notes: events/talks/kericonf26-d2-02-feairheller-acdcs-for-authorization

This data as json

path title type status classification words body
events/talks/kericonf26-d2-02-feairheller-acdcs-for-authorization Philip Feairheller: ACDCs for Authorization (KERIConf 2026) summary v0.1 — 2026-10-15: drafted by Claude from the curated transcript; unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only, no quotation partner 780 # Philip Feairheller: ACDCs for Authorization (KERIConf 2026) **Abstract.** Philip Feairheller, CTO (chief technology officer) and co-founder of healthKERI, showed how healthKERI extended OAuth 2.0 so that ACDCs (Authentic Chained Data Containers), beginning with the vLEI (verifiable Legal Entity Identifier), can register clients, authenticate users and protect data disclosure in healthcare data exchange. He opened with a recorded demonstration and then walked through the protocol changes and the supporting infrastructure. The talk suits implementers working where KERI (Key Event Receipt Infrastructure) meets existing identity standards. ## Summary Feairheller started with a demonstration first prepared for the SEDI (State-Endorsed Digital Identity) conference. A Locksmith wallet held a vLEI credential and a sample Utah SEDI health identification credential. On a sample healthcare portal, the user created an account and logged in with the credential instead of typing details. Before sharing any data, the user made an offer and required the site to return a signed receipt agreeing to the user's terms. The aim was to make credential login as easy as a passkey; because it rests on a KERI identifier, one key rotation reaches every site that uses that AID (autonomic identifier). He then explained how healthKERI arrived there. HL7 FHIR (Fast Healthcare Interoperability Resources) is a REST (representational state transfer) API (application programming interface) standard for healthcare, written into federal regulation, that exchanges discrete sections of records rather than whole documents. The CMS-0057-F final rule requires Medicare Advantage, Medicaid and CHIP (Children's Health Insurance Program) plans to implement FHIR-based APIs, with payer-to-payer exchange due by January 2027; healthKERI chose that narrow case for pilots, aiming at authorization scoped to a specific purpose of use. He described a lesson from an earlier product, RACK (Routing Authenticity and Confidentiality with KERI), an API gateway that signed and encrypted every transaction: it was secure but not interoperable, so healthKERI moved toward meeting customers in OAuth. UDAP (Unified Data Access Profiles) had extended OAuth with X.509 certificates. Mark Scrimshire raised the question of what happens when short certificate lifetimes force everyone to rotate, and proposed the vLEI as organizational identity in place of X.509. healthKERI first replaced certificates in dynamic client registration (RFC 7591), so one payer can register with another automatically by presenting a credential through IPEX (Issuance and Presentation Exchange); the server publishes an OOBI (out-of-band introduction) in its well-known location, the client ID maps to the credential's SAID (self-addressing identifier), and every token request is signed, with no client secret. Next came user authentication in the authorization code flow, effectively logging in with an ACDC. After discussion with George and Chris of the State of Utah, a credential offer step was added ahead of disclosure. He described IPEX's message flow (apply, offer, agree, grant, admit, and spurn) and how its offer and signed agreement give contractually protected disclosure. The resulting ACDC authorization server is both an OAuth server and an OIDC (OpenID Connect) identity provider, configured by accepted schemas, required root issuers such as the GLEIF root, and a template mapping from credential fields to OIDC claims. Two such servers accepting the same schema admit the same users without federation. A local watcher sidecar, HK Tracker, tracks the key state of the AIDs a system has authenticated, so participants can rotate keys as often as hourly, as done in one pilot. He closed with a picture of DirectTrust, GLEIF and the State of Utah issuing credentials into one ecosystem, and answered questions on roles, the authorization server as identity provider, and business-to-business use. ## Key terms vLEI, OAuth 2.0, UDAP, dynamic client registration, client credentials flow, authorization code flow, IPEX, credential offer, contractually protected disclosure, local watcher ## Claims and their evidence - The CMS-0057-F rule requires affected health plans to implement payer-to-payer FHIR exchange by January 2027. [presenter-reported] - In healthKERI's design, the OAuth client ID maps to the presented credential's SAID and token requests are signed, removing the shared client secret. [informative] - In a pilot, a participant rotated keys every hour while connections stayed valid through witnesses and watchers. [presenter-reported] - IPEX allows a holder to offer a commitment to a credential's structure and data and to require signed acceptance of terms before full disclosure. [informative] - healthKERI's earlier RACK gateway found no adopters because it did not interoperate with existing protocols. [presenter-reported] ## Related HL7 FHIR, CMS-0057-F, OAuth 2.0 and RFC 7591, UDAP, OIDC, the ACDC specification and IPEX, vLEI, SEDI, the Locksmith wallet, ESSR (encrypt sender sign receiver) messaging, DirectTrust, and other KERIConf 2026 sessions that discussed FHIR, including one by Jared. ## Provenance Drafted by Claude on 2026-10-15 from the curated transcript (d2-02-phil-feairheller-acdcs-for-authorization.md), all 36 minutes read. No quotations; paraphrase only. Not yet read by Mark.

Links from other tables