.

Then the agent's own details

Once the firm is registered, it describes the agent. What the agent is called, what it's for, and which firm it belongs to. We look those details over.

If they hold up, we issue the agent an identity.

That's the whole sequence. Two checks, then something issued. We're keeping this piece at the level of the process, and we're not describing how an identity is built inside, because that isn't ready to be said.

What the tax office gets

Back to the morning. The next return from the Nashik firm's agent arrives, and this time it carries the agent's identity.

The tax office's system checks it, and the check works offline, through an SDK. In plain terms, the office adds a small piece of software to its own system, and the check happens there, without a call to anyone while the return waits.

What does the office learn? Whether the agent is real. Which firm sent it. And, because it now has a name, there is a record to look at later if somebody asks what happened. Those are the three questions in the picture, and an office can put them to any agent that arrives, from any firm.

That last part matters more than it sounds. Today a tax office, a hospital or a bank would need some arrangement with each company that builds agents. With a shared register, one kind of check covers all of them. We wrote about why a register has to sit outside any one company in a separate piece, and about the office's side of the desk in who the relying party is.

What an identity doesn't do

It doesn't make the return correct. It doesn't promise the agent is any good, or that the firm is honest about everything else. It says who is answerable. Whether the numbers add up is still down to the firm, and the tax office keeps its own checks.

It also isn't a login. We covered the difference in what agent identity is.

So think of it as the line on a form that says whose signature this is. The line doesn't tell you the form is right.

Where this stands today

Nothing is running. We have a reference implementation and a lot of questions. The foundation that would do the registering is something we're setting up, and it doesn't exist as a company yet, so there is nobody to apply to and nothing is due from anyone.

If you run a firm that builds agents, or sit at a desk that receives their requests, we'd like to hear what you'd want to see in each step. The contact page has the addresses.

What we don't know

Quite a lot, and it's better said now.

We don't know which documents we'll ask a firm for. That depends on who applies, and on what offices tell us they'd trust. We don't know how long registration will take, so we won't promise a number. A firm of two partners and a firm of two hundred may need different handling, and we haven't worked out how.

We don't know how many tax offices, hospitals or banks will check an identity at all, as opposed to accepting the request and hoping. A desk with a queue is tempted to skip it. We'd like to hear from people who sit at that desk before we guess.

And we don't know how an organisation shows that the person applying really speaks for it. That one worries us. A careful process that registers the wrong person's firm is worse than no process.

The foundation isn't incorporated yet. No government body or company has endorsed this, and the steps above may change when the people who'd use them have read them.