notes: research/papers/hardman-progressive-assurance-flexible-organizational

This data as json

path title type status classification words body
research/papers/hardman-progressive-assurance-flexible-organizational Progressive Assurance: Flexible Organizational Identity in the Digital Economy summary v0.1 — 2026-10-15: drafted by Claude from the HTML page (version 0.9); unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only partner 534 # Progressive Assurance: Flexible Organizational Identity in the Digital Economy **Abstract.** A 2026 paper by Daniel Hardman proposing a Progressive Assurance Model for organizational identity: four levels of control assurance built on one KERI (Key Event Receipt Infrastructure) identifier and one ACDC (Authentic Chained Data Container) credential schema, filling the gap between X.509 certificates and the verifiable Legal Entity Identifier (vLEI). It compares the model with X.509, platform verification badges and STIR/SHAKEN, and is for people designing or buying organizational identity. ## Summary Section 1 frames the organizational identity gap: digital systems rarely tell a brand from a specific legal entity, and organizations must choose between low-friction X.509 certificates and the higher-friction vLEI issued under the Global Legal Entity Identifier Foundation (GLEIF) governance framework. The paper lists X.509's mismatches for this use: short and shrinking lifespans, governance that bottoms out in certificate authorities and browser root programs, revocation checks that phone home and soft-fail, and a thin audit trail across key rotation. Section 2 separates identifier scope, reference assurance (how well an identifier is tied to a legal entity and its reference data, drawing on Legal Entity Identifier (LEI) validation and lapse status) and control assurance, which it develops in four levels. LoA 0 is an unambiguous reference affidavit with no proof of control. LoA 1 binds the entity, a cryptographic identifier and a controlled asset such as a domain or phone number. LoA 2 adds human identity proofing and verifiable delegation, through vLEI role credentials or a Generalized Cooperative Delegation credential. LoA 3 is the Legal Entity vLEI under an audited governance framework, with weighted multisignature, witnesses and pre-rotation. Section 3 names three properties: an open ecosystem rather than walled gardens, independent verification rather than phoning home, and a durable audit trail. Section 4 treats ACDCs as foundational evidence (identifier-based signing anchored to key state, chaining by Self-Addressing Identifier (SAID), pre-rotation) and Selective Disclosure JSON Web Tokens (SD-JWTs) and similar formats as derivative presentations, with a RAW versus JPEG analogy. The conclusion presents the model as one path to the missing trust layer. ## Key terms Progressive Assurance Model, level of assurance (LoA), reference assurance, control assurance, vLEI, ACDC, autonomic identifier (AID), pre-rotation, Generalized Cooperative Delegation, derivative evidence ## Claims and their evidence - X.509 was designed to authenticate web servers, not durable legal entities, and its revocation checking is unreliable in practice, citing Liu et al. 2015. [informative] - The CA/Browser Forum approved reducing public TLS certificate lifespans to 47 days by 2029. [informative] - Credentials issued to an identifier survive key rotation, removing certificate reissuance churn. [informative] - ACDCs can be chained across issuers so a verifier traverses from an LoA 2 credential back to GLEIF without an external trust registry. [informative] - SD-JWTs are signed by keys rather than identifiers and lack native chaining for delegation. [informative] ## Related verifiable LEI (vLEI) Ecosystem Governance Framework; ACDC specification; KERI specification; Where Trust Bottoms Out: X.509, Certificate Transparency, and KERI's DPKI Architecture; Why X509 Certs Should Be Secondary Evidence of Org Identity; Verifiable Voice Protocol ## Provenance Drafted by Claude on 2026-10-15 from the HTML page at dhh1128.github.io/papers/prog-a.html, read in full (sections 1 to 5 and notes). Not yet read by Mark.

Links from other tables