Digital Identity / Account
Describe one persistent digital identity record or subscriber account within a declared identity-service authority and namespace.
Bundle → Layer → Finding → Questions Filled
6 bundles · 12 layers · 12 findings · 48 questions
Identity and naming Root and externally scoped identifiers.
Scoped identity anchor
Context for scoped identity anchor. Proposed local organization informed by the cited sources.
Scoped identity anchor
The root is one identity-service record with a stable local key. Names and contact addresses remain changeable attributes, and identity does not imply legal personhood.
- Which authoritative namespace and master identifier distinguish this record? identity
- Which subject kind and identity-service profile govern this anchor? classification
- What prevents reuse of a retired master identifier for a different record? constraint
- Which subject reference is asserted, unknown or disputed? relationship
Identifier bindings
Context for identifier bindings. Proposed local organization informed by the cited sources.
Identifier bindings
Bindings preserve issuer, scheme, audience and validity. Comparison uses profile-specific rules; matching labels or email addresses cannot silently merge identities.
- Which issuer, scheme and value identify each external binding? identity
- During which interval is each identifier binding supported by evidence? temporal
- Which bindings are pairwise or restricted from correlation? privacy
- Which case and normalization rules apply without changing identifier meaning? interoperability
Enrollment and assurance Evidence and qualified confidence.
Enrollment and proofing record
Context for enrollment and proofing record. Proposed local organization informed by the cited sources.
Enrollment and proofing record
Enrollment records the chosen profile and evidence outcomes, including a declared unproofed state. Evidence pointers are purpose-limited; absence of a proofing result is not a successful result.
- Which enrollment route and approved exception path were used? process
- Which proofing assessment and evidence references support enrollment? evidence
- Is proofing unperformed, pending, completed, failed or disputed? state
- What unresolved mismatch or redress request qualifies the enrollment outcome? quality
Qualified assurance observations
Context for qualified assurance observations. Proposed local organization informed by the cited sources.
Qualified assurance observations
Assurance assertions identify framework, assessor, scope and time. Identity proofing, authentication strength and federation protections remain distinct; a historical maximum is not a current universal guarantee.
- Which framework and assurance dimension does each recorded level measure? measurement
- Who assessed the level and which evidence supports it? provenance
- When was assurance assessed and when must applicability be reviewed? temporal
- Which evidence gap prevents interpreting an assurance claim as current? validation
Control and recovery Authenticator bindings and recovery authority.
Authenticator binding metadata
Context for authenticator binding metadata. Proposed local organization informed by the cited sources.
Authenticator binding metadata
Bindings connect the identity to externally managed authenticators and public credential references. Binding, compromise and retirement observations are distinct from possession, successful authentication or identity proofing.
- Which authenticator references and permitted purposes are bound? composition
- What authorized binding evidence links the authenticator to this identity? security
- Which replacement, compromise or retirement event changes the binding state? lifecycle
- How does the metadata projection exclude secret and reusable authentication material? constraint
Recovery and controller authority
Context for recovery and controller authority. Proposed local organization informed by the cited sources.
Recovery and controller authority
Recovery metadata records prerequisites, accountable actors and external outcomes. A controller or representative may differ from the subject; neither support access nor a changed contact address alone proves authority.
- Who may request or approve recovery under the applicable policy? authority
- Which accepted evidence and notification obligations apply to the recovery route? requirement
- What assisted recovery or dispute route applies when normal prerequisites fail? exception
- Which confirmed external outcome permits a local recovery status change? event
Federation and linkage Trust context and explicit cross-record assertions.
Federated identity context
Context for federated identity context. Proposed local organization informed by the cited sources.
Federated identity context
Each federation binding retains identity-provider, issuer, subject and audience context. Token validation and federation execution are external; local metadata must not promote an unvalidated assertion into identity evidence.
- Which issuer and subject pair identifies the federated identity? identity
- Which relying-party audience and trust agreement qualify the binding? relationship
- Which external validation result supports acceptance of a federation observation? validation
- Which expiry, stale trust or issuer mismatch blocks reuse of that observation? security
Explicit linkage and separation
Context for explicit linkage and separation. Proposed local organization informed by the cited sources.
Explicit linkage and separation
Linkage is a qualified assertion between contextual identities, not silent physical deduplication. Inbound application-account references preserve the separate online-account master and cannot transfer entitlements.
