Universal Manifest is one signed capsule for the verifiable state of any entity, and one procedure that every system follows to check it and act on it.

Claims carry their own proof.

Each claim names its issuer and can include the issuer's proof, or several proofs, each verified independently. At higher assurance levels, the evaluator also confirms that the party presenting a claim is the party it was issued to.

Permissions travel with the data.

Every facet carries its own consent: which operations are allowed, such as read, display, cache, process or forward; for what declared purpose; and until when. Writing to a facet needs its own consent. A facet without valid consent is not processed, and consent can be withdrawn.

Assurance matched to the stakes.

Assurance comes in levels, each including the one below: signature only; issuer-backed proof bound to the presenter; zero-knowledge proof of control across identifiers; multi-party co-signing. Each evaluator sets the level its risk requires, and a capsule can declare the minimum it demands.

Sensitive data, readable only by named recipients.

A facet can be encrypted for specific recipients, each with its own key. Any other evaluator records it as a sealed entry: present, but unread. Removing a recipient locks it out of every later capsule.

Each evaluator gets only what it needs.

The holder includes only the facets relevant to a given evaluator, purpose and context. The evaluator processes what it received and treats anything missing as not shared, never as absent.

Any change breaks the signature.

Every capsule is signed over its full contents and carries a hard expiry. Altered content fails verification, and expired capsules are rejected. Signing keys can stay in hardware key stores.

Verification needs no network connection.

An evaluator verifies a capsule from its own bytes plus trust material it already holds. No central service is involved, so verification works at the network edge and with no connectivity at all.

Every evaluation leaves a record.

Each evaluation produces a machine-readable receipt of what was checked, what was processed and what could not be opened. Failed checks cannot be left out. Receipts can be signed and chained into a tamper-evident history.