Verifiable Ownership and Provenance: The DPP Data Flaw Nobody Is Talking About

Verifiable ownership and provenance, working together, let us treat trust itself as infrastructure. By building on ERC725, the open identity standard behind LUKSO Universal Profiles, every product and every owner gets a cryptographically verifiable identity. Trust stops being a promise printed on a label and becomes a property of the system.

How verifiable ownership actually works

Every Digital Product Passport on the Universal Goods Protocol is a token minted on LUKSO. The architecture splits along a single principle: the parts that must be trusted live on-chain, and the parts that must stay flexible live off-chain.

• On-chain, the parts that must be trusted: ownership and identity.
• Off-chain, the parts that must stay flexible: lifecycle data and documentation.

Users and brands operate through Universal Profiles, smart-contract accounts that they own outright. There is no intermediary sitting in the middle, and no platform that can revoke their access. The account, and the products held in it, belong to the holder.

Because every passport is a token, its chain of custody is public and verifiable from the moment it is created:

• A brand mints the passport, and the brand's Universal Profile is recorded as the issuer.
• A consumer claims the product, and their Universal Profile becomes the owner.
• The product changes hands by transferring between Universal Profiles.

This is what enables verifiable ownership, and verifiable ownership is what makes a circular economy possible at scale. You cannot resell, refurbish, or recycle at volume if no one can prove who owns what. It is also the foundation for what is coming with AI agents, but more on that shortly.

Trust as a secondary security layer

Treating trust as infrastructure gives us a security layer that sits underneath three things that badly need one:

• Secondary marketplace transactions.
• Proving authenticity.
• Agentic commerce.

In each case the underlying question is the same: is this product real, and does this person actually own it? A verifiable identity answers both without anyone having to trust an intermediary's word for it. The proof travels with the product.

But there is a flaw, and it comes from the regulation itself

Now look again at which half of the passport the regulation actually leans on. Ownership and identity are trustless by construction, secured on-chain. The weakness lives in the other half. The EU's Digital Product Passport framework largely takes brand lifecycle data claims, the off-chain half, at face value. The figures a brand enters about a product's materials, origin, and footprint are trusted by default. Nobody verifies the original data until a regulator flags it, which is often long after the product is already in the market.

That turns verification into an exception-handling process. The default state is unverified. A passport can be fully compliant on paper and still rest on numbers that no independent party ever checked. For a system meant to underpin resale, authenticity, and autonomous transactions, an unverified default is a foundation with a crack in it.

Verification belongs at the point of entry

The fix is structural. Lifecycle data should be verified at the point of entry, the moment it first enters the passport, rather than audited reactively after a complaint. Verification at the source means every passport begins from a checked foundation instead of a trusted assumption. This is part of what Scout, our AI supplier agent, is built to do: validate data as it is gathered, not after the fact.

“Verification should be the default state of a Digital Product Passport, not an exception triggered by a regulator.”

A public good, funded by the Universal Goods Foundation

A verification layer for what billions of products are made of cannot be a private profit centre, any more than the record of who owns them can. We aim to establish this verification system as a public good, funded by the upcoming non-profit Universal Goods Foundation, based in Switzerland. The infrastructure that decides whether a product's claims are true should answer to the public it protects, not to a single company's bottom line.

Verifiable ownership tells you who holds a thing. Provenance tells you where it has been. Point-of-entry verification makes sure both are true from the start. Together they form the trust layer that physical commerce, and the agents about to operate within it, have never had.