# Architecture Overview

zkMe Protocol is a decentralized, permissionless, and composable zk-Identity Layer designed to unify, standardize, and process digital identities across all ecosystems, spanning all chains and Web2 environments. It leverages a combination of Zero-Knowledge Proofs (ZKP), Fully Homomorphic Encryption (FHE), Multi-Party Computation (MPC), and zkTLS technologies to enable truly universal, secure, and versatile verification, management, and monetization of credential data.

As zkMe evolves into the Identity and Open Finance Kernel for the Agent Economy, its architecture is organized around three core pillars: **Secure**, **Underwrite**, and **Gate**, powering secrets management, trustless credential verification, and enclaved session permissions respectively.

***

## The Three Pillars

### Secure: Protect Data

The **Secure** pillar provides the foundational infrastructure for protecting user and agent data. It encompasses Self-Sovereign Identity (SSI), the zkMe DID Method, the encrypted zkVault, Fully Homomorphic Encryption (FHE), zkPassport, zkTLS, and the on-chain Smart Contracts. Together, these components ensure that sensitive data never leaves the user’s control and that all cryptographic operations occur in privacy-preserving environments.

For AI agents, the Secure pillar means that secrets (API keys, payment credentials, private keys) are stored in an AES-256-GCM encrypted zkVault and are only ever decrypted inside hardware Trusted Execution Environments (Intel SGX / AMD SEV). The agent itself never holds plaintext credentials in its own memory.

### Underwrite: Verify Data

The **Underwrite** pillar transforms raw data into trustless, verifiable credentials. The [Credential System](/hub/how-built/credential-sys.md) is the core of this pillar, providing the issuance, verification, and lifecycle management infrastructure for all zkMe credentials. It supports [Selective Disclosure](/hub/how-built/credential-sys/selective-disclosure.md), [Reusable Credentials](/hub/how-built/credential-sys/reusable-credentials.md), and [Agent-Ready Credentials](/hub/how-built/credential-sys/agent-ready-credentials.md).

### Gate: Agent Execution

The **Gate** pillar enables AI agents to act on verified credentials through the [Agent Trust Gateway](/hub/how-built/agent-trust-gateway.md). The gateway evaluates agent credentials in real time, enforces policy decisions at the session level, and executes sensitive operations inside TEE enclaves. It supports the [8-step Agent Session Flow](/hub/how-built/agent-trust-gateway/agent-session-flow.md), [MCP Server integration](/hub/how-built/agent-trust-gateway/supported-protocols.md), OAuth2/PKCE authentication, PASETO v4 token signing, and immutable audit logging.

