Implementation
XCIM remains a draft, but its core issuer workflow is now exercised by a deployed reference implementation.
Reference implementation: Emabled
Emabled implements the managed XCIM Consent Issuer and operator surfaces used to test XCIM end to end. The deployed sandbox currently supports OIDC-based identity evidence, issuer-hosted consent, application and manifest publication, signed receipt issuance, revocation processing, lifecycle webhooks, public signing keys and background transparency processing.
The implementation is being refactored around a generic Identity Evidence layer. An experimental EVP-01 adapter is planned/tested separately before being enabled in the Emabled Hosted Consent flow. This page is driven by the shared profile status at identity-evidence.json.
| Surface | Current implementation | Boundary |
|---|---|---|
| Operator console | OIDC authentication, hosted-consent onboarding, MFA and workspace controls | Authorized sandbox operators |
| Identity evidence | OIDC-01 reference profile; EVP-01 adapter in development | Profile maturity is not external standards status |
| Consent issuer | Issuer-hosted consent session using a versioned manifest | Reference flow, not universal conformance |
| Receipts and revocation | KMS-backed Ed25519 signatures and lifecycle worker | Emabled issuer semantics |
| Application identity | XCIM Application ID, application key, metadata and current domain bindings | Independent of any one OAuth client |
| Public discovery | Issuer key set and service health | No public XCIM registry or resolver yet |
Identity profiles
Maturity labels below describe XCIM profile maturity, not the standards status of the external protocol.
| Profile | Purpose | Maturity |
|---|---|---|
| EVP-01 | Email-provider-backed address control | Experimental |
| OIDC-01 | Identity-provider-backed authentication | Supported draft profile |
Protocol roles
- Identity Issuer
- Provides independently verifiable identity evidence, such as EVP or OIDC evidence.
- XCIM Consent Issuer
- Validates acceptable identity evidence, presents the Consent Manifest, records the decision, and signs the XCIM receipt.
- Application
- Requests consent for a defined application identity, manifest and purpose.
- Sender
- Attaches the XCIM reference and proof to a message.
- Verifier
- Validates evidence and applies local trust and delivery policy.
Application identity
The XCIM application identity is not defined by an OAuth client. It is anchored by the XCIM Application ID, application key, metadata, and current domain bindings. OIDC client IDs are profile-specific integration metadata.
Verification sequence
- Validate ordinary message authentication and parsing.
- Resolve the issuer and select an explicitly trusted assurance profile.
- Validate proof signatures, application and domain bindings, time limits and anti-replay context.
- Resolve current permission state; stale or unavailable state remains indeterminate.
- Return a structured result to local receiver policy.
Interoperability boundary
The deployed Emabled flow demonstrates implementation feasibility. Independent conformance still requires published schemas, serialization rules, vectors, transparency proofs and resolver behavior. No implementation should treat the sandbox as a production trust root or sole abuse control.