diff --git a/package.json b/package.json
index 5081d87..45b20f7 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@agent-score/sdk",
-  "version": "2.7.4",
+  "version": "2.7.5",
   "description": "TypeScript client for the AgentScore APIs",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
diff --git a/src/types.ts b/src/types.ts
index 4d20e5f..17bd4f4 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -310,6 +310,19 @@ export interface AssessResponse {
    *  Returned regardless of identity_method so agents can enumerate all wallets they could
    *  sign with to satisfy a wallet-auth claim. Capped at 100 entries. */
   linked_wallets?: string[];
+  /** Stable pairwise handle (`oph_...`) for the ACCOUNT behind a presented operator token.
+   *
+   *  This is the identity durable merchant state should key on, because it survives the
+   *  token rotating, expiring or being revoked: an `opc_` lives 24h and rotates silently
+   *  off a 90-day refresh, so anything keyed on the token instance is stranded daily.
+   *  Pairwise per consuming account, so the same buyer presents an unrelated handle to
+   *  every merchant and handles never correlate across them.
+   *
+   *  Carries no compliance meaning: a registration-only (`sign_in`) credential resolves the
+   *  same as a KYC-backed one, so read the decision fields for policy. Present only on the
+   *  operator-token path, and returned on denials too, since it is identity rather than a
+   *  verdict. */
+  operator_handle?: string;
   verify_url?: string;
   policy_result?: PolicyResult | null;
   explanation?: PolicyExplanation[];