...

A driver for the exploration of attribute management is the growing economy behind the mining and exchange of attribute information. We see here the overlap of financial reward and privacy regulation; overlaps such as this generally see the creation of some kind of governance model. That governance may be formal regulation, it may be accepted industry standards groups, or some other model.

Recommendations

Where is more effort/discussion required?

...

Governance

Different sectors of society and industry are looking at what governance is necessary in the world of Internet Identity and the attribute economy. Each group, however, has a fairly narrow view of how governance is required in their particular sector. Having a group that could look at the bigger picture and provide a neutral bridge between different efforts may be a space that Kantara could fill. In particular, there is a need to provide Levels of Assurance for attributes. Kantara has experience in providing and vetting an LoA framework for identity; can that be expanded in to providing LoA for attributes?

• Recommendation: Create a Kantara Discussion Group to conduct an environmental survey of groups and activities in attribute management space (there are dozens at least) and create a cohesive index and description of where they fit in the attribute management space, where they are orthogonal or overlapping (this should be a prerequisite to the attribute LoA work)
• Recommendation: Create a Kantara Working Group to establish an LoA program and associated criteria for attributes

Context

The question of context and how different contexts may modify information in and about an attribute overlaps many focus areas for attribute management. From governance to technology, this is a rich space that urgently needs understanding and direction. With a stronger understanding and implementation of the idea of context, the questions of automatically identifying risk and liability may be answered.

• Recommendation: Create a Kantara Discussion Group to describe what contexts might be and how they might be used, characterizing them and registering/exposing them.

Query Language

While the need for a query language that could handle multiple schemas and protocols is identified as a gap by this discussion group, closing that gap was determined to be outside the mandate and expertise of the Kantara Initiative. This area should be left to other organizations, such as OASIS or the W3C.

Attributes

There needs to be effort around the normalization of a base identity attribute set. While we see some work going on in the SCIM and OIX-AX arenas, work needs to bridge that and any other efforts together to make a cohesive attribute set.