XCIM / Status

XCIM Protocol status

Draft v0.1 · Phase 0 · Reference implementation active · Updated 2026-08-13

DRAFTEMABLED SANDBOX OPERATIONALNOT A STABLE STANDARD

Implemented by the reference issuer

Emabled, the managed XCIM Consent Issuer operated by We Are 14 Inc., runs an isolated XCIM sandbox. Its implementation provides:

Public operator console with OIDC authentication, hosted XCIM consent handoff, onboarding and MFA controls.
Application registration, versioned consent manifests and an OIDC-01 identity-evidence path.
Signed consent receipts, revocation lifecycle processing and webhook delivery infrastructure.
Ed25519 keys held and used through Google Cloud KMS, with the public issuer key set available at api.emabled.com.
Isolated Cloud SQL persistence, background workers, least-privilege workload identities and health-checked services on GKE.

Scope: these are capabilities of one reference implementation. They do not establish protocol interoperability, production network availability, or standards-track status.

Identity Evidence architecture

The draft no longer makes any OAuth client the root application identity or OIDC the only identity-evidence mechanism. XCIM now defines an extensible Identity Evidence layer:

EVP-01 - experimental Email Verification Protocol evidence.
OIDC-01 - OpenID Connect evidence.

The deployed Emabled sandbox currently uses OIDC while the identity layer is being refactored. EVP support must remain explicitly experimental until the browser/protocol work stabilizes and Emabled exposes it in the sandbox. Profile status is maintained in the shared source.

Protocol decisions closed

Identity Evidence is distinct from consent.
XCIM application identity is independent of any one OAuth client.
Successful identity verification never implies communication permission.
Normative message headers are XCIM-Reference and XCIM-Proof.
Unavailable or insufficiently fresh state produces XCIM_STATUS_INDETERMINATE.
Receipt history and current permission state remain separate.

Still required for interoperable v0.1

Canonical Identity Evidence profile schemas for EVP-01 and OIDC-01.
Shared identity-evidence vectors and negative cases.
Canonical schemas, byte serialization and signing input.
Normative append-only and current-state proof algorithms.
Reference resolver release, security review and independent implementation testing.
Publication of the canonical v0.1 specification.

Document index · Implementation guidance · Public network status ↗