Skip to content
Universal Manifest

Portable Identity Profile XR Implementation Path

This guide gives implementers an actionable path for Portable Identity Profile behavior across XR surfaces.

Boundary

Section titled “Boundary”

Consumer sequence

Section titled “Consumer sequence”
  1. Validate required UM fields.
  2. Enforce freshness (expiresAt).
  3. Verify v0.2 signature when policy requires it.
  4. Read only supported Portable Identity Profile overlays.
  5. Enforce consent gates with default deny.
  6. Resolve pointers only after consent pass.
  7. Apply pairwise subject handling.
  8. Apply revocation checks for extended policy tier.
  9. Emit decision/audit event.

Issuer checklist

Section titled “Issuer checklist”
  • Keep required UM fields valid and time-bounded.
  • Use pointer-first design for avatar/wearables/proof bundles.
  • Emit explicit consent values for sensitive actions.
  • Use pairwise/pseudonymous subject strategy where privacy requires it.
  • Include v0.2 signature metadata for trust-sensitive paths.

Revocation policy tiers

Section titled “Revocation policy tiers”

baseline

  • TTL checks required.
  • Signature and revocation checks policy-driven.

extended

  • TTL checks required.
  • Signature verification required.
  • statusRef and revocationCursor freshness required.

Offline behavior

Section titled “Offline behavior”
  • Never use expired manifests.
  • Restrict sensitive actions when revocation freshness cannot be checked.
  • Re-resolve authoritative state on reconnect before re-enabling full behavior.

Verify with fixtures and journeys

Section titled “Verify with fixtures and journeys”
Terminal window
cd packages/universal-manifest
npm test
npm run journeys

Primary journey evidence:

Next

Section titled “Next”