decentralized-id.github.io/_posts/development/2023-07-01-governance.md

---
title: "Trust Frameworks, Trust Registries, and Machine Readable Governance in Self Sovereign Identity"
description: "Trust frameworks are complicated so getting governance right requires an ecosystems approach"
excerpt: >
  The trust infrastructure is concerned with the question of how and why the presented information can be trusted. It defines the rules for all stakeholders and enables legally binding relationships with the combination of governance frameworks, which are built on top of trust frameworks.
layout: single
categories: ["Development"]
tags: ["Governance","Trust Frameworks","Trust Registries","Machine Readable Governance"]
permalink: /development/governance-trust-frameworks-registries/
canonical_url: "https://decentralzed-id.com/development/governance-trust-frameworks-registries/"
last_modified_at: 2023-07-01
---

## Trust Modelling 
* [literature] [On the Trust and Trust Modelling for the Future Fully-Connected Digital World: A Comprehensive Study](https://arxiv.org/pdf/2106.07528.pdf) 2021-06-14 HANNAH LIM JING TING, XIN KANG IEEE
  > Under our analysis of trust and the digital world, we define different types of trust relationships and find out the factors that are needed to ensure a fully representative model.Next, to meet the challenges of digital trust modelling, comprehensive trust model evaluation criteria areproposed, and potential securities and privacy issues of trust modelling are analyzed. Finally, we provide awide-ranging analysis of different methodologies, mathematical theories, and how they can be applied totrust modelling

