Authored by Violet Shores. Specifies how an agent delegation chain anchors to a verified natural person — the identity-assurance root that workload- and token-level standards can reference by composition. Active in the IETF agent-protocol charter discussion, where the trust requirement (positional independence, durability, issuance independence, attribution at time of action) is under consideration. Read on the IETF Datatracker.

Authored by Violet Shores. Defines the autonomy bound in force at the moment an agent acts — how much independent action was authorised, sealed into the action’s attestation so a reviewer can later prove not only who stood at the origin but what latitude they had granted. Composes with the verified-human-root draft as the accountability pair. Read on the IETF Datatracker.

Standard for detecting spoofing attacks against biometric systems — photos, masks, deepfakes, video replay. Certified component, in production today: VAC integrates Didit passive liveness, an independently certified PAD detector — iBeta Level 1 PAD under ISO/IEC 30107-3, with a 0% attack-success rate across 360 attempts (0% IAPAR), tested by iBeta Quality Assurance, a NIST/NVLAP-accredited lab (NVLAP code 200962), compliance letter dated 4 Feb 2026. Level 1 covers presentation attacks — print, screen, and replay.

On top of that, VAC's own 7-modality engine (face liveness, deepfake detection, speech match, lip-sync, challenge response, finger gesture, duress) adds cross-modal binding — face, voice, and gesture bound in a single act — as defence-in-depth, including against injection attacks that single-detector presentation-attack testing does not cover. VAC's own ISO 30107 certification is planned for Q4 2026 (see timeline below).

Defines four levels of authentication assurance (LoA 1-4). VAC's adaptive modality system is designed to map onto them: streamlined verification (inside trust graph) onto LoA 2, full 7-modality onto LoA 4. An assurance level is determined formally with your auditor against your deployment — not a value any vendor self-declares. Trust graph density dynamically drives the modality set.

NIST's emerging framework for AI agent identity, authorization, and accountability. VAC Protocol submitted to the RFI (March 2026) positioning cryptographic delegation chains and trust graphs as the architectural foundation for agent accountability.

Standard for self-sovereign identity and verifiable credentials. VAC's trust graph architecture aligns with DID's model of decentralised trust relationships. Verifiable Authority Tokens (VATs) implement the verifiable credential pattern with cryptographic delegation chains.

Industry-standard security audit covering data handling, availability, processing integrity, confidentiality, and privacy. Required by enterprise customers before procurement. Estimated cost: $50K-$150K per audit cycle. Planned post-revenue.

European standard for identity verification in trust services, aligned with eIDAS regulation. Covers video identification, automated identification, and KYB verification. Required for EU market entry. Certification through accredited European bodies.

Passwordless authentication standard using biometrics and hardware keys. VAC's biometric verification can serve as a FIDO2 authenticator, enabling passkey-based authentication backed by the full VAC trust graph and delegation chain.

VAC defines its own standards for trust graph verification economics: inside graph (streamlined — a single modality), outside graph (full verification — the complete modality set). Density thresholds determine when verification cost reduces. These standards are part of the protocol specification and white paper.

Monotonic narrowing: permissions can only restrict, never expand, without human re-verification. Maximum delegation depth, scope inheritance rules, and revocation propagation are defined in the protocol spec. These constraints are mathematically enforced, not policy-based.