{
  "$id": "EOzVErBz2Mr9Xyz5NDML3Y0x_SYaKwX2Y4KTGvevTs15",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "Face-to-Face credential",
  "description": "Assert that an issuer knows the issuee to be a human being, based one or more face-to-face interactions.",
  "$comment": "These credentials have no edges. They can be chained by showing that the issuer's identifier is also an identifier associated with another credential of whatever type, but they do not require chaining.",
  "type": "object",
  "credentialType": "FaceToFaceCredential",
  "version": "1.2.0",
  "required": [
    "v",
    "d",
    "i",
    "ri",
    "s",
    "a",
    "r"
  ],
  "properties": {
    "v": {
      "description": "Version string using ACDC conventions",
      "type": "string"
    },
    "d": {
      "description": "SAID of the credential",
      "type": "string"
    },
    "u": {
      "description": "A salty nonce",
      "type": "string"
    },
    "i": {
      "description": "AID of the issuer",
      "type": "string"
    },
    "ri": {
      "description": "Registry for issuer's credential status",
      "type": "string"
    },
    "s": {
      "description": "SAID of this schema",
      "type": "string"
    },
    "a": {
      "oneOf": [
        {
          "description": "SAID of attributes block",
          "type": "string"
        },
        {
          "$id": "EI40MnOSGj6vYdUrs13KMECr2tlK5od9mGmDc8ZBTexD",
          "description": "Attributes block",
          "type": "object",
          "required": [
            "d",
            "u",
            "i",
            "dt",
            "minutes"
          ],
          "properties": {
            "d": {
              "description": "SAID of attributes block",
              "type": "string"
            },
            "u": {
              "description": "A salty nonce",
              "type": "string"
            },
            "i": {
              "description": "Identifier that issuee controls, according to issuer",
              "type": "string"
            },
            "knownAs": {
              "description": "A non-legal label the issuer knew the issuee by during their face-to-face interaction(s). NOT a legal name or a strong identity claim \u2014 a face-to-face credential asserts humanness, not identity. Useful for correlating independent attestations about the same person and for privacy-preserving reference.",
              "type": "string",
              "examples": [
                "Bob",
                "Alice",
                "Dr. Chen"
              ]
            },
            "dt": {
              "description": "Issuance datetime, ISO-8601 datetime string",
              "type": "string",
              "format": "date-time"
            },
            "assertDate": {
              "description": "Time as of which the issuer asserts the face-to-face interaction (and any other information about the issuee) to be fresh. This may be before the time of issuance.",
              "format": "date-time",
              "type": "string"
            },
            "firstMet": {
              "description": "Date of the issuer's FIRST in-person interaction with the issuee. Together with lastInteraction it bounds how long the issuer has known the issuee in real life; a longer, older acquaintance is harder to fabricate.",
              "type": "string",
              "format": "date-time"
            },
            "lastInteraction": {
              "description": "Date of the issuer's MOST RECENT in-person interaction with the issuee. A recent interaction supports the freshness of the humanness assertion; an old one should be weighted lower, since the identifier may since have changed hands.",
              "type": "string",
              "format": "date-time"
            },
            "ongoing": {
              "description": "Whether the issuer's real-life relationship with the issuee is ongoing (true) rather than a bounded or one-time interaction (false). An ongoing relationship (family, current colleague) decays more slowly than a single past meeting.",
              "type": "boolean"
            },
            "minutes": {
              "description": "At least how many minutes has issuer spent with issuee, face-to-face in real life?",
              "type": "integer",
              "exclusiveMinimum": 0
            },
            "modalities": {
              "description": "The human-specific channels through which the issuer observed the issuee \u2014 the ones an embodied AI cannot currently fake \u2014 so a verifier can weight how android-resistant the observation was, not merely how long it lasted. visual: saw the face/body clearly. tactile: physical contact such as a handshake or embrace. conversational: spontaneous, unscripted, real-time dialogue. movement: natural gait, posture, or motion. sharedActivity: a meal, exercise, travel, or work done together. multiSession: interaction across multiple separate occasions.",
              "type": "array",
              "uniqueItems": true,
              "minItems": 1,
              "items": {
                "type": "string",
                "enum": [
                  "visual",
                  "tactile",
                  "conversational",
                  "movement",
                  "sharedActivity",
                  "multiSession"
                ]
              }
            },
            "keyControl": {
              "description": "How, if at all, the issuer observed the issuee DEMONSTRATE control of the identifier (a.i) during the face-to-face interaction \u2014 binding the human to the key, not merely to the person. signedChallenge: the issuee signed a fresh challenge with the identifier's key in the issuer's presence (strongest). deviceControl: the issuer watched the issuee operate the device or wallet holding the key. Absence means key control was not demonstrated in person, not that it is false.",
              "type": "string",
              "enum": [
                "signedChallenge",
                "deviceControl"
              ]
            },
            "biometricHashes": {
              "description": "Hashes of photos, voiceprints, or biometric enrollments that the issuer attests characterized the issuee accurately, when they interacted face-to-face",
              "type": "array",
              "uniqueItems": true,
              "minItems": 1,
              "items": {
                "format": "cesr",
                "type": "string"
              }
            },
            "biometricProtocol": {
