Open governance framework · v1.3 · Practitioner-led · not an accredited standard, certification, or regulatory requirement · seeking shadow-evaluation partners
Home/Framework/NHID-Auth

Layer 3 · v2 · CC BY 4.0

NHID-Auth

v1.3 tells you the caller was automated. NHID-Auth tells you the caller was authorized.

The gap it closes

NPIs are public. A caller can state one truthfully and still have no relationship to the organization it names. Behavioral controls establish that a caller disclosed itself as automated; they cannot establish that it was ever delegated authority to act for the provider it claims.

NHID-Auth addresses that with signed delegation rather than a registry or a gatekeeper. A provider signs a statement binding an agent’s public key to an NPI and a bounded scope. The receiving side verifies that signature offline — no lookup, no central authority, no service to call.

How it works

  1. 1Provider signs a delegationThe provider organization holds a key pair and signs a passport binding an agent public key to its NPI, a purpose, a scope, and an expiration.
  2. 2Agent presents the passportThe AI agent carries the signed passport into the call alongside its behavioral disclosure.
  3. 3Receiver verifies offlineEd25519 signature verification against the provider’s published public key. No network call to NHID-Clinical, no registry lookup, no dependency on us.
  4. 4Scope is enforcedAn agent delegated for eligibility checks cannot use the same passport to pursue claims appeals. Scope is a precondition, not a suggestion.
  5. 5Expiration and revocationPassports carry an expiry. A provider revokes by rotating keys or publishing a revocation, without coordinating with any third party.

Design properties

No registry, no gatekeeper

Verification is a signature check. NHID-Clinical is not in the trust path and cannot become a chokepoint.

Offline verifiable

Works when the network does not. Nothing about verification requires reaching an external service in real time.

Bounded by construction

Scope and expiration are fields in the signed payload, so an over-broad or stale passport fails verification rather than relying on policy.

Open reference code

The implementation is public in the repository under CC BY 4.0. Fork it, port it, or write your own against the format.

ⓘ Status: NHID-Auth v2 is a published open reference implementation, not a deployed identity infrastructure. There are no production issuers yet. It documents a workable approach to delegated agent authority and invites implementers to break it.

Work with NHID-Auth

The reference code, the integration notes, and the layer it sits in.

Reference implementation →Where the code lives and how to run it. The five-layer stack →How Layer 3 relates to the rest. Developer guide →APIs, schemas, and integration. Managed identity →TrustLayer’s hosted agent registry.

NHID-Clinical is a voluntary open framework — not an accredited standard, certification, or regulatory requirement. Everything on this page is published under CC BY 4.0.