Governance Framework

Comprehensive policies, trust frameworks, and operational guidance ensuring accountability, transparency, and reliability across VeriTrust's trust infrastructure ecosystem.

Open Policies
Transparent Operations
Accountable Governance

Governance Pillars

Four foundational pillars structure VeriTrust's approach to trust infrastructure governance

Policy Framework

Written policies defining credential issuance standards, trust registry operations, dispute resolution, and compliance requirements across the ecosystem.

  • Credential issuance policies
  • Registry operation standards
  • Dispute resolution procedures
  • Compliance requirements
  • Privacy protection rules

Roles & Responsibilities

Clear definition of roles, authorities, and accountability structures from credential issuers to registry operators to governance bodies.

  • Credential issuers (verified entities)
  • Registry operators (VeriTrust)
  • Trust framework stewards
  • Technical committees
  • Dispute resolution board

Technical Standards

W3C-aligned technical specifications ensuring interoperability, security, and cryptographic integrity across all trust infrastructure.

  • W3C DID Core 1.0 compliance
  • Verifiable Credentials Data Model 2.0
  • Cryptographic signing standards
  • API specifications
  • Security requirements

Operational Procedures

Day-to-day operational guidance for registry management, incident response, credential revocation, and continuous improvement.

  • Registry operation procedures
  • Incident response protocols
  • Credential lifecycle management
  • Performance monitoring
  • Continuous improvement process

Trust Framework Components

Multi-layered trust framework governing credential issuance, verification, and registry operations

Issuer Accreditation

Requirements for becoming an authorized credential issuer: legal entity verification, technical capability assessment, security audit, and policy compliance review.

Credential Standards

Specifications for credential schemas, cryptographic signing requirements, metadata standards, and validity periods for different credential types.

Registry Governance

Policies for trust registry operations: entry criteria, verification procedures, data integrity requirements, and update protocols.

Revocation Policy

Procedures for credential revocation: authorized parties, justifiable causes, notification requirements, and revocation registry updates.

Security Requirements

Mandatory security controls: key management (HSM), access control, audit logging, encryption standards, and penetration testing.

Transparency & Audit

Public accountability mechanisms: audit trail requirements, public registry access, compliance reporting, and third-party audits.

Roles & Responsibilities

Clear accountability structure defining who does what in the trust ecosystem

Role Responsibilities Accountability
Credential Issuers Issue verifiable credentials to agents, verify identity claims, maintain signing keys, respond to revocation requests Accuracy of issued credentials, timely revocation, security of signing infrastructure
Registry Operators (VeriTrust) Maintain trust registries, verify issuer credentials, publish registry data, ensure infrastructure uptime Registry integrity, service availability (99.9% SLA), data accuracy, incident response
Trust Framework Stewards Define trust framework policies, accredit credential issuers, resolve policy disputes, update specifications Policy coherence, fair accreditation process, timely dispute resolution
Technical Committee Develop technical specifications, review security architecture, approve schema updates, ensure W3C alignment Technical quality, standards compliance, security robustness
Verification Parties Verify presented credentials, check revocation status, validate authorization scopes, report anomalies Proper verification procedures, privacy protection during verification
Governance Board Oversee trust framework evolution, resolve escalated disputes, approve major policy changes, ensure transparency Strategic direction, stakeholder representation, transparency of decisions

Operational Procedures

Day-to-day operational guidance for registry management and credential lifecycle

1

Credential Issuance

Standardized process for authorized issuers to create and publish verifiable credentials to agents and entities in the ecosystem.

  • Verify subject identity and attributes
  • Generate credential with appropriate schema
  • Sign credential with issuer's private key
  • Publish to subject (direct delivery or registry)
  • Record issuance in audit log
2

Registry Publication

Procedures for adding verified entities to trust registries and maintaining registry data accuracy and currency.

  • Receive registry entry request from issuer
  • Verify issuer authorization and credential validity
  • Validate entry data against schema requirements
  • Publish to appropriate registry (ANS, MCP, Trust)
  • Enable public discoverability and verification
3

Credential Verification

Standard verification workflow for parties validating presented credentials from agents or entities claiming identity/authorization.

  • Receive credential presentation from subject
  • Verify cryptographic signature using issuer's public key
  • Check revocation status in revocation registry
  • Validate credential hasn't expired
  • Confirm credential schema matches expected type
  • Log verification event for audit trail
4

Credential Revocation

Process for authorized parties to revoke credentials that are no longer valid, compromised, or issued in error.

  • Authorized party (issuer or subject) initiates revocation request
  • Verify revocation authority and justification
  • Update revocation registry with credential ID and timestamp
  • Propagate revocation status globally (sub-second)
  • Notify affected parties if required by policy
  • Archive revocation record for compliance
5

Incident Response

Procedures for responding to security incidents, integrity violations, or operational issues affecting trust infrastructure.

  • Detect incident through monitoring or report
  • Assess severity and activate appropriate response level
  • Contain incident (e.g., revoke compromised credentials)
  • Investigate root cause and document findings
  • Remediate vulnerability and restore service
  • Post-incident review and process improvement
6

Dispute Resolution

Fair and transparent process for resolving disputes between stakeholders regarding credentials, registry entries, or policy interpretation.

  • Receive formal dispute submission with evidence
  • Assign to dispute resolution board or mediator
  • Review evidence and hear stakeholder positions
  • Render decision with written justification
  • Implement decision (credential revocation, policy clarification, etc.)
  • Publish decision summary for precedent (anonymized if needed)

Compliance & Standards

Alignment with industry standards, regulatory frameworks, and best practices

W3C Standards

Full compliance with:

  • W3C Decentralized Identifiers (DIDs) v1.0
  • Verifiable Credentials Data Model 2.0
  • DID Resolution specification
  • VC JSON Schema 2020

EU Regulations

Aligned with:

  • eIDAS 2.0 (European Digital Identity)
  • EU AI Act (high-risk AI systems)
  • GDPR (data protection and privacy)
  • NIS2 Directive (cybersecurity)

Security Standards

Compliance targets:

  • SOC 2 Type II (security, availability, integrity)
  • ISO/IEC 27001 (information security)
  • NIST Cybersecurity Framework
  • FIPS 140-2 (cryptographic modules)

Industry Best Practices

Following guidance from:

  • Decentralized Identity Foundation (DIF)
  • Trust Over IP Foundation
  • OpenID Foundation
  • OASIS standards committees

Governance Documents

Access detailed policy documents, technical specifications, and operational guides

Governance Questions?

For questions about governance policies, accreditation processes, or dispute resolution, contact the VeriTrust governance team.

Contact Governance Team