Skip to content
auths/

Trust and principals

Concept / explicit trust

A principal identifies an entity whose control can be established by a principal-method adapter. A trust anchor defines the authority the verifier is willing to accept from that principal.

These are separate questions:

  1. Control: does the evidence prove control of this principal and verification method?
  2. Authority: does an explicitly trusted root and valid delegation chain permit this action?

Supporting raw keys, did:key, did:keri, bundled did:web, WebAuthn, HSM-attested keys, or SPIFFE/X.509 does not make one method the Auths identity system.

No ambient trust

Section titled “No ambient trust”

The kernel does not read system roots, DNS, environment variables, clocks, files, or networks. The verifier context supplies every trust anchor and accepted implementation explicitly.

Static evidence boundary

Section titled “Static evidence boundary”

The kernel verifies carried evidence. Live DID resolution, certificate acquisition, WebAuthn interaction, and HSM operations belong in auths-proof-apps, which can turn effectful observations into immutable evidence before verification.