ITU-T X.dpidm-aAI: Terminology and design guidelines for Agentic AI identity management

1st revised baseline text for X.dpidm-aAI: Terminology and design guidelines for Agentic AI identity management

ITU-T 1ST Revised baseline text for XSTR.gidi : Globally Interoperable Digital Identity (including Humans/Enterprise/Non-Humans i.e. Agentic AI)

ITU-T SG17  (Study Period 2025)  Temporary Document  201-WP1

ISO/IEC CD 29115.2Information security, cybersecurity and privacy protection – Entity authentication assurance framework

Will replace ISO/IEC 29115:2013

ISO/IEC 29115:2013 provides a framework for managing entity authentication assurance in a given context. In particular, it:

- specifies four levels of entity authentication assurance;

- specifies criteria and guidelines for achieving each of the four levels of entity authentication assurance;

- provides guidance for mapping other authentication assurance schemes to the four LoAs;

- provides guidance for exchanging the results of authentication that are based on the four LoAs; and

- provides guidance concerning controls that should be used to mitigate authentication threats.

The document provides requirements for implementing Human-to-Human Online Preventative Security (H2H-OPS), which complements ETSI TR 104 137 [i.1] 'Human-to-Human Online Preventative Security'. The principles included in the present document are secure by design, safety by design, and privacy by design. These are supported by annexes covering balancing the different requirements for Human-to-Human Online Preventative Security, demography, education and digital literacy. H2H-OPS is targeted at the operators, designers and service provides that have products, services and applications that allow users to post content online or to interact with each other. For example, social media networks, consumer file cloud storage and sharing sites, video-sharing platforms, online forums, dating services, video games with player-toplayer messaging, and online instant messaging services.

This document establishes general principles for and methods of processing personal identifiable information (PII) in BC/DLT systems and provides requirements and recommendations derived from legal requirements and recommendations in the GDPR. The document clarifies relevant terms for both technical as well as legal experts. It establishes a methodological framework that helps identifying types of PII as well as mapping legal principles of the GDPR to technical measures available to improve data protection or mitigate the risk of processing PII in BC/DLT-systems. This document is aimed towards establishing a high level of privacy in BC/DLT-systems. This document is applicable to all BC/DLT-systems.

This document specifies:

• logical data structures for a Biometric System-on-Card (BSoC);
• enrolment procedures; and
• usage of commands and data structures defined in other International Standards for BSoC.

This document does not define requirements for:

• commands and data structures that apply to devices external to a BSoC;
• commands and data structures that apply to logical interfaces inside a BSoC.

This document specifies the functionality of the Wallet Unit for Access Control to Wallet Held Assets (WHAs) i.e. personal data relating to the Wallet User and stored in the Wallet Unit. It defines the Wallet Access Control decision Engine (WACE) and the corresponding functional requirements, resulting in recommendations to the user on decision to be made. This document aims at: 1) describing and specifying an Access Control Model supporting access control to the various possible operations on WHA(s); 2) providing the definitions and classification of the various types of data and metadata, and supporting access control to the various possible operations on WHA(s) ; 3) describing and specifying a W ACE controlling the access to the various possible operations on WHA(s) and the notification returned by the Wallet Access Control Decision Engine to a Wallet Unit; 4) identifying requirements applicable to the Wallet Access Control Decision Engine; This document also: 

• identifies technical specifications and standards that can be used to support the concepts described herein;
• specifies additional requirements for the use of the identified specifications to meet the above objectives; 
• provides the missing technical specifications needed to meet the above objectives where needed; 

• provides examples and use cases; The Access Control Model and Wallet Access Control Decision Engine defined in this document aim to comply with the regulator requirements regarding access control. 

  The following areas are out of the scope of this document: 1) content and encoding of the policies assigned for the disclosure of WHA(s), 2) implementation choice and encoding of Wallet Held Access Control Metadata; 3) encoding of electronic attestation(s) of attributes which are in the remit of ETSI/TC ESI.