Design Principles of Ayra Network Credentials

First raised in the Special Network Effects whitepaper, the following design principles apply to all credentials that are governed at the Ayra level and apply to Ayra Cards. 

#1: Global Interoperability

As figure 1 illustrates, the #1 design goal for Ayra Network Credentials is to provide the broadest possible utility across ecosystems recognized in the Ayra Trust Network—utility for their issuers, holders, and verifiers (aka relying parties).

This design goal has one inescapable consequence: Ayra Network Credentials must use an open standard credential format and exchange protocol that has the potential to be supported by any ecosystem within the Ayra Trust Network.

This is the purpose of Ayra Interoperability Profiles (AIPs) and the Ayra Conformance Test Suite (CTS): to make it easier to implement compatible technologies that can be tested and proven to work between ecosystems with the Ayra Trust Network.

#2: Global Governance

Global interoperability also requires that Ayra Network Credentials be governed at the Ayra Governance Framework level. This is in contrast to cluster-specific credentials or ecosystem-specific credentials which are governed at the cluster or ecosystem level.

Governance at the Ayra Governance Framework level means:

• Each Ayra Network Credential will have its own credential governance framework that specifies both the technical requirements as well as the policies governing issuers and verifiers.
• The governing body of a cluster or ecosystem that wishes to issue or accept Ayra Network Credentials must be certified to meet the requirements of those credential governance frameworks.
• Those governing bodies must in turn certify the issuers and verifiers within their ecosystems against those requirements.

See the Introduction to Ayra paper for a list of the Ayra Projects that will be focused on producing credential governance frameworks for specific Ayra Network Credentials.

#3: Simplicity

As the most generic of digital credentials, the dominant design principle for Ayra Network Credentials is simplicity. In other words, they should have as few required claims (a.k.a. attributes or properties) as possible, and those claims should be for data that is universally required to achieve the credential’s purpose.

For example, a verifiable relationship credential (VRC) issued by an employer to an employee as proof of employment could have as little as two required claims:

1. A unique cryptographically-verifiable identifier, such as a decentralized identifier (DID), pseudonymously identifying the employee in the context of the employer.
2. A type claim with a value of “employee”.

All other claims could be optional.

#4: Extensibility

Precisely because each Ayra Network Credential should be as simple as possible, the Ayra Governance Framework should define a standard extension mechanism that applies to all of them (such as an array of name/value pairs). This design principle not only helps protect the core simplicity, but makes Ayra Network Credentials an ideal way to “start the conversation” between parties when they are forming a digital trust relationship for the first time. 

Either party can request the appropriate Ayra Network Credential from the other. Then their respective software agents can inspect the extension to determine how best to proceed with progressive disclosure (described below).

This design pattern can be applied to credential definitions at any level of the Ayra Trust Network—network, cluster, or ecosystem. Furthermore, interoperability of extensions can be greatly enhanced using type catalogues into which members can register the extensions they need for semantic interoperability. This is a core purpose of the Ayra Type Catalogue.

#5: Privacy Preservation and Progressive Disclosure

One benefit of constraining Ayra Network Credentials to be as simple and lightweight as possible is that it can also maximize personal privacy preservation. By defaulting to disclosing the minimum personal data possible in order to start a trust relationship, Ayra Network Credentials encourage data minimization. For example, the verifiable relationship credential for an employee (described above)  has only two claims.

Although the initial level of assurance provided by such a credential may be low, the fact that either party can prove they hold at least one Ayra Network Credential—and thus are a member of the Ayra Trust Network—can help establish at least a “toehold level of trust”. Even such a toehold exceeds the current state of the Internet—where, to quote the famous New Yorker cartoon, “No one knows you’re a dog.”

Once this first toehold is achieved, it becomes easier to proceed with progressive disclosure, i.e., for either party to request other cluster-specific or ecosystem-specific credentials as required to achieve the level of assurance needed in a specific context.

This could give a major lift to privacy on the Internet, especially compared to the vast amounts of personal data that relying parties must collect today to fight fraud and bad actors. It could also head off the potential threat that digital wallets could lead to a “papers please” Internet where every website asks for a copy of your mobile drivers license simply because it can.

#6: “Minimum Viable Friction” for Acceptance

Another design objective of Ayra Network Credentials is to make them as easy and fast as possible for relying parties to accept. This goes directly to the cold start problem (aka chicken-and-egg problem) that all digital credentials face: issuers won’t decide to issue until there is enough relying party demand, and relying parties won’t demand until there is enough issuer supply.

Ayra Network Credentials are specifically designed to break this bottleneck by providing a set of very simple credentials that: a) have at least some immediate value to relying parties, and b) require the minimum friction to accept (including support for peer-to-peer issuance and verification of verifiable relationship credentials). As a general rule, this means there will be no charge for accepting an Ayra Network Credential.

This principle also avoids the gnarly question of how relying parties can compensate issuers for credential verification without “phoning home” to the issuer (a privacy anti-pattern the decentralized digital identity community desperately wants to avoid).

#7: Designed as a Family

To paraphrase John Donne, at the Ayra Network Credential level, “no credential is an island”. This is especially true of Ayra Network Credentials because they need to be explicitly designed to work together as explained in the next section.

