Access attestation envelope
Scope
The envelope is not a credential and not a credential data model. It records that a presentation occurred, what was disclosed, against what credential, and what the verifier determined. The verifier generates it at presentation time; generating one does not make the verifier an issuer. Signing follows COSE (RFC 9052), specifically COSE_Sign1. Encoding is deterministic CBOR per RFC 8949 Section 4.2, profiled for access devices. The envelope binds to the presented credential’s own trust anchors, category by category: the Document Signer Certificate for a mobile driver’s license, the ICAO Public Key Directory for a passport, the eIDAS framework for a European credential, the Foundation’s governance roots for an NFID-aligned credential. It never re-roots the issuer’s chain.
Operational properties
Each ratified specification carries commitments on privacy (the deployment holds no stable, deployment-specific identifier for the holder, because it issued nothing; schema-level disclosure constraints; decline-for-insufficient-disclosure as a defined outcome), revocation (issuer-side and access-side paths kept separate, the access-side path under a defined propagation contract), audit (federated chain, tenant data stays with the tenant), and offline operation (deterministic policy on cached trust data with bounded freshness; reconciliation on reconnect; egress and life-safety paths never depend on audit-buffer state). Sections 6.1 through 6.4 of the paper state them in full.
Public review
No review period is open.
Want to be notified when this specification opens for public review? Register on the Participate page.
Disposition log
No review periods recorded yet.
Text
Not yet published.
Related
Paper reference: Section 5.1 of Beyond Credentials (Beyond Credentials)
Adjacent standards: