Governance is missing layer digital identity wallets need for high assurance | Biometric Update
Digital identity wallets cannot be treated as trusted public infrastructure until governments establish lawful reliance chains and not just cryptographic verification, according to a new analysis published by. . .
Digital identity wallets cannot be treated as trusted public infrastructure until governments establish lawful reliance chains and not just cryptographic verification, according to a new analysis published by The Seven Layers, a policy research site focused on digital public infrastructure governance. The paper, authored by Senior Digital Identity Advisor Ott Sarv, responds to aWorld Bank explainer on digital ID walletsand verifiable credentials. The World Bank defines wallets in a deliberately simple way, calling them software containers that allow users to receive, hold and share digital credentials. But this explanation is too limited for public infrastructure, Sarv argues. A wallet is not only a place to store attestation but also a user-side layer through which identity-linked data moves from an authentic source, through an authorized issuer, to a relying party that wants to act on it, the analysis notes. “That makes the wallet a governed data-sharing layer, not merely a container,” says Sarv. “It is where data is selected, disclosed, transmitted, accepted, matched, retained, challenged and sometimes reused. Those actions are not neutral technical steps. They are governance events. ” The World Bank’s technical framing stops short of what is required for high-assurance use cases, such asKYC, benefits eligibility, permits, payments, and access to regulated services, the paper argues. “Access to social benefits, digital student or professional attestations, and Private Sector Onboarding and e-KYC are not marginal examples,” writes Sarv. “They are precisely the kind of use cases where wallet infrastructure starts to touch money, rights, access, risk and public decisions. That is why they need a higher trust threshold. ”For high-assurance use cases, the design question is not whether the user can present an attestation, but whether the entire data-sharing event can withstand review. “Those questions define the wallet as governed public infrastructure. Without them, the wallet remains a polished presentation tool,” says the analysis. “With them, it becomes a controlled data-sharing layer capable of supportinglawful reliance. ”Verification confirms that a credential is cryptographically valid. Reliance asks whether a named party is legally entitled to use that data, for a defined purpose, under an accountable mandate, with an auditable record and an operable remedy path. The two are not the same thing, and conflating them is how technically successful wallet deployments become institutionally weak, he argues. “A presentation can verify cryptographically and still fail as trusted public infrastructure,” Sarv writes. “The relying party may have no mandate to request the data. The authentic source may not be established. The issuer may not be authorized for the purpose. The shared identifier may be used outside its proper context. The user may have no practical path to correction, erasure, review or remedy. ”Read morehere. Article Topicsdigital ID infrastructure|digital wallets|EU Digital Identity Wallet|identity assurance|verifiable credentials