Network Effects of Ayra Network Credentials

#1: The Trust Network Effect

Network effects are typically achieved either at the device level (e.g., the more telephones on a telephone network, the more valuable the phone to each user) or the member level (e.g., the more members on a social network, the more valuable the network to each member).

But because Ayra Network Credentials are designed to work together as a family, they achieve network effects at the credential level. In other words, the more Ayra Network Credentials on the Ayra Trust Network, the more valuable the Ayra Trust Network becomes for every member. For example:

• The more Org ID and Community ID credentials issued, the more business and community VRCs can be issued.
• The more business and community VRCs issued, the more First Person credentials can be issued.
• The more First Person credentials issued, the more personal VRCs can be issued.
• The more personal VRCs issued, the more it drives demand for Org ID and Community ID credentials.

And so the flywheel turns.

This is the trust network effect. Achieving the trust network effect was the fundamental reason the Ayra Trust Network was established as a “trust network of trust networks” that can interconnect any number of digital trust ecosystems just like the Internet can interconnect any number of local area networks.

#2: The “Zero-to-Hero” Network Effect

Back in 1900, the only way to achieve the network effect with the original device that started it all—the telephone—was for every new user to buy, install, and learn how to use a completely new gadget. In AT&T’s annual report in 1900, company president Theodore Vail put it this way:

A telephone without a connection at the other end of the line is not even a toy or a scientific instrument. It is one of the most useless things in the world. Its value depends on the connection with the other telephone and increases with the number of connections.

No wonder it took many decades for telephones to become ubiquitous. Today, with the Internet and the Web, joining a new network can be almost frictionless. For example, in a brilliant design move, webmail pioneer Hotmail automatically added a footer to every Hotmail message with a link offering the recipient a free Hotmail account. One click and a new user could sign up and start sending their own Hotmail in minutes—becoming yet another carrier of the Hotmail “virus”.

Many social networks have followed the same playbook—in fact so many that eventually it led to a backlash against “invitation spam”.

So far, digital credentials have not been able to tap into this dynamic. One reason is that they require digital wallets to work. Unfortunately, interoperable digital wallets—wallets that use open standard credential formats and exchange protocols that make it easy for developers to build new applications—are still in short supply.

With the Ayra Trust Network, Ayra Network Credentials, and the Ayra Conformance Test Suite, we can change that. This is how an existing user can invite a new user “zero to hero”:

1. A First Person credential holder generates an Ayra QR code to invite a new First Person relationship as illustrated in figure 4.
2. If the person scanning the QR code does not yet have an Ayra-compatible digital wallet, the QR code can direct the user to a Ayra Association microsite where they can download one.
3. Once installation is finished, the user’s new Ayra-compatible digital wallet will automatically connect to the microsite, which will then privately connect them to the party that generated the original QR code.
4. Now the two parties can complete the First Person connection dance and issue mutual personal VRCs.

And now the cycle can repeat. Because each new person in the Ayra Trust Network adds to the overall network effect.

#3: The First Person Network Effect

First Person credentials were so-named because they represent relationships that people form directly, one-on-one. While some of these relationships are with businesses and communities, far more are with other individuals.

Because these real-world person-to-person relationships can go from “zero-to-hero” so quickly, the First Person QR code is the Ayra equivalent of the Hotmail invitation link. Add to this the reputational incentive to forming new First Person relationships because each one (up to a limit) helps you increase the strength of your First Person credential.

This is the “First Person network effect”. It is a same-side network effect because it gives individuals the power to create and control their own personal relationship graphs and to use them with apps and services as they see fit—unconstrained by third-party business models or terms of service.

But it is also a cross-side network effect because the more First Person credentials, the more incentives businesses have to form First Person relationships with their customers. So the Ayra Trust Network can grow from both sides of the two-sided market.

#4: The Trusted Channel Network Effect

The final network effect harkens back to the telephone as the origin of the very term “network effect”. To repeat AT&T president Theodore Vail’s quote, as a breakthrough new communications device, the value of the telephone “depends on the connection with the other telephone and increases with the number of connections”.

This is true of any breakthrough new communications channel, from the fax machine to social networks. So how do Ayra Network Credentials represent a new type of  channel?

The secret is in the cryptographically verifiable identifiers (pairwise peer DIDs) exchanged in every VRC. These can serve as the endpoints for a secure, private communications channel between the two parties. This new trusted channel is extraordinarily powerful:

1. It can provide bidirectional authentication and encryption equal or better to HTTPS web connections without either party needing X.509 certificates.
2. It is fully private to the two parties, so the channel can be used for confidential messaging and data exchange that meets regulatory requirements in industries such as financial services and healthcare.
3. It uses cryptographically verifiable identifiers (e.g., DIDs) pre-exchanged between the parties, so they are essentially unphishable.
4. It can last as long as either party wants to keep the relationship, since the pairwise peer DIDs have no dependency on any external registry or service provider.
5. It can be used for automated workflows between digital agents of any kind, including personal and business AI agents.

Trusted channels are in fact such an important new dimension of Internet communications that they will be the subject of a separate white paper forthcoming from the Ayra Association.