## Trust Frameworks
* [Towards a Better Digital Identity Trust Framework in Aotearoa](https://digitalidentity.nz/2022/09/21/towards-a-better-digital-identity-trust-framework-in-aotearoa/) 2022-09-21 Digital Identity NZ
  >  It’s a great pleasure to share with you DINZ Reflections Report, a seminal piece of work that DINZ’s Digital Identity Trust Framework working group has developed over several months.
* [Digital Identity and Attributes Trust Framework](https://stateofidentity.libsyn.com/digital-identity-and-attributes-trust-framework) 2022-03-10 State of Identity
  > the bridge between payments and identity wallets, the UK's next big push in adopting shared identity standards, and the foundation of decentralized identity verification across Web3 applications and the metaverse.
* [The Ukrainian War, PKI, and Censorship](https://www.windley.com/archives/2022/03/the_ukrainian_war_pki_and_censorship.shtml) 2022-03 Phil Windley
  >  PKI has created a global trust framework for the web. But the war in Ukraine has shone a light on its weaknesses. Hierarchies are not good architectures for building robust, trustworthy, and stable digital systems.
* [The trust infrastructure of self-sovereign identity ecosystems](https://ssi-ambassador.medium.com/the-trust-infrastructure-of-self-sovereign-identity-ecosystems-551f46ed9e2c) 2021-12-22 SSI Ambassador
  > The trust infrastructure is concerned with the question of how and why the presented information can be trusted. It defines the rules for all stakeholders and enables legally binding relationships with the combination of governance frameworks, which are built on top of trust frameworks.
  >
  > includes a section on the core components of identity architecture that includes a graphic [based on a post by Phil Windley](https://www.windley.com/archives/2020/09/the_architecture_of_identity_systems.shtml)
* [Battle of the Trust Frameworks with Tim Bouma & Darrell O’Donnell](https://northernblock.io/battle-of-the-trust-frameworks-with-tim-bouma-darrell-odonnell) 2021-10-13 Northern Block
  >  1. Levels of Assurance (LOA): an introduction to LOAs as they relate to Digital Identity and why they’re an important part of the recipe in achieving digital trust. Tim and Darrell give us some practical examples of LOAs.
  > 2. The Concept of Trust: how do we define trust at a high-level and how do we differentiate between technical and human trust? How can we build trust with credential issuers but also with credential holders?
  > 3. The World of Trust Frameworks: what are trust frameworks and what are different types of frameworks being deployed in both the public and private sectors? How are organizations trying to monetize trust frameworks? What’s going right, and what’s going wrong with the way trust frameworks are being implemented?
  > 4. The Importance of Open Source for Trust Creation: why is open source important for achieving digital sovereignty? Is open source the only way to improve transparency, flexibility and accountability?
* [Good Health Pass Ecosystem Trust Architecture: DIDs and X.509 Trust Registries with Ecosystem Governance Frameworks](https://iiw.idcommons.net/23F/_Good_Health_Pass_Ecosystem_Trust_Architecture:_DIDs_and_X.509_Trust_Registries_with_Ecosystem_Governance_Frameworks) 2021-05-06 Drummond Reed, Scott Perry, Darrell O’Donnell IIW
  > Governance, Trust Registry, Ecosystem, Transitive Trust, Architecture
  - [GHP Ecosystem Trust Architecture PDF](https://drive.google.com/file/d/1Hgh5JvrM7aUCmg5q6KIXzvpVIcgfhTjr/view?usp=sharing)
  - [Good Health Pass Collaborative Principles Paper](https://www.goodhealthpass.org/wp-content/uploads/2021/02/Good-Health-Pass-Collaborative-Principles-Paper.pdf)
  - [GHPC Interoperability Blueprint Outline v2](https://www.goodhealthpass.org/wp-content/uploads/2021/03/GHPC-Interoperability-Blueprint-Outline-v2.pdf)
* [Pan-Canadian Trust Framework (PCTF) – Overview](https://northernblock.io/pan-canadian-trust-framework/) 2021-04-15 Northern Block
  > Right now, we are alpha testing the framework with different kinds of actors, both public and private, and with assessors. Through this process, we’re going to learn what may need to change, and what may not need to change. We’re going to get real knowledge there. I will say that what we’re seeing already, is that DIACC and our priorities are really driven by members.
* [Trust Frameworks](https://medium.com/mattr-global/learn-concepts-trust-frameworks-ad96a4427991) 2020-12-24 Mattr Global
  > Trust frameworks are a foundational component of the web of trust. A trust framework is a common set of best practice standards-based rules that ensure minimum requirements are met for security, privacy, identification management and interoperability through accreditation and governance. These operating rules provide a common framework for ecosystem participants, increasing trust between them.
* [Digital Caribou looks at the future trends impacting Digital Identity](https://medium.com/caribou-digital/diagnostic-trends-shaping-the-future-of-digital-identification-181724c40068) 2020-11-17 Caribou Digital
  > 1. The state of the art in digital identification are trust frameworks that accommodate diverse technologies, systems and stakeholders
  > 2. Risks remain even within the most rigorous trust framework:
  > 3. Achieving inclusion requires addressing both technical and political dimensions
   4. Trust frameworks are complicated so getting governance right requires an ecosystems approach
  > 5. Building the future of digital identification means reckoning with an analogue past
* [Trust Frameworks? Standards Matter](https://medium.com/@trbouma/trust-frameworks-standards-matter-47c946992f44) 2020-11-15 Tim Bouma
  > He points at the NIST documents about it [Developing Trust Frameworks to Support Identity Federations](https://nvlpubs.nist.gov/nistpubs/ir/2018/NIST.IR.8149.pdf) published in 2018. He also points at the Canadian government’s definition of standards.
   document that provides a set of agreed-upon rules, guidelines or characteristics for activities or their results. Standards establish accepted practices, technical requirements, and terminologies for diverse fields.”  He goes on to highlight a lot of the work being done in Canada and where it all sits relative to being a standard - “In closing, there are lots of trust frameworks being developed today. But to be truly trusted, a trust framework needs to either apply existing standards or become a standard itself.”
* [Trust Frameworks and SSI: An Interview with CULedger on the Credit Union MyCUID Trust Framework](http://ssimeetup.org/trust-frameworks-ssi-interview-culedger-credit-union-mycuid-trust-framework-drummond-reed-webinar-9/) 2018-06-28 Alex Preukschat, Drummond Reed SSI Meetup[Slideshare](https://www.slideshare.net/SSIMeetup/trust-frameworks-and-ssi-an-interview-with-culedger-on-the-credit-union-mycuid-trust-framework)
  > In this webinar, Evernym Chief Trust Officer Drummond Reed, chair of the Sovrin Foundation Trust Framework Working Group, will explain what a trust framework is and why they are are essential to SSI. Then he will interview executives of CULedger, the credit union blockchain consortia, about the MyCUID Trust Framework—the first global trust framework for proving membership in a credit union.
* [OIX White Paper: Trust Frameworks for Identity Systems](https://www.oixnet.org/news-whitepaper/) 2017-04-25 OIX
  > Trust frameworks are not a new concept. They are commonly used outside of the world of digital identities, to govern a variety of multi-party systems where participants desire the ability to engage in a common type of transaction with anyone of the other participants, and to do so in a consistent and predictable manner. In such cases, they are proven to work and scale. Common examples include credit card systems, electronic payment systems and the internet domain name registration system, which all rely on a set of interdependent specifications, rules, and agreements. This set of specifications, rules and agreements is referred to by various names, such as “operating regulations,” “scheme rules,” or “operating policies.” In the world of identity systems they are commonly referred to as a “trust framework.”

