notes: research/papers/hardman-sentries-confessionals-vaults-and-envelopes

This data as json

path title type status classification words body
research/papers/hardman-sentries-confessionals-vaults-and-envelopes Sentries, Confessionals, Vaults, and Envelopes summary v0.1 — 2026-10-15: drafted by Claude from the web page (version 1.0); unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only partner 460 # Sentries, Confessionals, Vaults, and Envelopes **Abstract.** A 2023 primer by Daniel Hardman that uses a medieval metaphor to distinguish four decentralized identity technologies often treated as rivals: OpenID Connect (OIDC), the Credential Handler API (CHAPI), Decentralized Web Nodes (DWNs) and DIDComm. It argues that they solve different problems and that interoperability work should draw boundaries between them rather than unify them. For people working in self-sovereign identity (SSI) and adjacent standards. ## Summary The paper begins from what it calls persistent misunderstandings in the decentralized identity and SSI space about how OIDC, CHAPI, DWNs (and similar secure storage) and DIDComm overlap. Two caveats come first: metaphors can be applied too literally, and the author states that he is one of the architects of DIDComm and so is not an unbiased source. The metaphor sets queen Alice and king Bob in medieval kingdoms. Sentries at a gate stand for OIDC: real-time, session-oriented, credential-based gatekeeping, with Self-Issued OpenID Providers (SIOP) changing who employs the sentries but not the picture. Confessionals stand for CHAPI: a sandboxed, protocol-driven, real-time space inside the browser for sharing credentials with a website, though the author notes CHAPI is more active and sentry-like than a confessional. Vaults stand for DWNs, Solid pods and encrypted data vaults: server-based, policy-governed bulk storage run by a specialist guild, which decouples the owner's timing from the accessor's. Envelopes, seals and couriers stand for DIDComm: asynchronous, transport-agnostic messaging whose security derives from control of a decentralized identifier (DID), with mediators as couriers. The paper separates DIDComm from credential exchange protocols built on it. In "Stepping Back" the author argues that each tool has legitimate uses, a mature ecosystem will have all of them, and some overlap is normal. He distinguishes auto-interop, agreement among parties that share goals (a standards-body question), from xeno-interop, the drawing of crisp boundaries between problem domains, and contends that these four technologies call for the latter. He describes three camps (login and authorization, data, and communication) and asks for room for each while the market decides. ## Key terms sentries, confessionals, vaults, envelopes, OpenID Connect, CHAPI, Decentralized Web Nodes, DIDComm, auto-interop, xeno-interop ## Claims and their evidence - OIDC, CHAPI, DWNs and DIDComm solve different problems and are mostly complementary rather than competing. [informative] - DIDComm is transport-agnostic and fully asynchronous, which is unusual among SSI technologies. [informative] - Interoperability across these tools is better served by defining boundaries (xeno-interop) than by unification. [informative] - The author is one of DIDComm's architects and states his bias. [presenter-reported] ## Related Three Dimensions of Identity; Big Desks and Little People; DIDComm Messaging specification (DIF). ## Provenance Drafted by Claude on 2026-10-15 from the web page at dhh1128.github.io/papers/svce.html, read in full (the images were not viewed). Not yet read by Mark.

Links from other tables