identity.org.au

Proposed pilot policy · version 0.1

Trust starts with the issuer

A signature tells you who signed a claim. You still need a reason to rely on what they say.

This policy is a proposal for the membership pilot. No issuer is admitted through this page, and no real issuer registry is provided by the demonstration.

Admission before issuance

  • Identify the legal organisation, accountable contacts and authority to make the specific membership claim.
  • Document the evidence checked, eligibility rules, exception handling and how the credential binds to its holder.
  • Record allowed credential types, formats, assurance and maximum validity. A membership issuer is not automatically trusted for age, residency or government identity.
  • Establish key custody, rotation, compromise response, status publication and suspension procedures.
  • Agree privacy notices, accessibility, correction and complaint processes, retention and independent assurance requirements.

Decide trust per service and purpose

Each service accepts specified issuers for specified claims. Avoid a universal “trusted” badge. An issuer may be suitable for a workshop eligibility decision while unsuitable for a regulated financial identity check.

Checks before accepting a presentation

  1. Verify the issuer signature and approved key using the selected credential profile.
  2. Confirm the issuer is currently accepted for this credential type and purpose.
  3. Check credential validity and fresh status using the agreed status method. Unavailable required checks fail closed or route to the disclosed alternative process.
  4. Verify holder authentication and bind the presentation to the service, fresh challenge, session and intended request.
  5. Match the approved claim to the request and confirm the user's decision. Store only the agreed lawful receipt.

Change, suspension and recovery

Issuers must support corrections and replacement credentials. A suspected compromise suspends affected issuance or acceptance according to the agreed incident process. Revoking a credential is distinct from withdrawing a user's consent; neither silently deletes information already lawfully received.

Lost devices require an approved recovery or reissuance route. A successful device unlock alone does not establish the issuer's membership claim.

Responsibilities remain visible

The issuer is accountable for its evidence process. The relying service is accountable for its eligibility decision and retention. Wallet and infrastructure operators need defined operational, privacy and incident responsibilities. Cryptography does not remove those obligations.

For broader interoperability, the OpenID4VP specification describes presentation validation and issuer-trust considerations. Supporting that protocol would not by itself grant accreditation or government recognition.

Return to the pilot proposal · Download the proposed policy and readiness checklist