Dual-path trust model
Scope
Path one: ecosystem-issued credentials. Mobile driver’s licenses under ISO 18013-5 and 18013-7, ICAO 9303 passports, eIDAS 2.0 credentials. Each traces trust through its own infrastructure, and the Foundation extends trust to them through published rules: any issuing authority that meets the published criteria for its category is eligible. No hand-curated list. Path two: NFID-aligned credentials, for what governments do not issue. An employee badge, a contractor credential, an industry-specific authorization. Format is the W3C Verifiable Credentials Data Model 2.0, secured with COSE for embedded deployment or SD-JWT for OAuth-aligned ecosystems, issued through OpenID for Verifiable Credential Issuance. The Foundation operates no Decentralized Identifier (DID) method and no DID registry.
Operational properties
Each ratified specification carries commitments on privacy (the deployment holds no stable, deployment-specific identifier for the holder, because it issued nothing; schema-level disclosure constraints; decline-for-insufficient-disclosure as a defined outcome), revocation (issuer-side and access-side paths kept separate, the access-side path under a defined propagation contract), audit (federated chain, tenant data stays with the tenant), and offline operation (deterministic policy on cached trust data with bounded freshness; reconciliation on reconnect; egress and life-safety paths never depend on audit-buffer state). Sections 6.1 through 6.4 of the paper state them in full.
Public review
No review period is open.
Want to be notified when this specification opens for public review? Register on the Participate page.
Disposition log
No review periods recorded yet.
Text
Not yet published.
Related
Paper reference: Section 5.3 of Beyond Credentials (Beyond Credentials)
Adjacent standards: