XCIM / Introduction

Introduction

XCIM is a draft protocol for attaching verifiable, application-scoped consent evidence to email while keeping delivery compatible with the existing mail stack.

Problem statement

Email authentication can establish facts about domains and messages, but it does not by itself prove that a recipient authorized a particular application to send a particular class of mail. XCIM explores a portable proof layer for that missing relationship.

Protocol model

  1. An application creates a consent request describing the intended communication purposes.
  2. An XCIM Consent Issuer obtains and validates acceptable Identity Evidence for the recipient.
  3. The XCIM Consent Issuer presents a frozen Consent Manifest on issuer-controlled infrastructure.
  4. The recipient explicitly grants or declines each applicable permission.
  5. The XCIM Consent Issuer signs a recipient-, application-, purpose-, and manifest-specific receipt.
  6. A sender may carry a compact XCIM reference/proof with mail.
  7. A verifier checks signed evidence, current permission state, current application/domain bindings, and local trust policy.

Identity Evidence

XCIM separates identity verification from communication permission. The draft defines an extensible Identity Evidence layer. Current work includes:

Other independently verifiable identity profiles may be defined later. Identity verification by itself never creates an XCIM communication permission.

Glossary

Identity Evidence
Cryptographically verifiable evidence that establishes control of, or authentication for, the recipient identity used in the XCIM decision.
Identity Issuer
The external authority that produces identity evidence, such as an EVP account authority or OIDC provider.
XCIM Consent Issuer
The independent XCIM actor that verifies accepted identity evidence, presents the frozen Consent Manifest, records the explicit decision, and signs the XCIM receipt.
Consent Manifest
The versioned description of the application, communication purposes, and decision presented to the recipient.

Email Verification Protocol

EVP is an emerging protocol that lets a browser obtain cryptographic proof from an email-account authority that the current user controls an email address, without requiring a verification email. XCIM can consume successful EVP evidence as the identity input to a separate issuer-hosted consent decision.

EVP verifies the address. XCIM attests the permission. EVP remains an active Internet-Draft and browser experiment, not an IETF standard. Its provider and browser behavior may change.

Primary references: IETF Datatracker draft, Chrome August 2026 update, and the WICG proposal.

Trust boundaries

XCIM does not replace SPF, DKIM, DMARC, ARC, mailbox policy, or abuse controls. A successful identity verification MUST NOT be interpreted as marketing, newsletter, promotional, or transactional permission. A valid XCIM proof is one input to a verifier; it is not a guarantee of delivery, safety, or endorsement. Issuers and verifiers remain independently governed.

Current scope

The work is at draft v0.1. An Emabled reference sandbox now exercises the OIDC-backed issuer workflow, while the generic Identity Evidence layer, EVP-01 adapter, canonical schemas, shared test vectors, public transparency proofs and resolver behavior remain in development. See protocol status and implementation status.