- Which identities are proposed as linked and for what limited purpose? relationship
- Which authenticated request and approval evidence authorize a link? authority
- How is a disputed or erroneous link corrected without merging histories? exception
- What evidence confirms unlinking and records any remaining access path? lifecycle
Lifecycle and synchronization Local continuity with qualified external outcomes.
Identity-service state and continuity
Context for identity-service state and continuity. Proposed local organization informed by the cited sources.
Identity-service state and continuity
The profile defines admissible local states and transitions. Suspension, closure and identifier retirement are different decisions; death, inactivity or a provisioning response cannot independently prove closure or remote access revocation.
- Which local state is effective under the approved lifecycle profile? state
- Which actor and reason authorize the requested state transition? authority
- How are effective time and delayed observation time retained for a transition? temporal
- Which precondition or stale revision prevents applying the transition? constraint
Projection and remote outcome evidence
Context for projection and remote outcome evidence. Proposed local organization informed by the cited sources.
Projection and remote outcome evidence
Provisioning and readback observations link this record to external resources without treating the protocol resource as the root. Pending, partial, failed and unknown results remain visible; session termination is separately evidenced.
- Which external resource and mapping version correspond to this identity projection? interoperability
- Which source system is authoritative for each mapped attribute? provenance
- What outcome distinguishes a request from confirmed remote state? quality
- Which partial failure or unresolved session consequence requires reconciliation? exception
Disclosure and disposition Purpose-limited access and evidence-based retention.
Purpose-limited identity views
Context for purpose-limited identity views. Proposed local organization informed by the cited sources.
Purpose-limited identity views
Views separate subject, steward and relying-party access, minimizing identifiers and assurance evidence. Public resolution is never a default. A yes/no response can also disclose protected information.
- Which authenticated recipient and purpose permit each identity view? access
- Which attributes and correlation links must be omitted from this view? privacy
- Which steward owns the record and which authority governs subject access requests? ownership
- Which enumeration or correlation risk constrains lookup responses? security
Retention and disposition evidence
Context for retention and disposition evidence. Proposed local organization informed by the cited sources.
Retention and disposition evidence
Payload disposition follows adopted retention and exception rules. Closing an account, deleting a protocol resource and disposing of all retained copies have distinct evidence. Continuity metadata must be minimized rather than retained indefinitely.
- Which retention schedule and trigger govern each category of identity data? retention
- Which authorized hold postpones disposition for a defined scope? exception
- Which disposal receipts and residual-copy inventory support a completion claim? evidence
- What minimal tombstone or successor reference may remain under the adopted policy? lifecycle
Classifiers Filled
- Family
- World Models
- Category
- Society, people and institutions
- Entry kind
- entity
- Navigation path
- NAV.SOC.PER.DIG
- Domain
- SOC.PER.DIG
- Industry
- Cross-industry
- Tags
- digitalidentityaccountsoc.per.dig
- Also called
- R4
What it is Filled
An identity-service record that binds scoped identifiers, subject assertions, authenticator references and assurance evidence over time. It is distinct from the represented person or organization, an identity register as a whole, and an application-specific online account. Federation is optional. Primary assurance coverage concerns natural persons; other subject kinds require separately justified profiles.
In scope
- Scoped identity and subject/controller distinctions, identifier bindings and explicit account linkage assertions
- Enrollment and proofing references, qualified assurance observations, authenticator and recovery metadata
- Identity-service lifecycle, federation bindings, restricted disclosure and retention evidence
Out of scope
- Population register operations, civil identity adjudication, person or organization master profiles, universal identity resolution
- Application-specific membership, purchases, content, subscriptions and virtual assets belonging to WM-VRT-005
- Private keys, passwords, recovery codes, bearer tokens, raw biometrics and source identity-document payloads
- Executing authentication, recovery, credential issuance, provisioning, authorization decisions, remote revocation or legal erasure
Why it exists Filled
Describe one persistent digital identity record or subscriber account within a declared identity-service authority and namespace.
Distinguishing features Derived, awaiting review
- Unlike WM-XCT-016 Identity Register: The R4 legacy alias is shared. Register-wide indexing, registrar governance and population uniqueness belong to the register; this entity carries an optional register reference only. The legacy EXTEND world.registry and legal-effect claim are not inherited.
- Unlike WM-VRT-005 Online Account: The frozen inbound candidate REFERENCE lets an application account bind to this identity. Application lifecycle, entitlements and content remain there; no reciprocal containment or automatic synchronization is implied.