## Trust Registries
* [Trust Registries Tweetstorm](https://www.continuumloop.com/trust-registries-tweetstorm/) 2022-09-14 Continuum Loop
  > We want to start a conversation on Trust Registries and get people thinking about how Trust Registries will help answer the hard questions an ecosystem needs to create a whole experience [[tweetstorm](https://threadreaderapp.com/thread/1569093372920614914.html)]
* [Managing Trust and Reputation via Trust Registries](https://www.continuumloop.com/managing-trust-and-reputation-via-trust-registries/) 2022-08-23 Continuum Loop
  > The concept behind a Trust Registry is that a Wallet needs to know which decentralized identifiers (DIDs) to “trust” as a source of truth. At many levels, this “trust” translates to “authority” – knowing that somebody, centralized or decentralized, is responsible for maintaining a list of trusted DIDs.
* [Literature] [Bottom-up Trust Registry in Self Sovereign Identity](https://arxiv.org/abs/2208.04624v1) 2022-08-09 Kai Jun Eer, Jesus Diaz, Markulf Kohlweiss Arxiv
  > we propose a trust registry design that handles the aspect of human trust in self sovereign identity. We also introduce an incentivisation mechanism for the trust registry in order to motivate each stakeholder to participate actively and honestly.
* [Trinsic Basics: What Is a Trust Registry?](https://trinsic.id/trinsic-basics-what-is-a-trust-registry/) 2022-07-12 Trinsic
  > Trust registries also need to be interoperable. The [Trust Over IP Foundation](https://www.trustoverip.org/) has a [specification](https://github.com/trustoverip/tswg-trust-registry-tf) for an interoperable trust registry, and ours is the first implementation of this spec. Because of this, Trinsic’s Trust Registry Service is architected so that one ecosystem could reference or incorporate a trust registry from a separate ecosystem if needed.
* [Solving Governance in SSI Ecosystems with Trust Registries.](https://www.youtube.com/watch?v=5zZKIwesSl8) 2022-10-04 Trust over IP Foundation
  > Learn the what and the why behind trust registries.  In addition to discussing how trust registries solve governance in verifiable credential ecosystems, Tomislav demos the very first implementation of ToIP’s trust registry specification.
* [Podcast] [Are Trust Registries Vital to the Success of Decentralized Identity?](https://northernblock.io/are-trust-registries-vital-to-the-success-of-decentralized-identity-with-darrell-odonnell/) 2022-09-30 Darrell O’Donnell Northern Block
  > - What are the differences between Verifiable Data Registries and Trust Registries?
  > - How can Trust Registries help establish the Authenticity of Data?
  > - Does placing too much Governance at the Verifiable Data Registry layer cause scaling issues?
  > - Why DNS can become an elegant Root of Trust solution to validate the authenticity of Credential Issuers.
  > - Who in the Trust Triangle benefits the most from Trust Registries
* [Trust Registries Webinar](https://www.continuumloop.com/trust-registries-webinar/) 2021-09-21 Continuum Loop
  > - “I don’t trust organizations and corporations” – where we point out the “decentralize the world” approach goes to far.
  > - Phoning home – (hint: no it doesn’t need to phone home)
  > - Where are Holders Authorized? (hint: [Knowing if you can trust Bubba’s Wallet](https://www.continuumloop.com/bubbas-wallet/) may be more important…)
  > - Canadian Digitial Identities are emerging – can startups leverage this?
  > - Explain the Role of Government in ecosystems.
  > - “Can a third party discover who I trust from a trust registry?”
  > - How will interoperability work between trust registries?
* [Trust Registries in the Real World](https://www.continuumloop.com/trust-registries-in-the-real-world/) 2022-09-08 Continuum Loop
  > Trust Registries allow us to know that the various shared credentials (e.g. proof of insurance) are accurate. A Homeowner can ask their Digital Wallet to verify an insurance Credential that the Contractor is honest.
* [Literature] [A novel approach to establish trust in verifiable credential issuers in Self-sovereign identity ecosystems using TRAIN](https://dl.gi.de/handle/20.500.12116/38702) 2022-07-07 Isaac Johnson Jeyakumar, David Chadwick; Michael Kubach Open Identity Summit
  > This paper illustrates how TRAIN (Trust mAnagement INfrastructure), an approach based on established components like ETSI trust lists and the Domain Name System (DNS), can be used as a trust registry component to provide a holistic approach for trust management in SSI ecosystems. TRAIN facilitates individual trust decisions through the discovery of trust lists in SSI ecosystems, along with published credential schemas, so that verifiers can perform informed trust decisions about issued credentials.

## Alternatives
* [Decentralized Ecosystem Governance: Better, More Effective, and More Robust than Trust Registries](https://indicio.tech/decentralized-ecosystem-governance-better-more-effective-and-more-robust-than-trust-registries/) 2022-09-12 Indicio
  > Decentralized Ecosystem Governance makes verifying data an easy-to-play game of red light/green light. And, importantly, it decentralizes governance to the appropriate authorities.
* [When it Comes to Decentralized Identity, Sell Solutions Not Rules](https://indicio.tech/when-it-comes-to-decentralized-identity-sell-solutions-not-rules/) 2022-02-02 Indicio
  > - First, machine-readable governance simplifies how decentralized identity works: The user software handles the rules for information flows and authentication, which are established and published by the entities with authority for governing the use case.
  > - Second, this architecture makes these rules transparent.
  > - Third, and critically, it enables these rules to function offline through caching, which, when you think about it, is an essential feature in any digital identity verification system; trust can’t be dependent on a Wi-Fi signal.
* [Trust Registry or Machine-Readable Governance?](https://indicio.tech/trust-registry-or-machine-readable-governance/) 2021-09-28 Indicio
  > Machine-readable governance is composed of elements that help to establish trust and enable interoperability: trusted participants, schemas (templates for structuring information in a credential), and rules and flows for presenting credentials and verifying them. Machine-readable governance can be hierarchical. Once a governance system is published, other organizations can adopt and then amend or extend the provided system.