***

## Component Map

### Secure Pillar: [Identity Infrastructure Stack](/hub/how-built/id-infra.md)

<table><thead><tr><th width="139.123046875">Component</th><th width="286.58203125">What It Does</th><th width="203.87890625">Key Technology</th><th>Learn More</th></tr></thead><tbody><tr><td><strong>zkMe Identity Chain</strong></td><td>Purpose-built L1 for identity settlement and credential state anchoring</td><td>CometBFT PoS, EVMOS EVM, Decentralized Storage Providers</td><td><a href="/pages/PJXVg6WY3BJmBfUHiv0R">Identity Chain →</a></td></tr><tr><td><strong>Self-Sovereign Identity</strong></td><td>Defines the trust model and role relationships (Credential Issuer, ZKP Issuer, Holder, Verifier, Regulator). Provides the SSI Wallet (zkMe App) for credential custody and on-device ZKP generation.</td><td>W3C VC, MPC key management, OCR, facial recognition</td><td><a href="/pages/o5SSNX9sDYwphgFAcwh6">SSI →</a></td></tr><tr><td><strong>DID Method</strong></td><td>On-chain registry for <code>did:zkme</code> decentralized identifiers. Enables creation, resolution, update, and deletion of DIDs linked to EVM addresses.</td><td><code>did:zkme</code> specification, Solidity smart contract</td><td><a href="/pages/LML1W5eTUQFeh1LmmkzZ">DID Method →</a></td></tr><tr><td><strong>zkVault</strong></td><td>Encrypted secrets storage combining TEE-based key hierarchy with threshold encryption. For agents, secrets are decrypted only inside hardware enclaves. For regulatory compliance, threshold encryption ensures no single party can access raw data alone.</td><td>AES-256-GCM, EC-ElGamal threshold encryption, TEE (Intel SGX / AMD SEV), Shamir’s Secret Sharing, IPFS</td><td><a href="/pages/m4fOGTqZi9hQL5OxAiMy">zkVault →</a></td></tr><tr><td><strong>FHE</strong></td><td>Fully Homomorphic Encryption enabling computation on encrypted facial feature vectors. Powers the Face-to-DID creation process where biometric data is never exposed in plaintext.</td><td>CKKS scheme (Cheon-Kim-Kim-Song)</td><td><a href="/pages/f35ffdG0aa8TTzBKrzoA">FHE →</a></td></tr><tr><td><strong>zkPassport</strong></td><td>Privacy-preserving ePassport verification. Reads NFC chip data, performs Active Authentication, and generates ZKPs from ICAO 9303 passport data without exposing the raw document.</td><td>NFC, ICAO 9303, Active Authentication, zk-SNARKs</td><td><a href="/pages/ZLerOKZiiLOaghojUycc">zkPassport →</a></td></tr><tr><td><strong>zkTLS</strong></td><td>Bridges Web2 data sources (bank accounts, credit scores, government portals) by generating zero-knowledge proofs from standard HTTPS sessions. Enables trustless attestation of off-chain data.</td><td>TLS 1.2/1.3, MPC-based session splitting, zk-SNARKs</td><td><a href="/pages/MPIrpl18CtFcUr3n3dl3">zkTLS →</a></td></tr><tr><td><strong>Smart Contracts</strong></td><td>On-chain contract suite managing credential state (Merkle roots, revocation), cross-chain relay, and the Mint/Delegate/Verify/Certify lifecycle. Deployed across all supported chains.</td><td>Solidity, SBT, cross-chain relay</td><td><a href="/pages/ntNN2rwFAnwNtrVd2Z6w">Smart Contracts →</a></td></tr></tbody></table>

### Underwrite Pillar: [Credential System Stack](/hub/how-built/credential-sys.md)

<table><thead><tr><th width="129.22265625">Component</th><th width="289.484375">What It Does</th><th width="169.05078125">Key Technology</th><th>Learn More</th></tr></thead><tbody><tr><td><strong>Core Concepts</strong></td><td>System architecture (4-layer model), credential data model (W3C VC, JSON-LD), Claim Tree and Merkle commitment model, complete credential lifecycle (issuance, verification, revocation, expiration), and cryptographic assumptions.</td><td>W3C VC, Sparse Merkle Tree, Poseidon hash, Baby JubJub curve</td><td><a href="/pages/W65KJZ9MjLTqFBYJjz4k">Core Concepts →</a></td></tr><tr><td><strong>Selective Disclosure</strong></td><td>Fine-grained privacy control allowing Holders to reveal only specific credential fields. Supports 14 query operators including range matching, set membership, and field extraction. Gas-optimized on-chain verification via circuitQueryHash compression.</td><td>ZK Query Language, SD operator, circuitQueryHash</td><td><a href="/pages/d6tRIsT26ysfJWhHvUkI">Selective Disclosure →</a></td></tr><tr><td><strong>Multi-Credential Proofs &#x26; Delegation</strong></td><td>Batch verification of up to 10 queries across multiple credentials in a single proof. Cross-chain identity portability via Delegated Proofs bound to secondary addresses or AI agent DIDs.</td><td>LinkedMultiQuery10, Delegate SC, Soulbound Token</td><td><a href="/pages/lqy5IoZwUUh5MOPIYBGN">Multi-Credential Proofs &#x26; Delegation →</a></td></tr><tr><td><strong>Anti-Sybil Mechanisms</strong></td><td>Nullifier-based uniqueness enforcement for "one person, one action" guarantees. Unified authentication supporting both BabyJubJub keys and standard Ethereum wallet signatures. Unified SIG/MTP circuit.</td><td>Nullifier, unified authentication, Groth16 zk-SNARK</td><td><a href="/pages/T4yM5WNiPJULaV1LsRAU">Anti-Sybil Mechanisms →</a></td></tr><tr><td><strong>Reusable Credentials</strong></td><td>“Verify Once, Prove Anywhere” paradigm. Cross-chain credential portability via Delegate smart contracts. Context-specific proof generation prevents replay.</td><td>Delegate SC, cross-chain relay, nonce-bound proofs</td><td><a href="/pages/oBuvDcDDLHpY44jpgyUf">Reusable Credentials →</a></td></tr><tr><td><strong>Agent-Ready Credentials</strong></td><td>Credentials optimized for AI agent consumption. Cryptographic delegation protocol, machine-readable JSON-LD schemas for LLM parsing, and automated proof generation.</td><td>Constrained proxy credentials, JSON-LD, Agent Trust Gateway</td><td><a href="/pages/nBMLaHWcG5quqLsTZ7jG">Agent-Ready Credentials →</a></td></tr></tbody></table>

