A computing system (100, 200, 300, 400, 500) that is implemented in a decentralized network that implements a distributed ledger, the distributed ledger being configured to back one or more decentralized identities, DID, for one or more users of the computing system, wherein a DID is an identifier which is independent from a centralized registry, identity provider, or certificate authority, the computing system comprising: one or more processors; and one or more computer-readable media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, cause the computing system to: receive an indication that a first DID owner of a first DID desires to delegate use of the first DID owned by the first DID owner to a second DID owner of a second DID so that the second DID owner can act on behalf of the first DID owner in interactions (545, 555) with one or more third-party entities (540, 550); generate a signed claim that specifies that the first DID owner has delegated use of the first DID to the second DID owner, such that the signed claim identifies and includes the second DID to generate a relationship between the first DID and the second DID, wherein the signed claim is cryptographically signed by the first DID owner using a public and private key pair, the signed claim further defining a scope of permission (536, 536A-536D, 537, 538) for the second DID owner when the second DID owner uses the first DID on behalf of the first DID owner; provide the signed claim to the second DID owner, such that when the second DID owner uses the first DID, the second DID owner is allowed to act on behalf of the first DID owner in interactions with third party entities within the scope of permissions defined in the signed claim; and record in an identity hub (411, 526) of the first DID owner and/or the second DID owner an indicator (590, 595) that indicates that the first DID owner as owner has delegated use of the first DID to the second DID owner to thereby at least partially prevent the first DID owner from repudiating the delegation, wherein the identity hub is a data store in the exclusive control of a specific DID owner. one or more processors; and one or more computer-readable media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, cause the computing system to: receive an indication that a first DID owner of a first DID desires to delegate use of the first DID owned by the first DID owner to a second DID owner of a second DID so that the second DID owner can act on behalf of the first DID owner in interactions (545, 555) with one or more third-party entities (540, 550); generate a signed claim that specifies that the first DID owner has delegated use of the first DID to the second DID owner, such that the signed claim identifies and includes the second DID to generate a relationship between the first DID and the second DID, wherein the signed claim is cryptographically signed by the first DID owner using a public and private key pair, the signed claim further defining a scope of permission (536, 536A-536D, 537, 538) for the second DID owner when the second DID owner uses the first DID on behalf of the first DID owner; provide the signed claim to the second DID owner, such that when the second DID owner uses the first DID, the second DID owner is allowed to act on behalf of the first DID owner in interactions with third party entities within the scope of permissions defined in the signed claim; and record in an identity hub (411, 526) of the first DID owner and/or the second DID owner an indicator (590, 595) that indicates that the first DID owner as owner has delegated use of the first DID to the second DID owner to thereby at least partially prevent the first DID owner from repudiating the delegation, wherein the identity hub is a data store in the exclusive control of a specific DID owner. receive an indication that a first DID owner of a first DID desires to delegate use of the first DID owned by the first DID owner to a second DID owner of a second DID so that the second DID owner can act on behalf of the first DID owner in interactions (545, 555) with one or more third-party entities (540, 550); generate a signed claim that specifies that the first DID owner has delegated use of the first DID to the second DID owner, such that the signed claim identifies and includes the second DID to generate a relationship between the first DID and the second DID, wherein the signed claim is cryptographically signed by the first DID owner using a public and private key pair, the signed claim further defining a scope of permission (536, 536A-536D, 537, 538) for the second DID owner when the second DID owner uses the first DID on behalf of the first DID owner; provide the signed claim to the second DID owner, such that when the second DID owner uses the first DID, the second DID owner is allowed to act on behalf of the first DID owner in interactions with third party entities within the scope of permissions defined in the signed claim; and record in an identity hub (411, 526) of the first DID owner and/or the second DID owner an indicator (590, 595) that indicates that the first DID owner as owner has delegated use of the first DID to the second DID owner to thereby at least partially prevent the first DID owner from repudiating the delegation, wherein the identity hub is a data store in the exclusive control of a specific DID owner.