diff --git a/agentscore/types.py b/agentscore/types.py
index cb50592..00be467 100644
--- a/agentscore/types.py
+++ b/agentscore/types.py
@@ -337,6 +337,18 @@ class AssessResponse(_AssessResponseRequired, total=False):
     # responses; omitted on denials to avoid leaking the linked set for flagged operators.
     # Capped at 100 entries.
     linked_wallets: list[str]
+    # Stable pairwise handle (``oph_...``) for the ACCOUNT behind a presented operator
+    # token. This is the identity durable merchant state should key on, because it survives
+    # the token rotating, expiring or being revoked: an ``opc_`` lives 24h and rotates
+    # silently off a 90-day refresh, so anything keyed on the token instance is stranded
+    # daily. Pairwise per consuming account, so the same buyer presents an unrelated handle
+    # to every merchant and handles never correlate across them.
+    #
+    # Carries no compliance meaning: a registration-only (``sign_in``) credential resolves
+    # the same as a KYC-backed one, so read the decision fields for policy. Present only on
+    # the operator-token path, and returned on denials too, since it is identity rather
+    # than a verdict.
+    operator_handle: NotRequired[str]
     verify_url: str
     policy_result: PolicyResult | None
     explanation: NotRequired[list[PolicyExplanation]]
diff --git a/pyproject.toml b/pyproject.toml
index 783045e..7cdb3c2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentscore-py"
-version = "2.6.4"
+version = "2.6.5"
 description = "Python client for the AgentScore APIs"
 readme = "README.md"
 license = "MIT"
diff --git a/uv.lock b/uv.lock
index b5d86e3..8a6d5a7 100644
--- a/uv.lock
+++ b/uv.lock
@@ -4,7 +4,7 @@ requires-python = ">=3.11"
 
 [[package]]
 name = "agentscore-py"
-version = "2.6.4"
+version = "2.6.5"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },