Implementation

This page is non-normative guidance for evaluating the draft architecture. There is no production XCIM conformance claim or released reference resolver.

Roles

Application

Requests consent for a defined identity and scope.

Issuer

Authenticates the user, records grants, and publishes verifiable metadata.

Sender

Attaches the XCIM reference and proof to a message.

Verifier

Checks evidence and applies local trust and delivery policy.

Evaluation sequence

1. Validate ordinary message authentication and parsing first.
2. Resolve the referenced issuer and select an explicitly trusted assurance profile.
3. Validate the proof bundle, bindings, time limits, and anti-replay context.
4. Resolve current permission state; stale or unavailable state must remain indeterminate.
5. Return a structured result to local policy rather than making a delivery decision inside the protocol.

Deployment boundaries

Do not deploy the current draft as a sole abuse control, publish private recipient information, or interpret missing public services as a valid state. Implementations should be fail-safe, cache-bounded, and observable.

Interoperability prerequisites

Canonical schemas, byte serialization, algorithm profiles, valid and adversarial vectors, and resolver behavior must be published before interoperable implementation claims are meaningful.