              "description": "Names the canonicalization-and-hash protocol used to compute every entry in biometricHashes, so hashes can be compared ACROSS credentials. Two independent credentials' biometric hashes are comparable only if they cite the same protocol; matching hashes are privacy-preserving evidence that they describe the same human (an optional, decentralized uniqueness / dedup signal). Omit when biometricHashes is absent.",
              "type": "string",
              "examples": [
                "bakobo:biohash:face:v1",
                "bakobo:biohash:voice:v1"
              ]
            },
            "basis": {
              "description": "Strongest reason that issuer wants to cite as proof that they have accurate knowledge of the issuee as a human being",
              "type": "string",
              "$comment": "Enum omitted to allow flexibility. However, use example values if they apply. NIST IAL values are mostly about identification, not personhood, but may provide clarity about interaction type.",
              "examples": [
                "family",
                "friend",
                "colleague",
                "acquaintance",
                "nist-ial1",
                "nist-ial2",
                "nist-ial3"
              ],
              "pattern": "^[-a-z0-9 ]+$"
            },
            "caveats": {
              "description": "Note about limits on issuer observations of issuee during face-to-face",
              "type": "string"
            }
          }
        }
      ]
    },
    "r": {
      "oneOf": [
        {
          "description": "Rules section SAID",
          "type": "string"
        },
        {
          "$id": "EEfBMOYviHkTR6vh40DL3MstehkEBevZBrE0uGqLeXki",
          "description": "Rules detail",
          "type": "object",
          "properties": {
            "d": {
              "description": "Rule section SAID",
              "type": "string"
            },
            "humanIssuer": {
              "description": "Human Issuer Disclaimer",
              "oneOf": [
                {
                  "description": "simple compact rule form",
                  "type": "string",
                  "const": "Issuers MUST be human beings. By issuing any face-to-face credential, issuers become accountable to the world (all conceivable verifiers) for asserting that fact about themselves."
                },
                {
                  "description": "Rule detail",
                  "type": "object",
                  "properties": {
                    "l": {
                      "description": "Associated legal language",
                      "type": "string",
                      "const": "Issuers MUST be human beings. By issuing any face-to-face credential, issuers become accountable to the world (all conceivable verifiers) for asserting that fact about themselves."
                    }
                  },
                  "required": [
                    "l"
                  ],
                  "additionalProperties": false
                }
              ]
            },
            "issuerAssertsFaceToFace": {
              "description": "IssuerAssertsFaceToFace Disclaimer",
              "oneOf": [
                {
                  "description": "simple compact rule form",
                  "type": "string",
                  "const": "Issuers MUST issue face-to-face credentials only to a human being distinct from the issuer, with whom the issuer has interacted face-to-face. \"Face-to-face\" means occurring physically and in close proximity, with the face (and often, the rest of the body) of the issuee observable closely, clearly, and long enough that ordinary human observation can tell the difference between a real human and any artificial construct. Except under unusual circumstances which MUST be documented in the `caveats` field (e.g., blindness, deafness, talking in a dark cave), it also means that normal sensory experiences were available. Teleconferences and phone calls are not \"face-to-face\" and in and of themselves do not provide a valid basis for face-to-face credentials."
                },
                {
                  "description": "rule detail",
                  "type": "object",
                  "properties": {
                    "l": {
                      "description": "Associated legal language",
                      "type": "string",
                      "const": "Issuers MUST issue face-to-face credentials only to a human being distinct from the issuer, with whom the issuer has interacted face-to-face. \"Face-to-face\" means occurring physically and in close proximity, with the face (and often, the rest of the body) of the issuee observable closely, clearly, and long enough that ordinary human observation can tell the difference between a real human and any artificial construct. Except under unusual circumstances which MUST be documented in the `caveats` field (e.g., blindness, deafness, talking in a dark cave), it also means that normal sensory experiences were available. Teleconferences and phone calls are not \"face-to-face\" and in and of themselves do not provide a valid basis for face-to-face credentials."
                    }
                  },
                  "required": [
                    "l"
                  ],
                  "additionalProperties": false
                }
              ]
            },
            "humanIssuee": {
              "description": "Human Issuee Disclaimer",
              "oneOf": [
                {
                  "description": "simple compact rule form",
                  "type": "string",
                  "const": "Issuees MUST be human beings. By accepting a face-to-face credential, issuees become accountable for asserting that fact to the issuer. By using a face-to-face credential to characterize themselves to others, issuees become accountable for asserting that fact to verifiers."
                },
                {
                  "description": "Rule detail",
                  "type": "object",
                  "properties": {
                    "l": {
                      "description": "Associated legal language",
                      "type": "string",
                      "const": "Issuees MUST be human beings. By accepting a face-to-face credential, issuees become accountable for asserting that fact to the issuer. By using a face-to-face credential to characterize themselves to others, issuees become accountable for asserting that fact to verifiers."