- Unlike WM-PER-001 Person and external organization or thing master: The identity record describes assertions about a subject without owning that subject. A person can have several contextual identities; organization and thing profiles cannot inherit natural-person IAL requirements.
- Unlike WM-XCT-017 Attestation / Credential and authenticator service: Credential assertions and authenticators have their own issuer, lifecycle and authority. This entity stores references, status observations and binding evidence, never secrets or credential issuance functions.
- Unlike WM-XCT-002 Access Contract / Consent: Record purpose, policy and consent references. Identity proofing or successful authentication does not itself authorize access; policy masters and enforcement remain external.
- Unlike Authentication events and session services: Event and session references can qualify observations, but the persistent identity is neither a login event nor a session. Local closure is not proof that every remote session ended.
Note: Derived from boundary notes against neighbouring models.
What robots and AI may and may not do Derived, awaiting review
Must not
- Deny by default and release only fields needed for the documented recipient and purpose
- Never store passwords, private keys, bearer tokens, recovery codes or raw biometrics in this model
- Linking, recovery and destructive transitions require explicit profile authority and evidence; no automated name-based merges
- Reviewability is not conformance, legal compliance or independent review; natural-person guidance cannot certify nonhuman identities
- Allow unproofed enrollment where the adopted profile permits it; never fabricate evidence
- Deny by default; intersect role, purpose, subject scope, field restrictions and time validity.
- Document assisted access or emergency exceptions with authority, scope, expiry and subsequent review; never an implicit bypass
Only with a human decision
- Reviewability is not conformance, legal compliance or independent review; natural-person guidance cannot certify nonhuman identities
May
- Record enrollment evidence: Proposed local operation, not implemented. Record an externally established enrollment outcome without performing proofing.
- Revise identifier or authenticator binding metadata: Proposed local operation, not implemented. Record an approved binding change without creating credentials or handling secrets.
- Record recovery outcome: Proposed local operation, not implemented. Attach verified external recovery and notice evidence to the local identity.
- Record linkage disposition: Proposed local operation, not implemented. Preserve an authorized linkage, unlinkage or dispute disposition without merging roots.
- Record identity-state decision: Proposed local operation, not implemented. Apply a policy-authorized local state revision and attach external synchronization observations.
- Build a minimized review view: Proposed local operation, not implemented. Propose a recipient-scoped local view including retention and evidence gaps.
Note: Derived from functions, policies, CRUD and access rules; prohibitions were not authored for agents as such.
Moral aspects Derived, awaiting review
- Privacy and records custodian
- Nonhuman assurance, shared-account rules, guardianship, estate access, jurisdictional privacy rights and sector-specific identity requirements need qualified profiles
- WM-XCT-002 Access Contract / Consent
- Record purpose, policy and consent references.
Note: Sentences mentioning harm, privacy, consent or similar, collected from the specification.
Owners Filled
Steward
Declare an accountable identity steward role, authority namespace and immutable record key policy
Roles
- Identity steward
- Own namespace, profile adoption and correction decisions
- Subject or authorized representative
- Request review and recovery within evidenced authority; cannot self-certify assurance
- Evidence reviewer
- Assess provenance and unresolved proofing or linkage evidence
- Security operator
- Record external authenticator and recovery results without handling secrets in this model
- Privacy and records custodian
- Approve scoped disclosure, retention exceptions and disposal evidence
- Relying-party reviewer
- Consume only authorized identity views and evaluate external access policies
Links to other meta-models Filled
references
- WM-XCT-016 - Candidate optional register membership reference. Register-wide indexing, uniqueness and resolution functions stay external.
- WM-PER-001 - Candidate optional natural-person reference; profile and civil-status lifecycle remain external and pseudonymous identities need no person master link.
- WM-VRT-005 - Optional navigational back-reference to the source of the frozen inbound candidate REFERENCE. Does not ratify reciprocal containment; application account state and assets remain target-owned.
- WM-XCT-017 - Candidate credential evidence reference; issuer decisions and credential lifecycle are external.
- WM-XCT-002 - Candidate access and consent policy reference; no authorization enforcement owned here.
aligned
- RFC 7643 and RFC 7644 - Conceptual resource and provisioning mapping. Field authority, identifier scope and conformance fixtures remain to be specified.
- OpenID Connect Core 1.0 - Optional federation binding projection using issuer, subject and audience; no protocol execution.
- DID Core v1.0 - Optional identifier and controller reference; no mandatory DID, ledger or equivalence to a proofed natural person.