### Gate Pillar: [Agent Trust Gateway Stack](/hub/how-built/agent-trust-gateway.md)

<table><thead><tr><th width="124.78125">Component</th><th width="297">What It Does</th><th width="177.82421875">Key Technology</th><th>Learn More</th></tr></thead><tbody><tr><td><strong>Gateway Overview</strong></td><td>Authorization and policy enforcement layer for AI agents. TEE Enclave for confidential execution, Policy Engine for user-defined constraints, Credential Verifier for on-chain validation, Protocol Adapters for ecosystem integration.</td><td>TEE (Intel SGX / AMD SEV), Remote Attestation</td><td><a href="/pages/0woRBBo2YnaWzOzO8P4z">Gateway Overview →</a></td></tr><tr><td><strong>Agent Session Flow</strong></td><td>The complete 8-step session lifecycle: Initiation → TEE Ingress → Credential Verification → Policy Evaluation → Human-in-the-Loop → Context Provisioning → Execution Proxy → Audit Logging.</td><td>PASETO v4, OAuth2/PKCE, append-only audit ledger</td><td><a href="/pages/J1wX5oMRHA6tgswBDLHk">Session Flow →</a></td></tr><tr><td><strong>Supported Protocols</strong></td><td>Native adapters for MCP (AI agent communication), APF/x402 (agent payments), W3C VC/DID, ERC-8004 (agent reputation), OIDC4VP (Web2 bridge), zkTLS, and PASETO.</td><td>MCP, x402, ERC-8004, OIDC4VP, PASETO</td><td><a href="/pages/ILcCUPggXSlTCoqHd5hU">Protocols →</a></td></tr></tbody></table>

***

## Integration Tools

For developers integrating with zkMe, the following tools provide the primary interfaces. Detailed documentation is available in the Getting Started section.

<table><thead><tr><th width="176.66015625">Tool</th><th width="414.609375">Description</th><th>Documentation</th></tr></thead><tbody><tr><td><strong>zkMe Widget / SDK</strong></td><td>JavaScript SDK for embedding credential verification into web applications. Desktop browser component with mobile QR code support.</td><td><a href="/pages/HmI3NcewisUG6cFLJfKF">JS SDK →</a></td></tr><tr><td><strong>Mobile SDK</strong></td><td>Native mobile SDK for iOS and Android integration.</td><td><a href="/pages/J9ZYF1n4LInw2fjE37bS">Mobile SDK →</a></td></tr><tr><td><strong>zkMe Dashboard</strong></td><td>Management interface for Verifiers to configure verification profiles, define eligibility rules, and access analytics.</td><td><a href="/pages/Y11BD2EPmGOjk1nIPflZ">Dashboard →</a></td></tr><tr><td><strong>zkMe API</strong></td><td>RESTful API for programmatic access to KYC and KYT verification, user management, risk assessment, and transaction analysis.</td><td><a href="/pages/RNWJoxfT8FefhmffencP">API Reference →</a></td></tr></tbody></table>

***

## High-Level User Stories

See the dedicated [**High-Level User Stories**](/hub/how-works/architecture/user-stories.md) page for detailed narratives covering the Holder, the Agent, the Verifier, the Regulator, and the Credential Issuer.

## Supported Chains

See the dedicated [**Supported Chains**](/hub/what/kyt/support-scope.md) page for the full list of blockchain networks where zkMe smart contracts are deployed and configurable via the dashboard.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.zk.me/hub/how-works/architecture.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.