Level of Assurance (LoA)
Ayrıca şöyle anılır LoA, assurance level, identity assurance level
Level of Assurance is a way of grading how strong an identity check actually was, so a verifier can demand "at least this strong" instead of treating every identity check as equally trustworthy. A quick, self-reported email signup is weak assurance; a full document-plus-biometric check witnessed in person is strong assurance. Without an LoA system, a verifier has no way to express "I need the strong kind": it just gets a credential that says "verified," with no way to know how much that verification is actually worth.
The rule that makes an LoA system useful rather than just decorative is directional: a stronger credential can always stand in for a request that only needed a weaker one (someone who went through a full bank-grade check can obviously also prove they're over 18), but a weaker credential can never satisfy a request for something stronger. Enforcing that rule consistently is what stops assurance levels from becoming a rubber stamp.
Who actually built this
NIST's Special Publication 800-63-3 is the reference framework most identity systems build their own LoA vocabulary against, splitting assurance into Identity Assurance Level (how well was the person's identity proofed), Authenticator Assurance Level (how strong is their login method), and Federation Assurance Level (how much can a third party trust an assertion about them). The EU's eIDAS framework takes a simpler three-tier approach, low, substantial, high, set out in a specific EU implementing regulation. Solidus's own L1–L3+ scale borrows the concept from both without adopting either verbatim.
Solidus today
Solidus's assurance-level vocabulary is live inside its issuer trust registry, enforced at both the point an issuer is accredited and the point a credential is issued. The practical ceiling today is L2: nothing issues at L3 or above yet, even though the vocabulary already has room for it.
See also
Trust Registry is where an issuer's assurance-level accreditation actually lives. KYC and IDV are the processes that produce a given assurance level in the first place. Credential Portability is why the level a credential carries matters beyond the moment it's issued.
Nereden geliyor
Bunu başkası belirtti. Solidus bir araya getiriyor.
The idea that not every identity check is equally strong, so a verifier should be able to demand a minimum tier rather than a plain yes/no, comes from NIST SP 800-63-3, which splits assurance into separate Identity, Authenticator, and Federation Assurance Levels (IAL/AAL/FAL), and separately from the EU's eIDAS framework, which defines three tiers, low, substantial, high, in Commission Implementing Regulation (EU) 2015/1502. Solidus adopted the general concept; it did not define either framework.
Bunu nasıl doğrularsınız
Bugün üretimde çalışıyor.
The same live trust-registry endpoint (see Trust Registry) carries each enrolled issuer's accredited assurance-level scope, and the down-not-up enforcement rule runs in code at both enrollment and issuance time. The underlying package isn't public, so a stranger can't read that source directly today, but its effect (an issuer scoped to a lower level being rejected for a higher-level request) is the same live, observable behavior documented under Trust Registry.