Trust
Neutral by knowing less.
WorldAuth can only be the control point between parties if it is not quietly becoming one of them. So it holds operational trust metadata — not the world’s identities or activity.
01 Three principles
What WorldAuth refuses to hold.
These are architectural exclusions, not configuration options.
No global ledger
Decisions are receipted where they belong
There is no central record of who did what. Full Receipts, sensitive evidence and raw transaction content remain customer- and relying-party-controlled by default.
No reputation economy
Authority comes from a Mandate, not a score
WorldAuth calculates no universal reputation or behaviour score for any person, organisation or agent. We do not rank actors.
Assurance stays behind the firewall
Evidence informs; it never travels as authority
Identity and evidence can inform whether a Mandate is granted. They never pool into a profile and never travel with the Key.
02 Security
Failure must never create authority.
WorldAuth’s security claims come from architecture, not adjectives. This section states what the design guarantees, what depends on a runtime that is still being built, and how to report a vulnerability.
Fail closed
Uncertainty is not permission
Malformed, expired, replayed, unbound or unverifiable authority is non-authorising. Network, cache, parser, status, clock and policy failure map to a non-authorising outcome — never to ALLOW.
Binding
Possession alone grants nothing
A presentation is bound to an audience, a resource, an action and a server-issued challenge, and carries proof of possession over exactly those bytes. A captured presentation does not transfer.
Attenuation
Delegation only narrows
Every hop is checked in every dimension, and the chain is rebuilt from its root. Widening, chain splicing and unrelated-parent substitution are rejected.
Separation
A decision is not an outcome
Deciding and doing are separate records. Decision evidence cannot be presented as proof that something was executed.
Firewall
Assurance is never authority
Identity, KYA, controls, insurance and provenance evidence inform a grant. They cannot widen a Mandate.
Minimalism
As little data as possible
Sensitive evidence and Receipts stay customer-controlled by default. There is no universal central activity ledger.
03 Honest limits
What is proven, and what is not.
The published contract and its conformance suite prove properties of the artefacts. They do not prove that a Gate enforces them at request time, because Gate Core does not exist yet.
| Property | Evidence today | Status |
|---|---|---|
| Object integrity | Real signature verification over canonical bytes, with tamper and forgery vectors. | Demonstrated |
| Proof of possession | One normative signing input, with wrong-key, challenge-substitution and absent-proof vectors. | Demonstrated |
| Delegation chain | A two-hop chain plus splice, substitution and hop-count vectors. | Demonstrated |
| Replay defence | Requires a Gate to enforce single-use challenge nonces. | Runtime — not yet |
| Status freshness & revocation | Requires a Gate to fail closed without fresh status. | Runtime — not yet |
| Depletion safety | Requires a coordinator to serialise reservations. | Runtime — not yet |
| Tenant isolation, DoS resistance | Control-plane and operational properties outside the object model. | Runtime — not yet |
| Signing-key custody | Software custody today; HSM/KMS custody is on the roadmap and named as such. | Roadmap |
| Post-quantum sealing | Ed25519 today; hybrid classical and post-quantum signature suites on the roadmap ahead of the 2027 compliance gates. | Roadmap |
WorldAuth makes no claim of being unhackable, “military-grade” or absolutely secure.
04 Coordinated disclosure
If you find something, tell us first.
If you believe you have found a security issue in WorldAuth — the protocol contract, this site, or anything we operate — please report it privately before publishing.
We do not currently operate a paid bug-bounty programme, and we will not claim one until it exists.
05 Privacy posture
Designed to know as little as possible.
WorldAuth is authority infrastructure, not a data business.
Keys
Authority, not identity
A Key reveals only what the Gate needs to decide. No identity documents, KYC, biometrics or reputation travel with it.
Receipts
What was authorised
A Receipt records what was authorised — never a person’s documents, face or history. Verification does not phone home.
Residency
By deployment
Where a Gate runs is where its decisions and evidence live. The Sovereign profile keeps trust material, policy, coordination and evidence inside your boundary.
What this website itself collects is set out in the privacy notice. Data questions and rights requests: privacy@worldauth.com.
06 Responsible deployment
A Gate must never become a means of exclusion.
Principles that bind every deployment, including our own.
- Step-up and human fallback are mandatory wherever a decision affects a person’s access to essential services.Human in the loop
- Availability, language and display currency are presentation only and never change authority or entitlement.Presentation ≠ authority
- Public decisions are exactly ALLOW, STEP-UP and DENY; a Gate never invents a fourth outcome to route around a person.Three decisions
- Local deployment can support a regulatory position; it does not by itself make an operator compliant with any regime, and we do not say otherwise.No compliance by proxy
Status Protocol v0.1 in draft · reference implementation in development · not yet in production use