> For the complete documentation index, see [llms.txt](https://template.ishare.eu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://template.ishare.eu/technical-building-blocks/data-sovereignty-and-trust/identity-and-attestation-management.md). # Identity & Attestation Management This building block ensures that every participant, whether a legal entity, service provider, or natural person, can be uniquely identified, verified, and trusted across data ecosystems. It provides the foundation for a secure and interoperable identity and attestation management by enabling identities and credentials to be issued, stored, exchanged, and verified in a consistent and secure way. This supports the onboarding, secure interactions, authorisation, and accountability within the data space. The data space can follow iSHARE’s principles on digital identity management: * **iSHARE-ID:** Each participant is assigned a globally unique identifier, improving interoperability between data spaces and enabling cross-ecosystem recognition. See more [here](https://framework.ishare.eu/detailed-descriptions/functional/functional-requirements-per-role/party-identification). * **Multiple Identifiers:** Participants can be recognised by multiple identifiers (EORI or chamber of commerce numbers), which can be linked to a common identifier, iSHARE ID, supporting portable and verifiable identity across ecosystems. See more [here](https://trustbok.ishare.eu/apply-ishare/identification/multiple-identifiers). * **Accredited Identity Providers:** Certified Identity Providers issue and manage identities for both legal entities and their human representatives. They act as trust anchors within the ecosystem. * **eIDAS and W3C Compliance:** The iSHARE identity model recognises European eIDAS standards and global Verifiable Credential formats to ensure compatibility and legal validity. * **Alternative Onboarding Routes:** Service consumers without PKI certificates can now onboard securely using approved alternative verification flows. ### **Attestations** Attestations are verifiable proofs about an entity, such as its identity, membership, role, certification, or compliance status. In a data space, they help prove not only who or what entity is, but also whether it is allowed to participate and under which conditions. At a minimum, this can include a data space membership credential, but in iSHARE this is typically reflected through a broader set of claims and attestations, such as data space membership, data space agreement, data space role, framework agreement, framework compliance, framework role, IDP assertions, or X.509 certificates, depending on the use case and trust requirements. See more [here](https://dev.ishare.eu/participant-registry-role/claim-models). Using W3C Verifiable Credentials and eIDAS alignment, attestations enable trust from the first interaction and support role-based authorisation, compliance monitoring, and automated onboarding within the Participant Registry. ### **Implementation in the Data Space** Implementation in the data space typically involves both federation-level trust services and participant-level credential management. * Trust services are responsible for issuing and verifying Verifiable Credentials and supporting trust or rights delegation, * Participant-controlled credential stores allow participants to store, manage, present, and exchange credentials securely under their own control. To ensure interoperability, compatible credential exchange protocols or credential store implementations should be used across the data space.
Cover image
The Data Space Governance Body Selects and oversees accredited Identity Providers within the iSHARE governance model. Also, it defines the requirements and governs the process of onboarding of participants into data space./files/Br2qP0goDCSeKle65JD4
Identity ProvidersIssue, manage, and verify participant identities following the Framework specifications./files/Nz3YSRGPjseX75ZPaRsY
Human representatives of organisationsAuthenticate via their verified identity credentials./files/vzvQd2pPt1vhUL7ZgAYq
The Participant Registry Maintains up-to-date information on all data-space participants—including their assurance level, services, and roles—and manages the processes and criteria for onboarding, updating, reviewing, and confirming their membership, aligned with the Data Space Governance Body. /files/iPSF93GyUYIQld0ef1F1
Credential exchange is an important part of this building block. Depending on the use case, this can be supported through protocols from the OpenID for Verifiable Credentials family, such as OID4VCI for credential issuance and OID4VP for credential presentation, or through other compatible approaches such as DCP. These protocols help participants issue, present, and verify credentials securely while keeping control over what they share and with whom. With the introduction of iSHARE-ID and DID-based verification, participants can engage across ecosystems with confidence, knowing that every entity they interact with has been verified according to transparent, globally recognised standards. These enhanced mechanisms create a distributed yet cohesive trust layer, one that supports secure data sharing, smooth onboarding, and scalable governance across interconnected data spaces. {% hint style="info" %} Identity & Attestation Management connects closely with other building blocks: * **Trust Framework:** Works with Identity & Attestation Management to establish overall trust and define trusted entities. * **Access & Usage Policies Enforcement:** Depends on verified participant identities to control access and usage. * **Participation Management:** Relies on identity verification for onboarding, offboarding, and attesting participation. * **Regulatory Compliance:** Translates rules into digital mechanisms for validation and verification. {% endhint %} {% hint style="warning" %} The guiding questions can help in the co-creation process and in defining this building block, so please see the next section. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://template.ishare.eu/technical-building-blocks/data-sovereignty-and-trust/identity-and-attestation-management.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.