Episode 234 - GluuFederation/identerati-office-hours GitHub Wiki

Title: Protecting Data Value in Digital Production Lines

Host: Mike Schwartz, Founder/CEO Gluu
Guest: Stephen Wilson, Data Protection leader/Principal Consultant Lockstep Technologies

Channels

Description

Verifiable credentials are destined for a bigger purpose than human identity and attributes. Think about data products—from simple web searches and statistical analyses through to automated decisions and Gen AI products—and how they are produced by sequences of digital processes (algorithms) operating on inputs. We should be thinking about how to organise and govern these digital production lines. At every step, the importance or value of the output depends on all sorts of properties of the inputs, such as provenance, instrumentation, software quality, peer review, standards compliance, jurisdiction, audit results etc. These properties can be captured in metadata and protected through verifiable credentials issued to the many non-human actors that touch data as it moves down the line.

Homework

Lockstep blog: If data is a resource, then let’s talk about data assays
Authenticate Conference 2022 handout: Leading at the Edge: FIDO and the Normalization of Cryptography

Takeaways

⚡ I was surprised how aligned Steve is with GovOps. He seems to agree that we need to base trust on many credentials (tokens, artifacts... whatever you want to call them) that are issued by an array of authorities . He sees the need for better evidence collection for accountability. He likes the idea of identity anchored in hardware. No... I didn't pay him to say all that stuff.
⚡ Credential issuer fragmentation gives relying parties the freedom to make decisions with more granularity. Fragmentation is good--who wants one uber-issuer? It's just not realistic.
⚡ An agent’s “wallet” isn't what you think. Agents (software) don't need the human presentation hacks like QR codes for cross device presentation or credential pickers. VC's is just a metaphor for agents identity is based on the protection of a private key (hopefully using hardware).
⚡ Leave a signed mark at every transformation. Permission to use training data, an assessment against an ethics standard, and the processor’s signature each tell a different part of the production story. This aligns well with GovOps TRACE evidence.
⚡ Data comes with strings. A digital bill of materials should help explain how it was produced, which agents handled it, and where their authority came from.