Tier-based Role Certifier

Authors: BlockScience and SDF, September 2023

Summary

The Tier-based Role Certifier (TRC) is a framework for attesting per-identity roles through the aggregation of available attestations. It is vaguely similar to Passport-like solutions for identity attestation, with the caveat that affordances are made for multiple roles (eg. each role has their own passport-like attestator) and that the concepts of role disqualifiers / autoqualifiers are introduced.

Attestation flows on a stylized TRC on which admissible roles for an identity are 1) Pathfinder, 2) Navigator and 3) Pilot. Source attestations to be aggregated are shown as ellipses. Any identity can apply for being attested for any of the available roles, with its approval being conditional either on the identity being listed on the disqualifiers / autoqualifiers, or the identity being above a threshold on the conditional qualifiers.

Use Cases

• Managing identity rights on role-based systems: TRC allows for expressing differentiated rights across identities on a single system by setting different sets of attestations for each role that encodes those rights.

• Representing hierarchical-like roles in terms of rights and required attestations: TRC allows to create dependence and/or fast-track pathways towards roles that require more layers of attestations. Is Role B only possible if Role A was acquired beforehand? Does acquiring Role C automatically associate having acquired Role B and A regardless of the path? TRC allows for a generalized form to express all of those.

User Journey

1. Setting-up TRC

   1. Administrator user creates roles of interest

   2. Administrator user configures the validity duration for each role attestation

   3. Administrator user attaches dis/auto qualifiers for each created role

   4. Administrator user attaches conditional qualifiers and its weights for each role.

   5. Administrator user set up the weighted conditional attestations threshold

2. Using TRC

   1. Users can apply for attestations for any role at any time. Newer attestations will replace older attestations regardless of them being expired or active.

   2. The attestation result will be processed through TRC's logic with the following sequence:

      1. If any disqualifier attestation is present and valid, then the result is to not attest.

      2. If any autoqualifier attestation is present and valid, then the result is to attest

      3. If the user weighted sum of conditional attestations is above the role threshold, then the result is to attest.

   3. If the result is to attest, the user will receive a soulbound registry entry with its expiry date set up until the role attestation duration. Else, nothing happens.

Module-specific Adjustments

Parametric Adjustments

• Setting up the Conditional Attestator thresholds

• Including / Excluding Attestators as Dis/Conditional/Auto qualifiers.

Logical Adjustments

• Implementing new Attestators