Thread by @darrello

"Machine Readable Governance" provides some #nuggetsOfAwesome but has some flaws that need to be addressed before it can be as helpful as it wants.

/1

Contrary to this well-written but somewhat flawed article by @TelegramSam it also needs a Trust Registry.

indicio.tech/trust-registry…

/2

Let's cover one minor flaw and then the nuggets of awesome inside this "machine-readable governance" concept.

/3

As @telegramsam writes, "It lies in the belief that the best way to do governance is to divert all traffic through a centralized trust registry"

That is the flaw - there is no "centralized trust registry" in our model.

/4

There are hundreds of Trust Registries needed.

Thousands eventually.

Hey! That smells a lot like #decentralization.

/5

We need the trust registries to focus where they are the source of truth. Professional Engineer authorities share their truth. Government issuers share theirs. Informal groups share theirs.

/6

There will be trust registries that duplicate information - and even conflict. Over time the need for these will become clear - some will vanish and some will be maintained.

/7

This web of trust registries creates a decentralized and distributed source of information systems can go and get the information needed - that is up to date, authoritative, and yes, decentralized.

/8

While a machine-readable governance approach is a file - and keeping yours up to date is a doomed-to-fail mission. You aren't the source of truth and will quickly reach the point where centralized systems fail.

/9

You will stop updating your governance file because it hits a line of diminishing returns. Adding information on that list of DIDs that your organization only needs once in a while just isn't worth it.

/10

What should you do then?

Let's recognize that for most things you aren't in control... and you don't want to be...

https://twitter.com/darrello/status/792496888444575744

/11

What you want to do is connect to the authoritative source(s). For a list of Credit Unions in the US, hit the MemberPass Digital Trust Registry (disclosure - I was CTO for that) - it is the best source for credit union DIDs.

/12

For other sources, find them and hook into them - using the Trust Registry Protocol.

wiki.trustoverip.org/display/HOME/T…

/13

OK - on to the #nuggetsOfAwesome in the machine readable governance idea...

/14

If you read the thread about Trust Registries you'll see we have a lot of data that need to be figured out.

https://twitter.com/darrello/status/1569093372920614914?s=20&t=QnMkidQFJViwWxsI_A7RfQ

/15

Each key element (credential types, presentation requests, approved wallets, etc.) will need data structures in an API.

/16

The work that Sam has led on machine readable governance helps immensely here - we don't need to create the API spec from whole cloth.

/17

We can borrow (steal) from work already done...

/18

The data structures and concepts in Machine Readable Governance lend themselves very well to what is needed in the future work on the Trust Registry Specification.

/19

It provides some good structures for Schemas, Rules, Flows and other data structures that are needed.

/20

We can certainly create a "give me your full file" and mimic the governance file that @telegramsam proposes. That's similar to the v1.0 spec providing a full access/offline file.

/21

And if your particular solution aligns with the data replication that some propose, great. Use that. For the other systems (and there are many) a RESTful API may be your best bet.

/22

Let's get discussing...

/23