I've spent a decent amount of time looking at how Dusk handles identity with Citadel, and the more I sit with it the more it feels like a practical attempt at giving users actual control instead of another data dump.

You request a license from a provider they trust. They verify you off-chain, sign the attributes, and register an encrypted version on-chain. When you need access later, you generate a proof that you hold a valid registered license. The chain only records that a session happened. Nothing about your wallet, the specific license, or the personal details themselves. You then send a session cookie to the service, and they decide whether to let you in based on their own rules.

That split matters. Citadel doesn't pretend to set policy. The service still chooses which issuers it accepts, which attributes count, and whether something has been revoked. Users aren't handing over their full file every time. Institutions avoid storing the data themselves, which cuts cost and leak risk.

The obvious limit is that you still have to trust the license providers. If those stay few or concentrated, the "self-sovereign" part is thinner than it looks. Getting real services to integrate it is the harder part, not the cryptography. Cookies are also bearer-style, so reuse and binding have to be handled carefully on the service side.

It could change how permissioned markets work if enough parties actually use it. Or it could stay a nice tool that never leaves the finance niche.

Who do you think has to move first for this to matter at scale — users, issuers, or the services themselves?

#dusk $DUSK @Dusk $BTW $BR
#USStorageStocksExtendLosses #EthereumOpensGlamsterdamEarlyTestnet