I was a consultant on NASA's Data & Reasoning Fabric — the programme building the information substrate for autonomous flight over cities. My piece of it was the decentralized identity layer: the machinery that lets an aircraft, a vertiport and a third-party weather service prove to one another who they are and what they are permitted to do, with no central authority in the middle and, often, no network to ask.
Enabling a Data and Reasoning Fabric — NASA's own three-minute explanation of the programme, and the clearest short account of the problem the identity layer exists to serve. Watch the traffic in it: every beam between a vehicle, a building and a service is an exchange that has to be authenticated before anyone acts on it.
Original NASA footage and narration, re-cut here with an original instrumental bed written for this page and mixed underneath the voice track. NASA does not endorse this site.
Advanced Air Mobility is the premise that small autonomous aircraft will move people and cargo across a city the way road vehicles do now — including to places aviation has never served. The hard part is not the airframe. It is that keeping thousands of them safely apart requires millions of decisions a day, taken in the vehicle, at the edge and in the cloud, and a decision is only as good as the data behind it.
NASA's answer is not another central air-traffic system. It is a fabric: a self-sustaining, decentralized ecosystem where data and reasoning are published as services by many independent organizations, and any participant can discover and consume them. A web-like ecosystem, in the programme's own words, rather than a hub.
That architectural choice is what makes identity the interesting problem. A fabric with no centre cannot have a central identity provider without giving back exactly what decentralisation bought.
Every useful exchange in the fabric is a cross-organisational trust decision taken in seconds, by a machine, frequently without a network.
A delivery drone asks for a trajectory and gets one back from a reasoning service it has never spoken to before. A vertiport publishes a pad as occupied. A municipality publishes a noise constraint. A battery-health service tells an operator its aircraft cannot complete the leg it just accepted. In each case, someone has to answer three questions before anything is acted upon: who is this, on whose authority, and is that authority still good right now.
The obvious answer — a shared identity provider everyone federates to — fails on three separate counts. It is a single point of failure in a safety-of-life system. It is a single point of control that no commercial operator will accept, because whoever runs it can ground a competitor's fleet. And it is unreachable precisely when it matters: at the edge, mid-flight, on a degraded link.
So the identity layer had to make trust portable. Evidence travels with the participant; verification happens locally; the fabric keeps working when the network does not.
Eight pieces, each chosen so that a verifier can reach a decision from evidence it already holds.
Every participant — an operating company, a data service, an airframe, a human pilot-in-command, an individual software agent on the edge — holds a decentralized identifier it controls itself, resolvable to the public keys and endpoints needed to talk to it. Nobody issues it; nobody can quietly take it away.
Permission is expressed as signed statements from whoever is actually entitled to make them: a regulator attests airworthiness, an operator attests that an airframe is theirs, a vertiport attests a landing reservation. Checking one is a signature verification and a trust-path walk — no round trip to an authority that may not be reachable.
A machine-readable answer to "whose word do I take, and for what?" Each verifier chooses its own roots rather than inheriting a single global list, which is what keeps the fabric adoptable: no operator has to hand a competitor or a single agency the ability to ground its fleet.
Authority flows downward in narrow, short-lived, audience-bound grants — operator to vehicle, vehicle to onboard agent — each proving exactly what it may ask for and nothing more. Short lifetimes bound the blast radius of a compromised key without depending on a revocation server being online.
Keys are generated inside the secure element of the edge node and never leave it, with hardware attestation binding the identifier to the airframe it actually lives on. Rotation, transfer and recovery paths have to survive an aircraft being serviced, re-registered or sold.
Compact, cacheable, privacy-preserving status lists paired with short credential lifetimes, so a vehicle that loses its link keeps flying on evidence it already holds instead of failing closed at the worst possible moment — and converges the instant it reconnects.
Data services and reasoning services authenticate each other with the same identifiers used by the vehicles, so provenance rides along with the payload. A trajectory can be traced back through the exact feeds, versions and issuers that produced it.
Every decision-relevant exchange leaves a verifiable record. This is the difference between "the system decided" and an account an investigator or a regulator can actually reconstruct after the fact — which is the precondition for anyone certifying autonomy at scale.
None of the components above are unusual on their own. What made the work interesting is that the aviation context removes most of the shortcuts the identity world normally takes — the assumption of a reachable issuer, of generous latency budgets, of a single governing organisation, of participants who do not mind being correlated.
Designing against those five constraints simultaneously is the whole exercise. Relax any one of them and the problem becomes ordinary; hold all five and the architecture is forced.
Programme description on this page is drawn from NASA's published DRF material, credited above. The account of the identity layer is my own. Nothing here is a NASA publication and NASA does not endorse this site.