- Web Authentication Level 2 - Optional account-scoped credential reference projection; no ceremony execution or device trust certification.
neighbor
- WM-XCT-016 Identity Register - The R4 legacy alias is shared. Register-wide indexing, registrar governance and population uniqueness belong to the register; this entity carries an optional register reference only. The legacy EXTEND world.registry and legal-effect claim are not inherited.
- WM-VRT-005 Online Account - The frozen inbound candidate REFERENCE lets an application account bind to this identity. Application lifecycle, entitlements and content remain there; no reciprocal containment or automatic synchronization is implied.
- WM-PER-001 Person and external organization or thing master - The identity record describes assertions about a subject without owning that subject. A person can have several contextual identities; organization and thing profiles cannot inherit natural-person IAL requirements.
- WM-XCT-017 Attestation / Credential and authenticator service - Credential assertions and authenticators have their own issuer, lifecycle and authority. This entity stores references, status observations and binding evidence, never secrets or credential issuance functions.
- WM-XCT-002 Access Contract / Consent - Record purpose, policy and consent references. Identity proofing or successful authentication does not itself authorize access; policy masters and enforcement remain external.
- Authentication events and session services - Event and session references can qualify observations, but the persistent identity is neither a login event nor a session. Local closure is not proof that every remote session ended.
What else AI and robots need to interact with it Incomplete
Identity and identifiers required Filled
- Authoritative master-system identifier scoped to its authority
- Governed global identifier or IRI with issuer context
- UUID or ULID assigned by the adopting Dimension
Direct properties not applicable Not applicable
Not applicable
Institutional or informational subject: no invented physical properties.
Recognition optional Missing, in the backlog
Not described yet. This gap is in the card backlog.
Capabilities and actions required Filled
- Record enrollment evidence: Proposed local operation, not implemented. Record an externally established enrollment outcome without performing proofing.
- Revise identifier or authenticator binding metadata: Proposed local operation, not implemented. Record an approved binding change without creating credentials or handling secrets.
- Record recovery outcome: Proposed local operation, not implemented. Attach verified external recovery and notice evidence to the local identity.
- Record linkage disposition: Proposed local operation, not implemented. Preserve an authorized linkage, unlinkage or dispute disposition without merging roots.
- Record identity-state decision: Proposed local operation, not implemented. Apply a policy-authorized local state revision and attach external synchronization observations.
- Build a minimized review view: Proposed local operation, not implemented. Propose a recipient-scoped local view including retention and evidence gaps.
Hazards and failure modes optional Missing, in the backlog
Not described yet. This gap is in the card backlog.
Standards and interfaces required Missing, in the backlog
Not described yet. This gap is in the card backlog.
Context of use required Filled
- NIST assurance guidance is a selected US federal technical profile for natural persons, not a universal legal obligation
- No global one-person-one-account rule, legal identity effect or unconditional subject-access right is asserted
- Protocol versions are pinned examples; current amendment, errata and deployment applicability review remains open
Sources Filled
- Identity Proofing and Enrollment - National Institute of Standards and Technology
- Authentication and Authenticator Management - National Institute of Standards and Technology
- Federation and Assertions - National Institute of Standards and Technology
- System for Cross-domain Identity Management: Core Schema - Internet Engineering Task Force
- System for Cross-domain Identity Management: Protocol - Internet Engineering Task Force
- OpenID Connect Core 1.0 incorporating errata set 2 - OpenID Foundation
- Decentralized Identifiers v1.0 - World Wide Web Consortium
- Web Authentication: An API for accessing Public Key Credentials - Level 2 - World Wide Web Consortium
- Date and Time on the Internet: Timestamps - Internet Engineering Task Force
Open questions
- Complete source/version and qualified adoption-profile review, including nonhuman and assisted-access cases.
- Specify and test instance constraints and external mappings against email reuse, incorrect linkage, lost authenticators, partial revocation, delayed provisioning and residual-copy disposal cases.
- Restore independent external review before any canonical or publishable-draft promotion.
- Independent external review is absent; local audit cannot replace it
- Direct HTTP and latest-version verification remain incomplete; browser reading is selected-section evidence
- Executable nested schemas, runtime bindings, protocol interoperability and adversarial instance fixtures are not implemented
- Nonhuman assurance, shared-account rules, guardianship, estate access, jurisdictional privacy rights and sector-specific identity requirements need qualified profiles
Machine files
Provenance
world-models research · reviewable-draft
Built from: models/wm-per-002-digital-identity-account/spec.yaml