Airlines have spent years proving that wallet-based digital identity can work: a credential issued by one party, read and trusted by another, across airlines, airports and wallet providers. The next question is harder. As AI travel assistants start booking on behalf of travelers, how does an airline know the person behind the request is real, has consented, and is paying? And how do identity and payment come together in one step without the assistant ever handling a passport or a card number?
These are the questions Theodor Dimache is working on as part of IATA’s Data and Technology Proof of Concept program, where mindit.io collaborates with airlines and other technology partners within the IATA Strategic Partnerships Program. On 10–12 November, the working groups meet in Buenos Aires for the Data and Technology Proof of Concept Meeting, one of three in-person sessions in the yearly cycle, with Cycle 3 results set to be presented at the IATA World Data Symposium 2027. Ahead of the trip, we asked Theo what still stands in the way of digital identity becoming the default, how “Know Your Agent” could work in practice, and what airlines should be able to do once this cycle wraps up.
IATA’s PoCs have shown that wallet-based digital identity already works across airlines, airports and wallet providers. What’s still stopping it from becoming the default way people travel?
The pilots proved the hard technical part: a credential issued by one party can be read and trusted by another. What I think is missing is the moment that matters most to the airline, which is booking. Today you still type your passport number into a booking form, then show the same passport at the airport. One document, entered twice. Until the wallet is useful on booking day, not only at the gate, people won’t build the habit. There’s also a plain rollout reality: wallets are arriving market by market, and the two big phone platforms don’t yet agree on what a wallet can hand over in one go. Things become the default when the easy path and the trusted path are the same path.
AI travel assistants are starting to book on behalf of travelers. How does an airline verify that the agent is acting for a real, consenting person, and not just trust whatever it sends?
I’d flip the question a little. In the design the working group is building, the airline shouldn’t have to take the agent’s word for who the traveler is. The traveler’s wallet checks the assistant once, when the traveler delegates to it, an idea the industry is starting to call “Know Your Agent”, a nod to the banks’ Know Your Customer. Then at booking, the passport details and a card token (a stand-in for the real card number) go from the wallet straight to the airline, after the traveler approves with a fingerprint or a face scan. The assistant finds the flight; it never carries the documents. The standards for this are still forming, which is exactly why a cross-industry PoC is useful.
Identity can already be presented from a wallet in one click, but payment is still a separate step. What changes for the traveler and the airline once identity, consent, eligibility and payment happen in one motion?
For the traveler, it’s one approval instead of a string of forms: the phone’s own confirmation screen shows the passport, the card and the amount, and one fingerprint or face scan completes the booking. Using your loyalty status to get personalized offers stays a separate, earlier choice, and saying no still gets you normal results. For the airline, the order arrives complete, with the name exactly as it is on the passport, and the AI assistant never touches card data. Under the hood, identity and payment stay two separate pieces, because different rules govern them. One gesture for the person, two separate records for the system.
mindit.io works with banks, where identity verification and compliance are non-negotiable. What from that experience transfers directly to digital identity in aviation, and what doesn’t?
A lot transfers. The habits I’d carry over: treat “who you are”, “what you’re allowed to do” and “what you’re paying” as separate checks, tie every approval to a specific amount and a specific payee, keep card data out of every system that doesn’t strictly need it, and keep an evidence trail you can rely on when something is disputed. What doesn’t transfer is the relationship. A bank knows its customer for years and can re-check them at every login. An airline may meet a traveler once, through an intermediary, with a passport issued by another country, and the person paying isn’t always the person flying. Border-grade identity is a different bar than a bank login.
What do you expect the group to settle at the Data and Technology Proof of Concept Meeting in Buenos Aires, and what should airlines be able to do differently once Cycle 3 results are presented at the World Data Symposium 2027?
I’d like us to agree on the shape of the handshake between an assistant, a traveler’s wallet and an airline, not on a product. Wallets and payment networks are getting ready for AI agents; the airline side is the missing piece. In Buenos Aires that means narrowing down how an assistant asks an airline for offers, what the wallet hands over and in what form, how an approval refers to the amount and the airline, and what stays out of scope for now. After the Symposium, an airline should be able to answer a concrete question: a booking comes in from an assistant, with the traveler’s identity and payment arriving straight from their wallet, so what do we accept, what do we check, and what do we refuse? I’m also on the technical side of our fraud track in Cycle 3, which Ioan covers in his interview.