                    }
                  },
                  "required": [
                    "l"
                  ],
                  "additionalProperties": false
                }
              ]
            },
            "issueeAssertsFaceToFace": {
              "description": "IssueeAssertsFaceToFace Disclaimer",
              "oneOf": [
                {
                  "description": "simple compact rule form",
                  "type": "string",
                  "const": "Issuees MUST accept and use face-to-face credentials only from issuers with whom they have interacted face-to-face. By using a face-to-face credential to characterize themselves to others, issuees ALSO become accountable for asserting the reality of such interaction(s) to verifiers."
                },
                {
                  "description": "Rule detail",
                  "type": "object",
                  "properties": {
                    "l": {
                      "description": "Associated legal language",
                      "type": "string",
                      "const": "Issuees MUST accept and use face-to-face credentials only from issuers with whom they have interacted face-to-face. By using a face-to-face credential to characterize themselves to others, issuees ALSO become accountable for asserting the reality of such interaction(s) to verifiers."
                    }
                  },
                  "required": [
                    "l"
                  ],
                  "additionalProperties": false
                }
              ]
            },
            "noOverstatement": {
              "description": "noOverstatement Disclaimer",
              "oneOf": [
                {
                  "description": "simple compact rule form",
                  "type": "string",
                  "const": "Both issuers and issuees MUST agree that the face-to-face credential does not overstate the time or basis of their interaction. It may understate it (e.g., for privacy reasons)."
                },
                {
                  "description": "Rule detail",
                  "type": "object",
                  "properties": {
                    "l": {
                      "description": "Associated legal language",
                      "type": "string",
                      "const": "Both issuers and issuees MUST agree that the face-to-face credential does not overstate the time or basis of their interaction. It may understate it (e.g., for privacy reasons)."
                    }
                  },
                  "required": [
                    "l"
                  ],
                  "additionalProperties": false
                }
              ]
            },
            "confirmIdentifiers": {
              "description": "confirmIdentifiers Disclaimer",
              "oneOf": [
                {
                  "description": "simple compact rule form",
                  "type": "string",
                  "const": "The original communication of the issuer and issuee identifiers associated with a face-to-face credential may take place digitally (e.g., by NFC touch, by QR code). However, both parties MUST confirm to the other party during their face-to-face interaction(s) or via another secured out-of-band channel that they are using the identifier that the other party expects. This prevents man-in-the-middle attacks."
                },
                {
                  "description": "Rule detail",
                  "type": "object",
                  "properties": {
                    "l": {
                      "description": "Associated legal language",
                      "type": "string",
                      "const": "The original communication of the issuer and issuee identifiers associated with a face-to-face credential may take place digitally (e.g., by NFC touch, by QR code). However, both parties MUST confirm to the other party during their face-to-face interaction(s) or via another secured out-of-band channel that they are using the identifier that the other party expects. This prevents man-in-the-middle attacks."
                    }
                  },
                  "required": [
                    "l"
                  ],
                  "additionalProperties": false
                }
              ]
            },
            "fairBiometric": {
              "description": "fairBiometric Disclaimer",
              "oneOf": [
                {
                  "description": "simple compact rule form",
                  "type": "string",
                  "const": "If the credential includes a hash of a biometric (e.g., photo or voice print), both parties MUST agree the associated data is a reasonable representation of how the issuer perceived the issuee near the time of issuance."
                },
                {
                  "description": "Rule detail",
                  "type": "object",
                  "properties": {
                    "l": {
                      "description": "Associated legal language",
                      "type": "string",
                      "const": "If the credential includes a hash of a biometric (e.g., photo or voice print), both parties MUST agree the associated data is a reasonable representation of how the issuer perceived the issuee near the time of issuance."
                    }
                  },
                  "required": [
                    "l"
                  ],
                  "additionalProperties": false
                }
              ]
            },
            "promptRevocation": {
              "description": "promptRevocation Disclaimer",
              "oneOf": [
                {
                  "description": "simple compact rule form",
                  "type": "string",
                  "const": "Issuers parties MUST agree to make prompt efforts to revoke any face-to-face credentials that they believe to be inaccurate. Issuees agree to immediately renounce any face-to-face credentials that they believe were not issued by a human."
                },
                {
                  "description": "Rule detail",
                  "type": "object",
                  "properties": {
                    "l": {
                      "description": "Associated legal language",
                      "type": "string",
                      "const": "Issuers parties MUST agree to make prompt efforts to revoke any face-to-face credentials that they believe to be inaccurate. Issuees agree to immediately renounce any face-to-face credentials that they believe were not issued by a human."
                    }
                  },
                  "required": [
                    "l"
                  ],
                  "additionalProperties": false
                }
              ]
            }
          },
          "additionalProperties": false,
          "required": [
            "d",
            "humanIssuer",
            "issuerAssertsFaceToFace",
            "humanIssuee",
            "issueeAssertsFaceToFace",
            "noOverstatement",
            "confirmIdentifiers",
            "fairBiometric",
            "promptRevocation"
          ]
        }
      ]
    }
  },
  "additionalProperties": false
}